1278 vulnerabilities classified as CWE-863 (授权机制不正确). AI Chinese analysis included.
CWE-863, Incorrect Authorization, represents a critical logic flaw where software fails to properly verify an actor’s permissions before granting access to resources or executing actions. Attackers typically exploit this vulnerability by manipulating input parameters, such as altering user IDs or session tokens, to bypass intended access controls and interact with data or functions reserved for privileged users. This often leads to unauthorized data disclosure, modification, or complete system compromise. To prevent such breaches, developers must implement robust, centralized authorization checks that are consistently applied across all application layers. Relying solely on client-side restrictions is insufficient; instead, server-side validation should enforce strict role-based or attribute-based access controls for every request, ensuring that permission verification occurs reliably before any sensitive operation is permitted.
$role = $_COOKIES['role']; if (!$role) { $role = getRole('user'); if ($role) { // save the cookie to send out in future responses setcookie("role", $role, time()+60*60*2); } else{ ShowLoginScreen(); die("\n"); } } if ($role == 'Reader') { DisplayMedicalHistory($_POST['patient_ID']); } else{ die("You are not Authorized to view this record\n"); }| CVE ID | Title | CVSS | Severity | Published |
|---|---|---|---|---|
| CVE-2020-15278 | Unauthorized privilege escalation in Mod module — Red-DiscordBot | 7.7 | High | 2020-10-28 |
| CVE-2020-3578 | Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software WebVPN Portal Access Rule Bypass Vulnerability — Cisco Adaptive Security Appliance (ASA) Software | 5.3 | Medium | 2020-10-21 |
| CVE-2020-12503 | Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products — P+F Comtrol RocketLinx | 7.2 | High | 2020-10-15 |
| CVE-2020-15251 | Privilege Escalation in Channelmgnt plug-in for Sopel — sopel-channelmgnt | 7.7 | High | 2020-10-13 |
| CVE-2020-3467 | Cisco Identity Services Engine Authorization Bypass Vulnerability — Cisco Identity Services Engine Software | 8.5 | - | 2020-10-08 |
| CVE-2020-3404 | Cisco IOS XE Software Consent Token Bypass Vulnerability — Cisco IOS XE Software | 7.8 | - | 2020-09-24 |
| CVE-2020-15163 | Invalid root may become trusted root in The Update Framework (TUF) — tuf | 8.7 | High | 2020-09-09 |
| CVE-2020-5418 | Cloud Controller allows users with no roles to list droplets — CAPI | 4.3 | - | 2020-09-03 |
| CVE-2020-7300 | DLP ePO extension - Improper Authorization — DLP ePO extension | 4.6 | Medium | 2020-08-12 |
| CVE-2020-15120 | Authorization Bypass in I hate money — ihatemoney | 4.9 | Medium | 2020-07-27 |
| CVE-2020-15126 | Information disclosure through Viewer query in parse-server — parse-server | 6.5 | Medium | 2020-07-22 |
| CVE-2020-15110 | Possible pod name collisions in jupyterhub-kubespawner — kubespawner | 6.8 | Medium | 2020-07-17 |
| CVE-2020-7499 | 多款Schneider Electric产品访问控制错误漏洞 — U.motion Servers and Touch Panels (affected versions listed in the security notification) | 6.5 | - | 2020-06-16 |
| CVE-2020-11844 | Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products. — Hybrid Cloud Management | 10.0 | Critical | 2020-05-29 |
| CVE-2020-6214 | SAP S/4HANA 安全漏洞 — SAP S/4HANA (Financial Products Subledger) | 6.3 | - | 2020-04-14 |
| CVE-2020-8142 | Revive Adserver 安全漏洞 — https://github.com/revive-adserver/revive-adserver | 6.1 | - | 2020-04-03 |
| CVE-2020-5239 | Unspecified vulnerability in the fetchmail script in Mailu — Mailu | 8.7 | High | 2020-02-13 |
| CVE-2019-6855 | 编号重复 — EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10) | 9.4 | - | 2020-01-06 |
| CVE-2019-14832 | Red Hat Keycloak 安全漏洞 — keycloak REST API | 7.1 | - | 2019-10-15 |
| CVE-2019-6838 | Schneider Electric 多款产品安全漏洞 — U.motion Servers (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, and MEG6260-0415 - U.motion KNX Server Plus, Touch 1) | 6.5 | - | 2019-09-17 |
| CVE-2019-6836 | Schneider Electric 多款产品安全漏洞 — U.motion Servers (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, and MEG6260-0415 - U.motion KNX Server Plus, Touch 1) | 7.5 | - | 2019-09-17 |
| CVE-2019-14995 | Atlassian Jira 安全漏洞 — Jira | 5.3 | - | 2019-09-11 |
| CVE-2019-8445 | Atlassian Jira 授权问题漏洞 — Jira | 5.3 | - | 2019-08-23 |
| CVE-2019-8446 | Atlassian Jira 授权问题漏洞 — Jira | 5.3 | - | 2019-08-23 |
| CVE-2019-13417 | floragunn Search Guard 信息泄露漏洞 — Search Guard | 5.3 | - | 2019-08-12 |
| CVE-2018-20826 | Atlassian Jira 授权问题漏洞 — Jira | 4.3 | - | 2019-08-09 |
| CVE-2019-3403 | Atlassian Jira 授权问题漏洞 — Jira | 5.3 | - | 2019-05-22 |
| CVE-2019-3401 | Atlassian Jira 信息泄露漏洞 — Jira | 5.3 | - | 2019-05-22 |
| CVE-2019-3399 | Atlassian Jira 信息泄露漏洞 — Jira | 7.5 | - | 2019-04-30 |
| CVE-2019-3887 | Linux kernel 输入验证错误漏洞 — Kernel | 5.6 | - | 2019-04-09 |
Vulnerabilities classified as CWE-863 (授权机制不正确) represent 1278 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.