CWE-285

Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network.

Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over

OneUptime is a solution for monitoring and managing online services. Prior to 10.0.21, a low‑privileged user can bypass

In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated us

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, two distinct authorization defects in the team settings al

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.

Lemur manages TLS certificate creation. Prior to 1.9.2, authenticated users could influence an ACME authority acme_url w

PlaciPy is a placement management system designed for educational institutions. In version 1.0.0, the code evaluation en

FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.2.10, an authentication bypass vuln

Cross-Site Request Forgery (CSRF) vulnerability in rustdesk-client RustDesk Client rustdesk-client on Windows, MacOS, Li

The WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) implements a broken authentication mechanism in its web manag

The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes an HTTP API on TCP port 2345 that

The Hippoo Mobile App for WooCommerce plugin for WordPress is vulnerable to Authentication Bypass leading to Administrat

Improper authorization in Microsoft Teams allows an authorized attacker to disclose information over a network.

OpenDJ is an LDAPv3 compliant directory service. Prior to 5.1.2, the SASL PLAIN authorization identity path in opendj-se

Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2

Signal K Server is a server application that runs on a central hub in a boat. Prior to version 2.24.0-beta.4, there is a

Azure Entra ID Elevation of Privilege Vulnerability

Improper authorization in Azure Portal allows an unauthorized attacker to disclose information over a network.

A privilege escalation vulnerability allows local users to execute arbitrary code as root via Sophos Endpoint for macOS

Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.

An Improper Authorization vulnerability affecting 3DPassport in 3DSwymer from Release 3DEXPERIENCE R2023x through Releas

LibreChat is a ChatGPT clone with additional features. Prior to v0.8.2-rc2, LibreChat's MCP stdio transport accepts arbi

gRPC-Go is the Go language implementation of gRPC. Versions prior to 1.79.3 have an authorization bypass resulting from

Improper Authorization vulnerability when multiple method constraints define an HTTP method for the same extension in Ap

Improper authorization in Microsoft Exchange Online allows an unauthorized attacker to disclose information over a netwo

@fastify/express versions 4.0.6 and earlier only rewrite the plugin prefix for middleware mount paths when the path argu

IBM Langflow OSS 1.0.0 through 1.9.6 could allow unauthenticated attackers to access protected MCP project resources and

SolarWinds Serv-U is affected by a privilege escalation vulnerability. This would elevate a group’s access to system adm

Improper authorization in Azure Red Hat OpenShift (ARO) allows an authorized attacker to elevate privileges over a netwo

Ceph is an open-source distributed storage platform providing object, block, and file storage. In versions prior to 20.2

Permanent Fork PR Workflow Approval Gate Bypass

RustFS is a distributed object storage system built in Rust. Prior to version 1.0.0-alpha.79, he `ImportIam` admin API v

AutoGPT is a platform that allows users to create, deploy, and manage continuous artificial intelligence agents that aut

The IDonate – Blood Donation, Request And Donor Management System plugin for WordPress is vulnerable to Privilege Escala

Improper Authorization vulnerability in nerves-hub nerves_hub_web allows cross-organization device control via device bu

MyTube is a self-hosted downloader and player for several video websites Prior to version 1.8.69, an authorization bypas

PolarLearn is a free and open-source learning program. In 0-PRERELEASE-14 and earlier, setCustomPassword(userId, passwor

An authorization vulnerability in MphRx's Minerva V3.6.0, specifically in the '/minerva/moUser/update' endpoint, could a

The Optoma CinemaX P2 projector (firmware TVOS-04.24.010.04.01, Android 8.0.0) exposes Android Debug Bridge (ADB) on TCP

Bludit is a content management system. Versions prior to 3.22.0 have a Broken Access Control flaw where active sessions

A privilege escalation vulnerability in Apache OFBiz allows a low-privileged authenticated user to obtain higher privile

Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privile

Improper authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network

IBM Db2 Mirror for i 7.4, 7.5, and 7.6 could allow a remote authenticated attacker to bypass security restrictions due t

In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who does not hold the "admin" or "power"

An insecure PIN derivation mechanism in ABR allows a low-privileged user to escalate privileges to administrator by comm

Vaultwarden is a Bitwarden-compatible server written in Rust. Prior to 1.35.5, Vaultwarden does not enforce that a group

Improper authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to bypass a security feature o

Vaultwarden is an unofficial Bitwarden compatible server written in Rust, formerly known as bitwarden_rs. Prior to versi