Home/CWE/Incorrect Authorization
Weakness

Incorrect Authorization

CWE-863 · Class · Incomplete

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-284 · Improper Access Control
ChildOfCWE-285 · Improper Authorization
Children (more specific)
ParentOfCWE-1244 · Internal Asset Exposed to Unsafe Debug Access Level or State
ParentOfCWE-41 · Improper Resolution of Path Equivalence
ParentOfCWE-551 · Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
ParentOfCWE-639 · Authorization Bypass Through User-Controlled Key
ParentOfCWE-647 · Use of Non-Canonical URL Paths for Authorization Decisions
ParentOfCWE-804 · Guessable CAPTCHA
ParentOfCWE-942 · Permissive Cross-domain Security Policy with Untrusted Domains
⚠

CVEs With This Weakness

3,303
A sample of the 3,303 CVEs tagged with this weakness.
CVECVE-2026-6863
CVECVE-2026-6383
CVECVE-2026-6343
CVECVE-2026-6342
CVECVE-2026-6341
CVECVE-2026-6290
CVECVE-2026-5712
CVECVE-2026-5574
CVECVE-2026-5384
CVECVE-2026-5383
CVECVE-2026-5382
CVECVE-2026-5381
◉

Nuclei Scanner Templates

30
Open-source Nuclei templates that detect this weakness class - an actionable scan-for-it pivot. Licensed under the ProjectDiscovery / Nuclei terms.
criticalMasa CMS - Authentication Bypass
criticalGitLab CE/EE - Information Disclosure
criticalMura CMS <10.0.580 - Authentication Bypass
criticalEasy!Appointments <1.4.3 - Broken Access Control
criticalAtlassian Confluence Server - Improper Authorization
criticalArcserve UDP <= 9.0.6034 - Authentication Bypass
criticalIvanti Sentry - Authentication Bypass
criticalKubeOperator Foreground `kubeconfig` - File Download
criticalCalibre <= 7.14.0 Remote Code Execution
criticalProjectSend <= r1605 - Improper Authorization
criticalApache Solr - Authentication Bypass
criticalQNAP QTS and Photo Station 6.0.3 - Remote Command Execution
highPowertek Firmware <3.30.30 - Authorization Bypass
highWebmin <1.990 - Improper Access Control
highWAVLINK WN533A8 - Improper Access Control
highLiteLLM - Arbitrary File Read
highSiYuan <= v3.6.1 - Bookmark Data Disclosure
highMotorola Baby Monitors - Remote Command Execution
highD-Link DIR-605 - Information Disclosure
highWordPress Contact Form 7 <2.3.4 - Arbitrary Nonce Generation
highKONGA 0.14.9 - Privilege Escalation
highOptinMonster Plugin < 2.6.5 - Unprotected REST-API
highWordPress WPS Hide Login <1.9.1 - Information Disclosure
highBuddyPress REST API <7.2.1 - Privilege Escalation/Remote Code Execution
highSecurePoint UTM 12.x Session ID Leak
highProFTPD ≤ 1.3.8b - Privilege Escalation via mod_sql
mediumWordPress Shareaholic <9.7.6 - Information Disclosure
mediumJira Server and Data Center - Information Disclosure
mediumApache Druid - Local File Inclusion
mediumWP Cerber < 8.9.3 - Broken Access Control
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin