CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5839 vulnerabilities reference this CWE, most recent first.
GHSA-6VF8-8P4X-PXM5
Vulnerability from github – Published: 2022-05-24 17:40 – Updated: 2022-05-24 17:40PlugIns\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!zlibVersion+0x0000000000004e5e via a crafted BMP image.
{
"affected": [],
"aliases": [
"CVE-2021-26025"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-26T18:16:00Z",
"severity": "HIGH"
},
"details": "PlugIns\\IDE_ACDStd.apl in ACDSee Professional 2021 14.0 1721 has a User Mode Write Access Violation starting at IDE_ACDStd!zlibVersion+0x0000000000004e5e via a crafted BMP image.",
"id": "GHSA-6vf8-8p4x-pxm5",
"modified": "2022-05-24T17:40:21Z",
"published": "2022-05-24T17:40:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-26025"
},
{
"type": "WEB",
"url": "https://github.com/secluck/pentest/blob/main/000022.md"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6VG3-HGRW-P5GF
Vulnerability from github – Published: 2026-07-01 20:12 – Updated: 2026-07-01 20:12An authenticated user could bypass permission rules that gated access on parts of a record's id — most commonly tenant-isolation rules of the form PERMISSIONS FOR select WHERE id.tenant = $auth.id.tenant. The same defect also let UNIQUE constraints defined on parts of an id admit duplicate entries.
When a query referenced part of a composite record id (id.tenant, id.uid, …), SurrealDB read the value from the record's editable body fields instead of from the immutable id key. Because the body is editable but the id is fixed at creation, an attacker with write access could set the body field to any value and have permission checks read that spoofed value.
Impact
What an attacker can do:
- Read records hidden by permission rules of the form
id.<field> = $auth.<...>(typically tenant- or scope-isolation boundaries) by writing the same-named field on a record they control to the spoofed value. - Cause UNIQUE constraints defined on
id.<field>to silently admit duplicate entries, leaving the database with rows that violate the constraint.
What it can't do:
- Cross namespace or database isolation boundaries.
-Bypass field-level
PERMISSIONS FORupdate clauses that don't referenceid.<field>paths. - Affect availability or crash the server.
Patches
The value-path resolver now special-cases Part::Field and Part::Value against RecordIdKey::Object, reading the named component directly from the id key without ever entering select_document. The Array-keyed special case (id[0], id[1], …) is unchanged.
- Versions 3.1.0 and later are not affected.
Workarounds
Users unable to patch are advised to consider the following workarounds:
- Avoid permission expressions that read id.<field> on Object-keyed record ids; gate on the full record id (id = $auth.id) or on a server-derived session value instead.
- Avoid UNIQUE indexes on id.<field> until 3.1.0; use DEFINE INDEX ... ON FIELDS id UNIQUE (the full id) where possible.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "surrealdb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-01T20:12:25Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "An authenticated user could bypass permission rules that gated access on parts of a record\u0027s id \u2014 most commonly tenant-isolation rules of the form `PERMISSIONS FOR select WHERE id.tenant = $auth.id.tenant`. The same defect also let UNIQUE constraints defined on parts of an id admit duplicate entries.\n\nWhen a query referenced part of a composite record id (`id.tenant`, `id.uid`, \u2026), SurrealDB read the value from the record\u0027s editable body fields instead of from the immutable id key. Because the body is editable but the id is fixed at creation, an attacker with write access could set the body field to any value and have permission checks read that spoofed value.\n\n### Impact\n\nWhat an attacker **can** do:\n\n- Read records hidden by permission rules of the form `id.\u003cfield\u003e = $auth.\u003c...\u003e` (typically tenant- or scope-isolation boundaries) by writing the same-named field on a record they control to the spoofed value.\n- Cause UNIQUE constraints defined on `id.\u003cfield\u003e` to silently admit duplicate entries, leaving the database with rows that violate the constraint.\n\nWhat it **can\u0027t** do:\n\n- Cross namespace or database isolation boundaries.\n-Bypass field-level `PERMISSIONS FOR` update clauses that don\u0027t reference `id.\u003cfield\u003e` paths.\n- Affect availability or crash the server.\n\n### Patches\n\nThe value-path resolver now special-cases `Part::Field` and `Part::Value` against `RecordIdKey::Object`, reading the named component directly from the id key without ever entering `select_document`. The Array-keyed special case (`id[0]`, `id[1]`, \u2026) is unchanged.\n\n- Versions 3.1.0 and later are not affected.\n\n### Workarounds\n\nUsers unable to patch are advised to consider the following workarounds:\n- Avoid permission expressions that read `id.\u003cfield\u003e` on Object-keyed record ids; gate on the full record id (`id = $auth.id`) or on a server-derived session value instead.\n- Avoid UNIQUE indexes on `id.\u003cfield\u003e` until 3.1.0; use `DEFINE INDEX ... ON FIELDS id UNIQUE` (the full id) where possible.",
"id": "GHSA-6vg3-hgrw-p5gf",
"modified": "2026-07-01T20:12:25Z",
"published": "2026-07-01T20:12:25Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6vg3-hgrw-p5gf"
},
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/commit/1fcb19040bfffba92b3f69edb9b707d469e0027b"
},
{
"type": "PACKAGE",
"url": "https://github.com/surrealdb/surrealdb"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "SurrealDB has an Authorization Bypass via Composite Record-id Paths"
}
GHSA-6VHM-RHMC-3Q94
Vulnerability from github – Published: 2023-12-03 21:30 – Updated: 2023-12-07 15:30Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.
{
"affected": [],
"aliases": [
"CVE-2023-49947"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-03T19:15:08Z",
"severity": "HIGH"
},
"details": "Forgejo before 1.20.5-1 allows 2FA bypass when docker login uses Basic Authentication.",
"id": "GHSA-6vhm-rhmc-3q94",
"modified": "2023-12-07T15:30:37Z",
"published": "2023-12-03T21:30:17Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49947"
},
{
"type": "WEB",
"url": "https://codeberg.org/forgejo/forgejo/commit/44df78edd40076b349d50dc5fb02af417a44cfab"
},
{
"type": "WEB",
"url": "https://forgejo.org/2023-11-release-v1-20-5-1"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6VP2-FHW3-WVCX
Vulnerability from github – Published: 2024-10-25 18:30 – Updated: 2024-10-29 21:30OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserrole via the userid and role parameters . Authentication is required with OE_ADMIN role privilege.
{
"affected": [],
"aliases": [
"CVE-2022-30356"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-10-25T17:15:03Z",
"severity": "HIGH"
},
"details": "OvalEdge 5.2.8.0 and earlier is affected by a Privilege Escalation vulnerability via a POST request to /user/assignuserrole via the userid and role parameters . Authentication is required with OE_ADMIN role privilege.",
"id": "GHSA-6vp2-fhw3-wvcx",
"modified": "2024-10-29T21:30:48Z",
"published": "2024-10-25T18:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30356"
},
{
"type": "WEB",
"url": "https://cve.offsecguy.com/ovaledge/vulnerabilities/privilege-escalation#cve-2022-30356"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6VPQ-PCM8-6PGW
Vulnerability from github – Published: 2022-05-24 17:39 – Updated: 2022-06-06 00:00Adobe Bridge version 11.0 (and earlier) is affected by an out-of-bounds write vulnerability when parsing TTF files that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
{
"affected": [],
"aliases": [
"CVE-2021-21012"
],
"database_specific": {
"cwe_ids": [
"CWE-639",
"CWE-787",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-01-13T23:15:00Z",
"severity": "HIGH"
},
"details": "Adobe Bridge version 11.0 (and earlier) is affected by an out-of-bounds write vulnerability when parsing TTF files that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-6vpq-pcm8-6pgw",
"modified": "2022-06-06T00:00:35Z",
"published": "2022-05-24T17:39:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21012"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/bridge/apsb21-07.html"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/magento/apsb21-08.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6VPX-F5JX-6W5M
Vulnerability from github – Published: 2022-01-15 00:01 – Updated: 2022-07-15 00:00An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.
{
"affected": [],
"aliases": [
"CVE-2021-28506"
],
"database_specific": {
"cwe_ids": [
"CWE-306",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-01-14T20:15:00Z",
"severity": "CRITICAL"
},
"details": "An issue has recently been discovered in Arista EOS where certain gNOI APIs incorrectly skip authorization and authentication which could potentially allow a factory reset of the device.",
"id": "GHSA-6vpx-f5jx-6w5m",
"modified": "2022-07-15T00:00:16Z",
"published": "2022-01-15T00:01:30Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28506"
},
{
"type": "WEB",
"url": "https://www.arista.com/en/support/advisories-notices/security-advisories/13449-security-advisory-0071"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6VQ6-GHRC-JPJW
Vulnerability from github – Published: 2022-05-24 19:03 – Updated: 2025-11-04 21:30Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.
{
"affected": [],
"aliases": [
"CVE-2020-26555"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-24T18:15:00Z",
"severity": "MODERATE"
},
"details": "Bluetooth legacy BR/EDR PIN code pairing in Bluetooth Core Specification 1.0B through 5.2 may permit an unauthenticated nearby device to spoof the BD_ADDR of the peer device to complete pairing without knowledge of the PIN.",
"id": "GHSA-6vq6-ghrc-jpjw",
"modified": "2025-11-04T21:30:25Z",
"published": "2022-05-24T19:03:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26555"
},
{
"type": "WEB",
"url": "https://kb.cert.org/vuls/id/799380"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NSS6CTGE4UGTJLCOZOASDR3T3SLL6QJZ"
},
{
"type": "WEB",
"url": "https://www.bluetooth.com/learn-about-bluetooth/key-attributes/bluetooth-security/reporting-security"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00520.html"
},
{
"type": "WEB",
"url": "https://www.kb.cert.org/vuls/id/799380"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6VWW-2WX8-Q6X4
Vulnerability from github – Published: 2026-07-08 15:32 – Updated: 2026-07-08 15:32MISP’s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not enforce the per-organisation module restriction checked by getEnabledModules(). As a result, an authenticated user from an organisation that was not allowed to use a module restricted via Plugin.Import__restrict could still invoke that import module directly if they knew its name.
This could allow unauthorised access to restricted import-module functionality and, depending on the module and the user’s event permissions, may allow unauthorised import or modification of event data through a module that should have been unavailable to the user’s organisation.
{
"affected": [],
"aliases": [
"CVE-2026-60125"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-08T14:17:22Z",
"severity": "MODERATE"
},
"details": "MISP\u2019s importModule() path used getEnabledModule() to resolve a single import module by name, but this lookup did not enforce the per-organisation module restriction checked by getEnabledModules(). As a result, an authenticated user from an organisation that was not allowed to use a module restricted via Plugin.Import_\u003cmodule\u003e_restrict could still invoke that import module directly if they knew its name.\n\n\nThis could allow unauthorised access to restricted import-module functionality and, depending on the module and the user\u2019s event permissions, may allow unauthorised import or modification of event data through a module that should have been unavailable to the user\u2019s organisation.",
"id": "GHSA-6vww-2wx8-q6x4",
"modified": "2026-07-08T15:32:02Z",
"published": "2026-07-08T15:32:02Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-60125"
},
{
"type": "WEB",
"url": "https://github.com/MISP/MISP/commit/0ed79b4d3177f4b9e44040962161a1a436d2587d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6W3Q-44CJ-75VR
Vulnerability from github – Published: 2022-05-24 17:28 – Updated: 2022-05-24 17:28In various places in Telephony, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-155094269
{
"affected": [],
"aliases": [
"CVE-2020-0396"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-17T16:15:00Z",
"severity": "MODERATE"
},
"details": "In various places in Telephony, there is a possible permission bypass due to an unsafe PendingIntent. This could lead to local information disclosure with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-8.1 Android-9 Android-10 Android-11 Android-8.0Android ID: A-155094269",
"id": "GHSA-6w3q-44cj-75vr",
"modified": "2022-05-24T17:28:48Z",
"published": "2022-05-24T17:28:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0396"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2020-09-01"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-6W9R-9P3M-QRJ9
Vulnerability from github – Published: 2022-12-20 00:30 – Updated: 2022-12-27 21:30The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZero.
{
"affected": [],
"aliases": [
"CVE-2022-46399"
],
"database_specific": {
"cwe_ids": [
"CWE-400",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-12-19T23:15:00Z",
"severity": "HIGH"
},
"details": "The Microchip RN4870 module firmware 1.43 (and the Microchip PIC LightBlue Explorer Demo 4.2 DT100112) is unresponsive with ConReqTimeoutZero.",
"id": "GHSA-6w9r-9p3m-qrj9",
"modified": "2022-12-27T21:30:21Z",
"published": "2022-12-20T00:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46399"
},
{
"type": "WEB",
"url": "https://microchip.com"
},
{
"type": "WEB",
"url": "https://www.computer.org/csdl/proceedings-article/sp/2023/933600a521/1He7Yja1AYM"
},
{
"type": "WEB",
"url": "https://www.computer.org/csdl/proceedings/sp/2023/1He7WWuJExG"
},
{
"type": "WEB",
"url": "https://www.microchip.com/en-us/products/wireless-connectivity/software-vulnerability-response/deviating-behaviors-in-bluetooth-le"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.