← Back
CWE-863

3,797 CVEs • Abstraction: Class • Likelihood of Exploit: High

Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

JSON object

Loading...

CVEs (3,797)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-57681
1Dlink
1Dir 816 Firmware
Jun 17, 2026
Jan 16, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
An access control issue in the component form2alg.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the agl service of the device via a crafted POST request.
CVE-2024-57680
1Dlink
1Dir 816 Firmware
Jun 17, 2026
Jan 16, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
An access control issue in the component form2PortriggerRule.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the port trigger of the device via a crafted POST request.
CVE-2024-57679
1Dlink
1Dir 816 Firmware
Jun 17, 2026
Jan 16, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
An access control issue in the component form2RepeaterSetup.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G repeater service of the device via a crafted POST request.
CVE-2024-57678
1Dlink
1Dir 816 Firmware
Jun 17, 2026
Jan 16, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
An access control issue in the component form2WlAc.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G mac access control list of the device via a crafted POST request.
CVE-2024-57677
1Dlink
1Dir 816 Firmware
Jun 17, 2026
Jan 16, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
An access control issue in the component form2Wan.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the wan service of the device via a crafted POST request.
CVE-2024-57676
1Dlink
1Dir 816 Firmware
Jun 17, 2026
Jan 16, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
An access control issue in the component form2WlanBasicSetup.cgi of D-Link 816A2_FWv1.10CNB05_R1B011D88210 allows unauthenticated attackers to set the 2.4G and 5G wlan service of the device via a crafted POST request.
CVE-2024-44136
1Apple
2Ipados
Iphone Os
Jun 17, 2026
Jan 15, 2025
N/A· v4
4.6 MEDIUM· v3
N/A· v2
This issue was addressed through improved state management. This issue is fixed in iOS 17.5 and iPadOS 17.5. An attacker with physical access to a device may be able to disable Stolen Device Protection.
CVE-2024-40771
1Apple
5Ipados
Iphone OsMacos+2 more
Jun 17, 2026
Jan 15, 2025
N/A· v4
7.8 HIGH· v3
N/A· v2
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1....Show more
The issue was addressed with improved memory handling. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2, watchOS 10.5. An app may be able to execute arbitrary code with kernel privileges.Show less
CVE-2025-21403
1Microsoft
1On Prem Data Gateway
Jun 17, 2026
Jan 14, 2025
N/A· v4
6.4 MEDIUM· v3
N/A· v2
On-Premises Data Gateway Information Disclosure Vulnerability
CVE-2024-13302
1Ciandt
1Pages Restriction Access
Jun 17, 2026
Jan 9, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Incorrect Authorization vulnerability in Drupal Pages Restriction Access allows Forceful Browsing.This issue affects Pages Restriction Access: from 2.0.0 before 2.0.3.
CVE-2024-13291
1Basic Http Authentication Project
1Basic Http Authentication
Jun 17, 2026
Jan 9, 2025
N/A· v4
7.3 HIGH· v3
N/A· v2
Incorrect Authorization vulnerability in Drupal Basic HTTP Authentication allows Forceful Browsing.This issue affects Basic HTTP Authentication: from 7.X-1.0 before 7.X-1.4.
CVE-2024-13290
1Ohdear
1Ohdear Integration
Jun 17, 2026
Jan 9, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Incorrect Authorization vulnerability in Drupal OhDear Integration allows Forceful Browsing.This issue affects OhDear Integration: from 0.0.0 before 2.0.4.
CVE-2024-56114
1Henkel
1Canlineapp
Jun 17, 2026
Jan 9, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authorization checks. This feature is designated for supervisor role...Show more
Canlineapp Online 1.1 is vulnerable to Broken Access Control and allows users with the Auditor role to create an audit template as a result of improper authorization checks. This feature is designated for supervisor role, but auditors have been able to successfully create audit templates from their account.Show less
CVE-2024-13282
1Block Permissions Project
1Block Permissions
Jun 17, 2026
Jan 9, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
Incorrect Authorization vulnerability in Drupal Block permissions allows Forceful Browsing.This issue affects Block permissions: from 1.0.0 before 1.2.0.
CVE-2024-13281
1Monster Menus Project
1Monster Menus
Jun 17, 2026
Jan 9, 2025
N/A· v4
9.1 CRITICAL· v3
N/A· v2
Incorrect Authorization vulnerability in Drupal Monster Menus allows Forceful Browsing.This issue affects Monster Menus: from 0.0.0 before 9.3.2.
CVE-2024-13278
1Diff Project
1Diff
Jun 17, 2026
Jan 9, 2025
N/A· v4
9.1 CRITICAL· v3
N/A· v2
Incorrect Authorization vulnerability in Drupal Diff allows Functionality Misuse.This issue affects Diff: from 0.0.0 before 1.8.0.
CVE-2024-13277
1Smart Ip Ban Project
1Smart Ip Ban
Jun 17, 2026
Jan 9, 2025
N/A· v4
9.1 CRITICAL· v3
N/A· v2
Incorrect Authorization vulnerability in Drupal Smart IP Ban allows Forceful Browsing.This issue affects Smart IP Ban: from 7.X-1.0 before 7.X-1.1.
CVE-2024-13271
1Content Entity Clone Project
1Content Entity Clone
Jun 17, 2026
Jan 9, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Incorrect Authorization vulnerability in Drupal Content Entity Clone allows Forceful Browsing.This issue affects Content Entity Clone: from 0.0.0 before 1.0.4.
CVE-2024-13270
1Freelinking Project
1Freelinking
Jun 17, 2026
Jan 9, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Incorrect Authorization vulnerability in Drupal Freelinking allows Forceful Browsing.This issue affects Freelinking: from 0.0.0 before 4.0.1.
CVE-2024-13266
1Responsive And Off Canvas Menu Project
1Responsive And Off Canvas Menu
Jun 17, 2026
Jan 9, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Incorrect Authorization vulnerability in Drupal Responsive and off-canvas menu allows Forceful Browsing.This issue affects Responsive and off-canvas menu: from 0.0.0 before 4.4.4.