CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
6551 vulnerabilities reference this CWE, most recent first.
GHSA-X44P-GG67-52FC
Vulnerability from github – Published: 2026-06-19 00:31 – Updated: 2026-06-19 21:32Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-ffp3-3562-8cv3. This link is maintained to preserve external references.
Original Description
PraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequent execute_command calls to bypass approval prompts. Attackers can exploit this by obtaining initial approval for a benign command, then silently exfiltrate API keys and credentials via subsequent shell commands without user consent.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c 4.5.128"
},
"package": {
"ecosystem": "PyPI",
"name": "praisonai"
},
"ranges": [
{
"events": [
{
"introduced": "0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-06-19T21:32:50Z",
"nvd_published_at": "2026-06-18T23:16:19Z",
"severity": "MODERATE"
},
"details": "## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of\u00a0GHSA-ffp3-3562-8cv3. This link is maintained to preserve external references.\n\n## Original Description\nPraisonAI before 1.5.128 caches tool approval decisions by tool name only, not by invocation arguments, allowing subsequent execute_command calls to bypass approval prompts. Attackers can exploit this by obtaining initial approval for a benign command, then silently exfiltrate API keys and credentials via subsequent shell commands without user consent.",
"id": "GHSA-x44p-gg67-52fc",
"modified": "2026-06-19T21:32:50Z",
"published": "2026-06-19T00:31:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-ffp3-3562-8cv3"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-56074"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/praisonai-tool-approval-cache-bypass-via-coarse-grained-caching"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
],
"summary": "Duplicate Advisory: PraisonAI: Coarse-Grained Tool Approval Cache Bypasses Per-Invocation Consent for Shell Commands",
"withdrawn": "2026-06-19T21:32:50Z"
}
GHSA-X45C-CVP8-Q4FM
Vulnerability from github – Published: 2022-12-05 23:08 – Updated: 2022-12-06 16:20Capsule implements a multi-tenant and policy-based environment in a Kubernetes cluster. A ServiceAccount deployed in a Tenant Namespace, when granted with PATCH capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operator and removing all the enforcement like Pod Security annotations, Network Policies, Limit Range and Resource Quota items.
With that said, an attacker could detach the Namespace from a Tenant that is forbidding starting privileged Pods using the Pod Security labels by removing the OwnerReference, removing the enforcement labels, and being able to start privileged containers that would be able to start a generic Kubernetes privilege escalation.
Patches
Patches have been released for version 0.1.3 and all users must upgrade to this release.
Workarounds
N.A.
References
N.A.
For more information
If you have any questions or comments about this advisory: * Open an issue in github.com/clastix/capsule * Reach out on #capsule channel available on Kubernetes Slack workspace
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.1.2"
},
"package": {
"ecosystem": "Go",
"name": "github.com/clastix/capsule"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.1.3"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-46167"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2022-12-05T23:08:37Z",
"nvd_published_at": "2022-12-02T19:15:00Z",
"severity": "HIGH"
},
"details": "Capsule implements a multi-tenant and policy-based environment in a Kubernetes cluster. A ServiceAccount deployed in a Tenant Namespace, when granted with `PATCH` capabilities on its own Namespace, is able to edit it and remove the Owner Reference, breaking the reconciliation of the Capsule Operator and removing all the enforcement like Pod Security annotations, Network Policies, Limit Range and Resource Quota items.\n\nWith that said, an attacker could detach the Namespace from a Tenant that is forbidding starting privileged Pods using the Pod Security labels by removing the OwnerReference, removing the enforcement labels, and being able to start privileged containers that would be able to start a generic Kubernetes privilege escalation.\n\n### Patches\n\nPatches have been released for version 0.1.3 and all users must upgrade to this release.\n\n### Workarounds\n\nN.A.\n\n### References\n\nN.A.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [github.com/clastix/capsule](https://github.com/clastix/capsule)\n* Reach out on [#capsule](https://kubernetes.slack.com/archives/C03GETTJQRL) channel available on Kubernetes Slack workspace\n",
"id": "GHSA-x45c-cvp8-q4fm",
"modified": "2022-12-06T16:20:39Z",
"published": "2022-12-05T23:08:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/clastix/capsule/security/advisories/GHSA-x45c-cvp8-q4fm"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-46167"
},
{
"type": "WEB",
"url": "https://github.com/clastix/capsule/commit/1df430e71be8c4778c82eca3459978ad7d0b4b7b"
},
{
"type": "WEB",
"url": "https://github.com/clastix/capsule/commit/75525ac19254b0c5111e34d7985e2be7bc8b1ac1"
},
{
"type": "PACKAGE",
"url": "https://github.com/clastix/capsule"
},
{
"type": "WEB",
"url": "https://github.com/clastix/capsule/releases/tag/v0.1.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Capsule vulnerable to privilege escalation by ServiceAccount deployed in a Tenant Namespace"
}
GHSA-X46V-M262-7XX6
Vulnerability from github – Published: 2022-05-24 19:01 – Updated: 2022-05-24 19:01An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email).
{
"affected": [],
"aliases": [
"CVE-2021-24244"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-06T13:15:00Z",
"severity": "MODERATE"
},
"details": "An AJAX action registered by the WPBakery Page Builder (Visual Composer) Clipboard WordPress plugin before 4.5.8 did not have capability checks, allowing low privilege users, such as subscribers, to update the license options (key, email).",
"id": "GHSA-x46v-m262-7xx6",
"modified": "2022-05-24T19:01:32Z",
"published": "2022-05-24T19:01:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-24244"
},
{
"type": "WEB",
"url": "https://codecanyon.net/item/visual-composer-clipboard/8897711"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/354b98d8-46a1-4189-b347-198701ea59b9"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-X49H-89M5-C8JW
Vulnerability from github – Published: 2023-04-11 21:31 – Updated: 2023-04-11 21:31Windows Boot Manager Security Feature Bypass Vulnerability
{
"affected": [],
"aliases": [
"CVE-2023-28249"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-04-11T21:15:00Z",
"severity": "MODERATE"
},
"details": "Windows Boot Manager Security Feature Bypass Vulnerability",
"id": "GHSA-x49h-89m5-c8jw",
"modified": "2023-04-11T21:31:00Z",
"published": "2023-04-11T21:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-28249"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28249"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-X4G2-X8CV-JG46
Vulnerability from github – Published: 2022-05-24 17:22 – Updated: 2022-05-24 17:22IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 172014.
{
"affected": [],
"aliases": [
"CVE-2019-4704"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-07-01T15:15:00Z",
"severity": "MODERATE"
},
"details": "IBM Security Identity Manager Virtual Appliance 7.0.2 does not set the secure attribute on authorization tokens or session cookies. Attackers may be able to get the cookie values by sending a http:// link to a user or by planting this link in a site the user goes to. The cookie will be sent to the insecure link and the attacker can then obtain the cookie value by snooping the traffic. IBM X-Force ID: 172014.",
"id": "GHSA-x4g2-x8cv-jg46",
"modified": "2022-05-24T17:22:10Z",
"published": "2022-05-24T17:22:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-4704"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/172014"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/6242348"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-X4G7-CR9M-3WFR
Vulnerability from github – Published: 2024-01-24 00:30 – Updated: 2024-10-28 21:30An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. An attacker within RF range can obtain a cleartext copy of the network configuration of the device, including the Wi-Fi PSK, during device setup and reconfiguration. Upon success, the attacker is able to further infiltrate the target's Wi-Fi networks.
{
"affected": [],
"aliases": [
"CVE-2023-35836"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-23T23:15:08Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in SolaX Pocket WiFi 3 through 3.001.02. An attacker within RF range can obtain a cleartext copy of the network configuration of the device, including the Wi-Fi PSK, during device setup and reconfiguration. Upon success, the attacker is able to further infiltrate the target\u0027s Wi-Fi networks.",
"id": "GHSA-x4g7-cr9m-3wfr",
"modified": "2024-10-28T21:30:33Z",
"published": "2024-01-24T00:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-35836"
},
{
"type": "WEB",
"url": "https://www.solaxpower.com/downloads"
},
{
"type": "WEB",
"url": "https://www.solaxpower.com/help/upgrading-the-pocket-wifi-firmware"
},
{
"type": "WEB",
"url": "https://yougottahackthat.com/blog"
},
{
"type": "WEB",
"url": "https://yougottahackthat.com/blog/1370/solax-inverters-pocket-wifi-using-poor-authentication"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X4H6-WF22-PX84
Vulnerability from github – Published: 2026-08-05 09:31 – Updated: 2026-08-05 18:31In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.
{
"affected": [],
"aliases": [
"CVE-2026-71201"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-08-05T07:16:39Z",
"severity": "MODERATE"
},
"details": "In OpenStack Ironic through 38.0.0, a project reader that makes a crafted request to Ironic can return Portgroups assigned to Nodes owned or leased by another project.",
"id": "GHSA-x4h6-wf22-px84",
"modified": "2026-08-05T18:31:30Z",
"published": "2026-08-05T09:31:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-71201"
},
{
"type": "WEB",
"url": "https://bugs.launchpad.net/ironic/+bug/2162715"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2026/08/05/16"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X4H7-GG27-PW2V
Vulnerability from github – Published: 2022-05-24 17:45 – Updated: 2024-04-04 03:05An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on authored merge requests
{
"affected": [],
"aliases": [
"CVE-2021-22176"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-24T17:15:00Z",
"severity": "MODERATE"
},
"details": "An issue has been discovered in GitLab affecting all versions starting with 3.0.1. Improper access control allows demoted project members to access details on authored merge requests",
"id": "GHSA-x4h7-gg27-pw2v",
"modified": "2024-04-04T03:05:24Z",
"published": "2022-05-24T17:45:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22176"
},
{
"type": "WEB",
"url": "https://hackerone.com/reports/962604"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-22176.json"
},
{
"type": "WEB",
"url": "https://gitlab.com/gitlab-org/gitlab/-/issues/243491"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X4MM-WG99-32FJ
Vulnerability from github – Published: 2026-03-27 15:30 – Updated: 2026-07-02 21:32A blog.admin v.8.0 and before system's getinfobytoken API interface contains an improper access control which leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security.
{
"affected": [],
"aliases": [
"CVE-2026-30689"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-27T15:16:53Z",
"severity": "HIGH"
},
"details": "A blog.admin v.8.0 and before system\u0027s getinfobytoken API interface contains an improper access control which leads to sensitive data exposure. Unauthorized parties can obtain sensitive administrator account information via a valid token, threatening system security.",
"id": "GHSA-x4mm-wg99-32fj",
"modified": "2026-07-02T21:32:02Z",
"published": "2026-03-27T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30689"
},
{
"type": "WEB",
"url": "https://gist.github.com/Sw3092567023/c420c6a5ee947d72aeab2b3e0ba92a40"
},
{
"type": "WEB",
"url": "https://github.com/anjoy8/Blog.Core"
},
{
"type": "WEB",
"url": "https://github.com/anjoy8/Blog.Core/blob/bcb4d17ccc71e206a0c2ff663faf4b399e19f687/Blog.Core.Api/Controllers/UserController.cs#L139-L140"
},
{
"type": "WEB",
"url": "http://blagadmin.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-X4VV-6742-QCPF
Vulnerability from github – Published: 2026-03-05 03:31 – Updated: 2026-03-11 21:30Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script in International Data Casting (IDC) SFX2100 Satellite Receiver allows a local unprivileged attacker to potentially execute arbitrary commands with root privileges (local privilege escalation and persistence) via modification of a root-owned, world-writable BusyBox udhcpc DHCP event script, which is executed when a DHCP lease is obtained, renewed, or lost.
{
"affected": [],
"aliases": [
"CVE-2026-29126"
],
"database_specific": {
"cwe_ids": [
"CWE-732",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-05T02:16:51Z",
"severity": "HIGH"
},
"details": "Incorrect permission assignment (world-writable file) in /etc/udhcpc/default.script\u00a0in International Data Casting (IDC) SFX2100 Satellite Receiver allows a local unprivileged attacker to potentially execute arbitrary commands with root privileges (local privilege escalation and persistence) via modification of a root-owned, world-writable BusyBox udhcpc\u00a0DHCP event script, which is executed when a DHCP lease is obtained, renewed, or lost.",
"id": "GHSA-x4vv-6742-qcpf",
"modified": "2026-03-11T21:30:58Z",
"published": "2026-03-05T03:31:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29126"
},
{
"type": "WEB",
"url": "https://www.abdulmhsblog.com/posts/sfx2100-vulns"
},
{
"type": "WEB",
"url": "https://www.abdulmhsblog.com/posts/spfx-vulnrabilities"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:N/R:U/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.