Skip to content
CVE Tracker

CWE-285: Improper authorization

1,764 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

All 1,764 in the listAtom feed of new CVEsWhat CWE-285 is, at MITRE (opens in a new tab)
Published CVEs
1,764
Last 12 months
817
Critical
151
Known exploited
2

Critical 151High 458Medium 1,070Low 85Not scored 0

CVEs per yearBy the year they were published

  1. 201729
  2. 20174
  3. 20181
  4. 201932
  5. 202294
  6. 2023121
  7. 202339
  8. 202458
  9. 2026719
  10. 2026330
  11. 2026171
  12. 2026136

Known exploitedNewest addition to KEV first

  • CVE-2026-58704

    In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of…

    Google · Android

    ExploitedHigh8.8
  • CVE-2021-28799

    Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)

    QNAP Systems Inc. · HBS 3

    ExploitedCritical10.0

Newest CVEs

  • CVE-2026-121585

    InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization

    InfiniFlow · RAGFlow

    Medium5.3
  • CVE-2026-121583

    Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization

    Sanluan · PublicCMS

    Medium5.3
  • CVE-2026-121582

    Umami Record API Endpoint route.ts authorization

    Umami

    Medium6.9
  • CVE-2026-95860

    node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound `DefaultRolePermissions

    node-opcua · node-opcua

    Critical9.1
  • CVE-2026-108047

    Inadequate authorization vulnerability in Alosuite’s user invitation functionality

    AM System · ALO Suite

    High8.6
  • CVE-2025-11969

    Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions

    WSO2 · WSO2 API Manager

    Critical9.4
  • CVE-2026-120319

    Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization

    Sanluan · PublicCMS

    Medium5.3
  • CVE-2026-120224

    Oray Pugongying X5 Pro API Authorization run_async_task improper authorization

    Oray · Pugongying X5 Pro

    Critical9.4
  • CVE-2026-77152

    Field Collection for Drupal 7 access bypass via missing parent entity access check

    Drupal · Field Collection for Drupal 7

    Medium5.3
  • CVE-2026-62989

    Shopper: missing variant-delete authorization permits destructive single and bulk actions

    shopperlabs · shopper

    High8.1

Vendors it comes up for most

  1. Samsung Mobile64
  2. Microsoft57
  3. Cisco45
  4. SourceCodester40
  5. Apple34
  6. Adobe32
  7. Oracle Corporation31
  8. IBM29
  9. Dell20
  10. Apache Software Foundation19