Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1000 CNY

100.0%

CWE-863 (授权机制不正确) — Vulnerability Class 1278

1278 vulnerabilities classified as CWE-863 (授权机制不正确). AI Chinese analysis included.

CWE-863, Incorrect Authorization, represents a critical logic flaw where software fails to properly verify an actor’s permissions before granting access to resources or executing actions. Attackers typically exploit this vulnerability by manipulating input parameters, such as altering user IDs or session tokens, to bypass intended access controls and interact with data or functions reserved for privileged users. This often leads to unauthorized data disclosure, modification, or complete system compromise. To prevent such breaches, developers must implement robust, centralized authorization checks that are consistently applied across all application layers. Relying solely on client-side restrictions is insufficient; instead, server-side validation should enforce strict role-based or attribute-based access controls for every request, ensuring that permission verification occurs reliably before any sensitive operation is permitted.

MITRE CWE Description
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
Common Consequences (5)
ConfidentialityRead Application Data, Read Files or Directories
An attacker could bypass intended access restrictions to read sensitive data, either by reading the data directly from a data store that is not correctly restricted, or by accessing insufficiently-protected, privileged functionality to read the data.
IntegrityModify Application Data, Modify Files or Directories
An attacker could bypass intended access restrictions to modify sensitive data, either by writing the data directly to a data store that is not correctly restricted, or by accessing insufficiently-protected, privileged functionality to write the data.
Access ControlGain Privileges or Assume Identity, Bypass Protection Mechanism
An attacker could bypass intended access restrictions to gain privileges by modifying or reading critical data directly, or by accessing privileged functionality.
Confidentiality, Integrity, AvailabilityExecute Unauthorized Code or Commands
An attacker could use elevated privileges to execute unauthorized commands or code.
AvailabilityDoS: Crash, Exit, or Restart, DoS: Resource Consumption (CPU), DoS: Resource Consumption (Memory), DoS: Resource Consumption (Other)
An attacker could gain unauthorized access to resources on the system and excessively consume those resources, leading to a denial of service.
Mitigations (5)
Architecture and DesignDivide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the …
Architecture and DesignEnsure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible…
Architecture and DesignUse a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Architecture and DesignFor web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page. One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests …
System Configuration, InstallationUse the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Examples (1)
The following code could be for a medical records application. It displays a record to already authenticated users, confirming the user's authorization using a value stored in a cookie.
$role = $_COOKIES['role']; if (!$role) { $role = getRole('user'); if ($role) { // save the cookie to send out in future responses setcookie("role", $role, time()+60*60*2); } else{ ShowLoginScreen(); die("\n"); } } if ($role == 'Reader') { DisplayMedicalHistory($_POST['patient_ID']); } else{ die("You are not Authorized to view this record\n"); }
Bad · PHP
CVE IDTitleCVSSSeverityPublished
CVE-2020-15278 Unauthorized privilege escalation in Mod module — Red-DiscordBot 7.7 High2020-10-28
CVE-2020-3578 Cisco Adaptive Security Appliance Software and Firepower Threat Defense Software WebVPN Portal Access Rule Bypass Vulnerability — Cisco Adaptive Security Appliance (ASA) Software 5.3 Medium2020-10-21
CVE-2020-12503 Pepperl+Fuchs improper authorization affects multiple Comtrol RocketLinx products — P+F Comtrol RocketLinx 7.2 High2020-10-15
CVE-2020-15251 Privilege Escalation in Channelmgnt plug-in for Sopel — sopel-channelmgnt 7.7 High2020-10-13
CVE-2020-3467 Cisco Identity Services Engine Authorization Bypass Vulnerability — Cisco Identity Services Engine Software 8.5 -2020-10-08
CVE-2020-3404 Cisco IOS XE Software Consent Token Bypass Vulnerability — Cisco IOS XE Software 7.8 -2020-09-24
CVE-2020-15163 Invalid root may become trusted root in The Update Framework (TUF) — tuf 8.7 High2020-09-09
CVE-2020-5418 Cloud Controller allows users with no roles to list droplets — CAPI 4.3 -2020-09-03
CVE-2020-7300 DLP ePO extension - Improper Authorization — DLP ePO extension 4.6 Medium2020-08-12
CVE-2020-15120 Authorization Bypass in I hate money — ihatemoney 4.9 Medium2020-07-27
CVE-2020-15126 Information disclosure through Viewer query in parse-server — parse-server 6.5 Medium2020-07-22
CVE-2020-15110 Possible pod name collisions in jupyterhub-kubespawner — kubespawner 6.8 Medium2020-07-17
CVE-2020-7499 多款Schneider Electric产品访问控制错误漏洞 — U.motion Servers and Touch Panels (affected versions listed in the security notification) 6.5 -2020-06-16
CVE-2020-11844 Incorrect Authorization vulnerability in the Micro Focus Container Deployment Foundation affecting multiple products. — Hybrid Cloud Management 10.0 Critical2020-05-29
CVE-2020-6214 SAP S/4HANA 安全漏洞 — SAP S/4HANA (Financial Products Subledger) 6.3 -2020-04-14
CVE-2020-8142 Revive Adserver 安全漏洞 — https://github.com/revive-adserver/revive-adserver 6.1 -2020-04-03
CVE-2020-5239 Unspecified vulnerability in the fetchmail script in Mailu — Mailu 8.7 High2020-02-13
CVE-2019-6855 编号重复 — EcoStruxure Control Expert (all versions prior to 14.1 Hot Fix), Unity Pro (all versions), Modicon M340 (all versions prior to V3.20) , and Modicon M580 (all versions prior to V3.10) 9.4 -2020-01-06
CVE-2019-14832 Red Hat Keycloak 安全漏洞 — keycloak REST API 7.1 -2019-10-15
CVE-2019-6838 Schneider Electric 多款产品安全漏洞 — U.motion Servers (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, and MEG6260-0415 - U.motion KNX Server Plus, Touch 1) 6.5 -2019-09-17
CVE-2019-6836 Schneider Electric 多款产品安全漏洞 — U.motion Servers (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server Plus, MEG6260-0410 - U.motion KNX Server Plus, Touch 10, and MEG6260-0415 - U.motion KNX Server Plus, Touch 1) 7.5 -2019-09-17
CVE-2019-14995 Atlassian Jira 安全漏洞 — Jira 5.3 -2019-09-11
CVE-2019-8445 Atlassian Jira 授权问题漏洞 — Jira 5.3 -2019-08-23
CVE-2019-8446 Atlassian Jira 授权问题漏洞 — Jira 5.3 -2019-08-23
CVE-2019-13417 floragunn Search Guard 信息泄露漏洞 — Search Guard 5.3 -2019-08-12
CVE-2018-20826 Atlassian Jira 授权问题漏洞 — Jira 4.3 -2019-08-09
CVE-2019-3403 Atlassian Jira 授权问题漏洞 — Jira 5.3 -2019-05-22
CVE-2019-3401 Atlassian Jira 信息泄露漏洞 — Jira 5.3 -2019-05-22
CVE-2019-3399 Atlassian Jira 信息泄露漏洞 — Jira 7.5 -2019-04-30
CVE-2019-3887 Linux kernel 输入验证错误漏洞 — Kernel 5.6 -2019-04-09

Vulnerabilities classified as CWE-863 (授权机制不正确) represent 1278 CVEs. The CWE taxonomy describes the weakness; review individual CVEs for product-specific impact.