CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
7172 vulnerabilities reference this CWE, most recent first.
GHSA-FV97-W6HF-PQJV
Vulnerability from github – Published: 2022-05-24 19:05 – Updated: 2022-05-24 19:05Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to access arbitrary files with an escalated privilege.
{
"affected": [],
"aliases": [
"CVE-2021-25410"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-06-11T15:15:00Z",
"severity": "HIGH"
},
"details": "Improper access control of a component in CallBGProvider prior to SMR JUN-2021 Release 1 allows local attackers to access arbitrary files with an escalated privilege.",
"id": "GHSA-fv97-w6hf-pqjv",
"modified": "2022-05-24T19:05:08Z",
"published": "2022-05-24T19:05:08Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-25410"
},
{
"type": "WEB",
"url": "https://blog.oversecured.com/Two-weeks-of-securing-Samsung-devices-Part-2"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2021\u0026month=6"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FV9M-8CWH-9RGJ
Vulnerability from github – Published: 2026-04-24 18:31 – Updated: 2026-09-08 21:32A client-side authorization flaw in Lightspeed Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks and abusing client-generated authorization tokens, leading to unauthorized control and monitoring of student devices.
{
"affected": [],
"aliases": [
"CVE-2026-30368"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-04-24T16:16:34Z",
"severity": "MODERATE"
},
"details": "A client-side authorization flaw in Lightspeed Classroom v5.1.2.1763770643 allows unauthenticated attackers to impersonate users by bypassing integrity checks and abusing client-generated authorization tokens, leading to unauthorized control and monitoring of student devices.",
"id": "GHSA-fv9m-8cwh-9rgj",
"modified": "2026-09-08T21:32:15Z",
"published": "2026-04-24T18:31:11Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30368"
},
{
"type": "WEB",
"url": "https://github.com/truekas/ls-poc"
},
{
"type": "WEB",
"url": "https://tasty-hovercraft-9b9.notion.site/Enabling-Unauthorized-Remote-Control-of-Student-Devices-with-Lightspeed-Classroom-2ec5157f5b4a800c9eefc5526479820a"
},
{
"type": "WEB",
"url": "https://truekas.dev/blog/lightspeed"
},
{
"type": "WEB",
"url": "https://www.incognitotgt.me/blog/lightspeed"
},
{
"type": "WEB",
"url": "https://www.lightspeedsystems.com/products/lightspeed-classroom-management"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FVF5-WM7J-89HJ
Vulnerability from github – Published: 2024-08-06 18:30 – Updated: 2024-08-08 00:31Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a malicious file. (Chromium security severity: Low)
{
"affected": [],
"aliases": [
"CVE-2024-7004"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-08-06T16:15:50Z",
"severity": "MODERATE"
},
"details": "Insufficient validation of untrusted input in Safe Browsing in Google Chrome prior to 127.0.6533.72 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a malicious file. (Chromium security severity: Low)",
"id": "GHSA-fvf5-wm7j-89hj",
"modified": "2024-08-08T00:31:44Z",
"published": "2024-08-06T18:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7004"
},
{
"type": "WEB",
"url": "https://chromereleases.googleblog.com/2024/07/stable-channel-update-for-desktop_23.html"
},
{
"type": "WEB",
"url": "https://issues.chromium.org/issues/40063014"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FVP7-JJ9M-3QPF
Vulnerability from github – Published: 2025-09-10 21:30 – Updated: 2025-12-20 02:55An Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest users to obtain object entry information via the API Builder.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.liferay:com.liferay.headless.builder.impl"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.0.32"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-43784"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-09-12T21:08:53Z",
"nvd_published_at": "2025-09-10T19:15:41Z",
"severity": "MODERATE"
},
"details": "An Improper Access Control vulnerability in Liferay Portal 7.4.0 through 7.4.3.124, and Liferay DXP 2024.Q2.0 through 2024.Q2.8, 2024.Q1.1 through 2024.Q1.12 and 7.4 GA through update 92 allows guest users to obtain object entry information via the API Builder.",
"id": "GHSA-fvp7-jj9m-3qpf",
"modified": "2025-12-20T02:55:23Z",
"published": "2025-09-10T21:30:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-43784"
},
{
"type": "WEB",
"url": "https://github.com/liferay/liferay-portal/commit/ccbae813d4a9ec66597191f58d1cb4137f264c99"
},
{
"type": "PACKAGE",
"url": "https://github.com/liferay/liferay-portal"
},
{
"type": "WEB",
"url": "https://liferay.atlassian.net/browse/LPE-18066"
},
{
"type": "WEB",
"url": "https://liferay.dev/portal/security/known-vulnerabilities/-/asset_publisher/jekt/content/CVE-2025-43784"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:H/SI:H/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Liferay Portal\u0027s Incorrect Authorization vulnerability can lead to guest users to obtaining sensitive data"
}
GHSA-FVPX-GX3C-PQ7F
Vulnerability from github – Published: 2025-09-16 15:32 – Updated: 2025-09-16 15:32The Sparkle framework includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. Lack of validation of connecting client allows the attacker to copy TCC-protected files to an arbitrary location. Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission.
This issue was fixed in version 2.7.2
{
"affected": [],
"aliases": [
"CVE-2025-10015"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-16T10:15:37Z",
"severity": "MODERATE"
},
"details": "The Sparkle framework\u00a0includes an XPC service Downloader.xpc, by default this service is private to the application its bundled with. A local unprivileged attacker can register this XPC service globally which will inherit TCC permissions of the application. \nLack of validation of connecting client allows the attacker to\u00a0copy TCC-protected files to an arbitrary location.\u00a0Access to other resources beyond granted-permissions requires user interaction with a system prompt asking for permission.\n\nThis issue was fixed in version 2.7.2",
"id": "GHSA-fvpx-gx3c-pq7f",
"modified": "2025-09-16T15:32:34Z",
"published": "2025-09-16T15:32:34Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-10015"
},
{
"type": "WEB",
"url": "https://cert.pl/en/posts/2025/09/CVE-2025-10015"
},
{
"type": "WEB",
"url": "https://github.com/sparkle-project/Sparkle"
},
{
"type": "WEB",
"url": "https://github.com/sparkle-project/Sparkle/discussions/2764"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-FVQJ-2G9G-F9XV
Vulnerability from github – Published: 2022-05-24 17:33 – Updated: 2022-05-24 17:33An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admin user would be made available for a short time to users with only view permission. In this short time window the user with view permission could read cluster secrets that should only be disclosed to admin users.
{
"affected": [],
"aliases": [
"CVE-2020-25655"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-11-09T15:15:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered in ManagedClusterView API, that could allow secrets to be disclosed to users without the correct permissions. Views created for an admin user would be made available for a short time to users with only view permission. In this short time window the user with view permission could read cluster secrets that should only be disclosed to admin users.",
"id": "GHSA-fvqj-2g9g-f9xv",
"modified": "2022-05-24T17:33:58Z",
"published": "2022-05-24T17:33:58Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-25655"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-25655"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-FVQW-WG8V-HMCW
Vulnerability from github – Published: 2024-06-10 21:30 – Updated: 2026-04-02 21:31This issue was addressed with improved permissions checking. This issue is fixed in macOS Sonoma 14.5, iOS 17.5 and iPadOS 17.5. A malicious app may be able to gain root privileges.
{
"affected": [],
"aliases": [
"CVE-2024-27848"
],
"database_specific": {
"cwe_ids": [
"CWE-277",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-10T21:15:51Z",
"severity": "HIGH"
},
"details": "This issue was addressed with improved permissions checking. This issue is fixed in macOS Sonoma 14.5, iOS 17.5 and iPadOS 17.5. A malicious app may be able to gain root privileges.",
"id": "GHSA-fvqw-wg8v-hmcw",
"modified": "2026-04-02T21:31:46Z",
"published": "2024-06-10T21:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27848"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120903"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/120905"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214101"
},
{
"type": "WEB",
"url": "https://support.apple.com/en-us/HT214106"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214101"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT214106"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-FVWW-7H3R-VFHP
Vulnerability from github – Published: 2026-10-05 22:49 – Updated: 2026-10-05 22:49Impact
What kind of vulnerability is it? Who is impacted?
langgraph-sdk incorrectly applies the actions= argument on resource-scoped authorization decorators, including @auth.on.threads, @auth.on.assistants, and @auth.on.crons.
In affected versions, a decorator such as:
@auth.on.threads(actions=["create"])
async def allow_thread_create(ctx, value):
return None
intended to register a handler for selected actions instead registers that handler for every action on the resource. Because the resource-wide handler is selected before broader fallback handlers, authorization checks implemented in those fallback handlers may not run.
An authenticated user may therefore be able to perform actions the application intended to deny, such as reading, updating, or deleting another user's resource. Exploitability and impact depend on the affected handler's behavior: deployments remain protected if that handler independently enforces the necessary action, ownership, or permission checks for every request it receives.
Only Python deployments using actions= on the affected resource-scoped decorators are affected.
Patches
0.4.4
Workarounds
No.
References
N/A
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.4.3"
},
"package": {
"ecosystem": "PyPI",
"name": "langgraph-sdk"
},
"ranges": [
{
"events": [
{
"introduced": "0.1.45"
},
{
"fixed": "0.4.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-104873"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-10-05T22:49:35Z",
"nvd_published_at": "2026-10-02T20:17:01Z",
"severity": "HIGH"
},
"details": "### Impact\n_What kind of vulnerability is it? Who is impacted?_\n`langgraph-sdk` incorrectly applies the `actions=` argument on resource-scoped authorization decorators, including `@auth.on.threads`, `@auth.on.assistants`, and `@auth.on.crons`.\n\nIn affected versions, a decorator such as:\n\n```python\n@auth.on.threads(actions=[\"create\"])\nasync def allow_thread_create(ctx, value):\n return None\n```\nintended to register a handler for selected actions instead registers that handler for every action on the resource. Because the resource-wide handler is selected before broader fallback handlers, authorization checks implemented in those fallback handlers may not run.\n\nAn authenticated user may therefore be able to perform actions the application intended to deny, such as reading, updating, or deleting another user\u0027s resource. Exploitability and impact depend on the affected handler\u0027s behavior: deployments remain protected if that handler independently enforces the necessary action, ownership, or permission checks for every request it receives.\n\nOnly Python deployments using `actions=` on the affected resource-scoped decorators are affected.\n\n### Patches\n\n0.4.4\n\n### Workarounds\n\nNo.\n\n### References\n\nN/A",
"id": "GHSA-fvww-7h3r-vfhp",
"modified": "2026-10-05T22:49:35Z",
"published": "2026-10-05T22:49:35Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langgraph/security/advisories/GHSA-fvww-7h3r-vfhp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104873"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langgraph/commit/5a77be5e8bec1600ad0a865638d88c1368497559"
},
{
"type": "PACKAGE",
"url": "https://github.com/langchain-ai/langgraph"
},
{
"type": "WEB",
"url": "https://github.com/langchain-ai/langgraph/releases/tag/sdk==0.4.4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "LangGraph SDK custom auth silently ignores actions= on resource decorators"
}
GHSA-FW62-7JCP-752G
Vulnerability from github – Published: 2025-11-11 21:30 – Updated: 2025-11-11 21:30Adobe Pass versions 3.7.3 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must install a malicious SDK.
{
"affected": [],
"aliases": [
"CVE-2025-61830"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-11T19:15:35Z",
"severity": "HIGH"
},
"details": "Adobe Pass versions 3.7.3 and earlier are affected by an Incorrect Authorization vulnerability. An attacker could leverage this vulnerability to bypass security measures and gain unauthorized read and write access. Exploitation of this issue requires user interaction in that a victim must install a malicious SDK.",
"id": "GHSA-fw62-7jcp-752g",
"modified": "2025-11-11T21:30:27Z",
"published": "2025-11-11T21:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-61830"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/pass/apsb25-112.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-FWCM-GWWR-6JW8
Vulnerability from github – Published: 2022-05-24 17:43 – Updated: 2022-05-24 17:43Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to communicate with the server.
{
"affected": [],
"aliases": [
"CVE-2020-28050"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-03-05T17:15:00Z",
"severity": "CRITICAL"
},
"details": "Zoho ManageEngine Desktop Central before build 10.0.647 allows a single authentication secret from multiple agents to communicate with the server.",
"id": "GHSA-fwcm-gwwr-6jw8",
"modified": "2022-05-24T17:43:43Z",
"published": "2022-05-24T17:43:43Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-28050"
},
{
"type": "WEB",
"url": "https://www.manageengine.com/products/desktop-central/cve-2020-28050.html"
},
{
"type": "WEB",
"url": "https://www.manageengine.com/products/desktop-central/fixing-multiple-vulnerabilities.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.