CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5726 vulnerabilities reference this CWE, most recent first.
GHSA-G8XC-6MF7-H28H
Vulnerability from github – Published: 2023-05-09 21:25 – Updated: 2023-05-09 21:25Impact
There is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours.
Affected versions
OpenSearch 1.0.0-1.3.9 and 2.0.0-2.6.0
Patched versions
OpenSearch 1.3.10 and 2.7.0
For more information
If you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.opensearch.plugin:opensearch-security"
},
"ranges": [
{
"events": [
{
"introduced": "1.0.0"
},
{
"fixed": "1.3.10.0"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.opensearch.plugin:opensearch-security"
},
"ranges": [
{
"events": [
{
"introduced": "2.0.0"
},
{
"fixed": "2.7.0.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-31141"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2023-05-09T21:25:06Z",
"nvd_published_at": "2023-05-08T21:15:11Z",
"severity": "MODERATE"
},
"details": "### Impact\nThere is an issue with the implementation of fine-grained access control rules (document-level security, field-level security and field masking) where they are not correctly applied to the queries during extremely rare race conditions potentially leading to incorrect access authorization. For this issue to be triggered, two concurrent requests need to land on the same instance exactly when query cache eviction happens, once every four hours.\n\n### Affected versions\nOpenSearch 1.0.0-1.3.9 and 2.0.0-2.6.0\n\n### Patched versions\nOpenSearch 1.3.10 and 2.7.0\n\n### For more information\nIf you have any questions or comments about this advisory, please contact AWS/Amazon Security via our issue reporting page (https://aws.amazon.com/security/vulnerability-reporting/) or directly via email to aws-security@amazon.com. Please do not create a public GitHub issue.",
"id": "GHSA-g8xc-6mf7-h28h",
"modified": "2023-05-09T21:25:06Z",
"published": "2023-05-09T21:25:06Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/opensearch-project/security/security/advisories/GHSA-g8xc-6mf7-h28h"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-31141"
},
{
"type": "PACKAGE",
"url": "https://github.com/opensearch-project/security"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "OpenSearch issue with fine-grained access control during extremely rare race conditions"
}
GHSA-G929-VM5V-86GQ
Vulnerability from github – Published: 2022-05-24 17:37 – Updated: 2022-05-24 17:37An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can access Tickets.
{
"affected": [],
"aliases": [
"CVE-2020-26028"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-28T08:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in Zammad before 3.4.1. Admin Users without a ticket.* permission can access Tickets.",
"id": "GHSA-g929-vm5v-86gq",
"modified": "2022-05-24T17:37:23Z",
"published": "2022-05-24T17:37:23Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-26028"
},
{
"type": "WEB",
"url": "https://zammad.com/news/security-advisory-zaa-2020-19"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-G934-4C2X-9PCQ
Vulnerability from github – Published: 2022-05-05 00:00 – Updated: 2022-05-12 00:01Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.
{
"affected": [],
"aliases": [
"CVE-2021-42192"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-04T11:15:00Z",
"severity": "HIGH"
},
"details": "Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.",
"id": "GHSA-g934-4c2x-9pcq",
"modified": "2022-05-12T00:01:23Z",
"published": "2022-05-05T00:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42192"
},
{
"type": "WEB",
"url": "https://github.com/pantsel/konga/commit/d61535277aced18b5be0313ab2d124f60f649978"
},
{
"type": "WEB",
"url": "https://docs.google.com/document/d/1-YU9zWiDVUps3Mb6zos3996yvZ48vW_vfOvaJLLHc4I/edit?usp=sharing"
},
{
"type": "WEB",
"url": "https://github.com/pantsel/konga"
},
{
"type": "WEB",
"url": "https://github.com/whokilleddb/Konga-Privilege-Escalation-Exploit"
},
{
"type": "WEB",
"url": "https://www.exploit-db.com/exploits/50521"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G94R-MVHR-PC74
Vulnerability from github – Published: 2026-03-04 15:30 – Updated: 2026-03-05 21:30A logic error in the remove_password() function in Checkmk GmbH's Checkmk versions <2.4.0p23, <2.3.0p43, and 2.2.0 (EOL) allows a low-privileged user to cause data loss.
{
"affected": [],
"aliases": [
"CVE-2026-3103"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-04T14:16:14Z",
"severity": "MODERATE"
},
"details": "A logic error in the remove_password() function in Checkmk GmbH\u0027s Checkmk versions \u003c2.4.0p23, \u003c2.3.0p43, and 2.2.0 (EOL) allows a low-privileged user to cause data loss.",
"id": "GHSA-g94r-mvhr-pc74",
"modified": "2026-03-05T21:30:33Z",
"published": "2026-03-04T15:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3103"
},
{
"type": "WEB",
"url": "https://checkmk.com/werk/19041"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-G97G-7JJM-WPHR
Vulnerability from github – Published: 2022-09-07 00:01 – Updated: 2022-09-10 00:00Broken Access Control vulnerability in Alessio Caiazza's About Me plugin <= 1.0.12 at WordPress.
{
"affected": [],
"aliases": [
"CVE-2022-36387"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-09-06T23:15:00Z",
"severity": "CRITICAL"
},
"details": "Broken Access Control vulnerability in Alessio Caiazza\u0027s About Me plugin \u003c= 1.0.12 at WordPress.",
"id": "GHSA-g97g-7jjm-wphr",
"modified": "2022-09-10T00:00:35Z",
"published": "2022-09-07T00:01:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-36387"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/about-me/wordpress-about-me-plugin-1-0-12-broken-access-control-vulnerability/_s_id=cve"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/about-me"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-G9C5-VHP6-C68R
Vulnerability from github – Published: 2026-03-06 00:31 – Updated: 2026-03-06 00:31Unauthorized data access due to insufficient access control validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.
{
"affected": [],
"aliases": [
"CVE-2026-28724"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-06T00:16:13Z",
"severity": "MODERATE"
},
"details": "Unauthorized data access due to insufficient access control validation. The following products are affected: Acronis Cyber Protect 17 (Linux, Windows) before build 41186.",
"id": "GHSA-g9c5-vhp6-c68r",
"modified": "2026-03-06T00:31:35Z",
"published": "2026-03-06T00:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-28724"
},
{
"type": "WEB",
"url": "https://security-advisory.acronis.com/advisories/SEC-8493"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G9CV-V3V4-3H8R
Vulnerability from github – Published: 2023-07-12 12:31 – Updated: 2023-07-12 17:30Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar.
This issue affects Apache Pulsar: before 2.10.4, and 2.11.0.
When a client connects to the Pulsar Function Worker via the Pulsar Proxy where the Pulsar Proxy uses mTLS authentication to authenticate with the Pulsar Function Worker, the Pulsar Function Worker incorrectly performs authorization by using the Proxy's role for authorization instead of the client's role, which can lead to privilege escalation, especially if the proxy is configured with a superuser role.
The recommended mitigation for impacted users is to upgrade the Pulsar Function Worker to a patched version.
2.10 Pulsar Function Worker users should upgrade to at least 2.10.4. 2.11 Pulsar Function Worker users should upgrade to at least 2.11.1. 3.0 Pulsar Function Worker users are unaffected. Any users running the Pulsar Function Worker for 2.9.* and earlier should upgrade to one of the above patched versions.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.pulsar:pulsar"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.10.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.pulsar:pulsar"
},
"ranges": [
{
"events": [
{
"introduced": "2.11.0"
},
{
"fixed": "2.11.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.11.0"
]
}
],
"aliases": [
"CVE-2023-30429"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2023-07-12T17:30:06Z",
"nvd_published_at": "2023-07-12T10:15:09Z",
"severity": "CRITICAL"
},
"details": "Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar.\n\nThis issue affects Apache Pulsar: before 2.10.4, and 2.11.0.\n\nWhen a client connects to the Pulsar Function Worker via the Pulsar Proxy where the Pulsar Proxy uses mTLS authentication to authenticate with the Pulsar Function Worker, the Pulsar Function Worker incorrectly performs authorization by using the Proxy\u0027s role for authorization instead of the client\u0027s role, which can lead to privilege escalation, especially if the proxy is configured with a superuser role.\n\nThe recommended mitigation for impacted users is to upgrade the Pulsar Function Worker to a patched version.\n\n2.10 Pulsar Function Worker users should upgrade to at least 2.10.4.\n2.11 Pulsar Function Worker users should upgrade to at least 2.11.1.\n3.0 Pulsar Function Worker users are unaffected.\nAny users running the Pulsar Function Worker for 2.9.* and earlier should upgrade to one of the above patched versions.\n",
"id": "GHSA-g9cv-v3v4-3h8r",
"modified": "2023-07-12T17:30:06Z",
"published": "2023-07-12T12:31:36Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30429"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/pulsar"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/v0gcvvxswr830314q4b1kybsfmcf3jf8"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Pulsar Incorrect Authorization vulnerability"
}
GHSA-G9G2-QC64-JGCJ
Vulnerability from github – Published: 2026-07-29 21:31 – Updated: 2026-07-29 21:31GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check.
{
"affected": [],
"aliases": [
"CVE-2026-6336"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-29T20:17:13Z",
"severity": "MODERATE"
},
"details": "GitLab has remediated an issue in GitLab CE/EE affecting all versions from 16.6 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an unauthorized user to view project import source information due to a missing authorization check.",
"id": "GHSA-g9g2-qc64-jgcj",
"modified": "2026-07-29T21:31:01Z",
"published": "2026-07-29T21:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6336"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/3661988"
},
{
"type": "WEB",
"url": "https://docs.gitlab.com/releases/patches/patch-release-gitlab-19-2-1-released"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/work_items/596762"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-G9G5-CP8F-6WCH
Vulnerability from github – Published: 2022-05-24 17:49 – Updated: 2022-05-24 17:49AMP Application Deployment Service in CubeCoders AMP 2.1.x before 2.1.1.2 allows a remote, authenticated user to open ports in the local system firewall by crafting an HTTP(S) request directly to the applicable API endpoint (despite not having permission to make changes to the system's network configuration).
{
"affected": [],
"aliases": [
"CVE-2021-31926"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-04-30T20:15:00Z",
"severity": "MODERATE"
},
"details": "AMP Application Deployment Service in CubeCoders AMP 2.1.x before 2.1.1.2 allows a remote, authenticated user to open ports in the local system firewall by crafting an HTTP(S) request directly to the applicable API endpoint (despite not having permission to make changes to the system\u0027s network configuration).",
"id": "GHSA-g9g5-cp8f-6wch",
"modified": "2022-05-24T17:49:20Z",
"published": "2022-05-24T17:49:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31926"
},
{
"type": "WEB",
"url": "https://github.com/CubeCoders/AMP/issues/443"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-G9QC-QF28-HHQX
Vulnerability from github – Published: 2026-05-19 21:32 – Updated: 2026-06-05 16:37In the AWS Secrets Manager and SSM Parameter Store secrets backends of apache-airflow-providers-amazon prior to 9.28.0, the team-scoping logic could resolve a conn_id containing a / (e.g. "my_team/conn") to the same path as another team's team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team's secret by crafting a colliding conn_id. Fixed in 9.28.0 by switching the team-scope separator to -- and rejecting team-shaped conn_ids when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to apache-airflow-providers-amazon 9.28.0, which fixes the issue.
{
"affected": [
{
"package": {
"ecosystem": "PyPI",
"name": "apache-airflow-providers-amazon"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.28.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42526"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-05T16:37:51Z",
"nvd_published_at": "2026-05-19T20:16:19Z",
"severity": "MODERATE"
},
"details": "In the AWS Secrets Manager and SSM Parameter Store secrets backends of `apache-airflow-providers-amazon` prior to 9.28.0, the team-scoping logic could resolve a `conn_id` containing a `/` (e.g. `\"my_team/conn\"`) to the same path as another team\u0027s team-scoped secret when the caller had no team context. A privileged caller without team context could therefore retrieve another team\u0027s secret by crafting a colliding `conn_id`. Fixed in 9.28.0 by switching the team-scope separator to `--` and rejecting team-shaped `conn_id`s when team context is absent. Affects the experimental multi-tenant teams feature only. Users are recommended to upgrade to `apache-airflow-providers-amazon` 9.28.0, which fixes the issue.",
"id": "GHSA-g9qc-qf28-hhqx",
"modified": "2026-06-05T16:37:51Z",
"published": "2026-05-19T21:32:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42526"
},
{
"type": "WEB",
"url": "https://github.com/apache/airflow/pull/65703"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/airflow"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/0092sz5g520d3qqjb01wd61myqlgjtyn"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/05/19/36"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Airflow Amazon provider: Prevent unauthorized access to team-scoped secrets in AWS Secrets Manager and SSM Parameter Store backends"
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.