CWE-863: Incorrect Authorization vulnerabilities

An incorrect authorization vulnerability (CWE-863) exists in the n8n workflow automation platform prior to versions 2.37.7 and 2.38.1. The OAuth token endpoint did not properly bind refresh tokens to the originally consented resource, allowing an OAuth client authorized for one workflow to obtain a valid token for a different, unapproved workflow by substituting the resource parameter. This issue is fixed in versions 2.37.7 and 2.38.1.

MongoDB Server contains an incorrect authorization vulnerability in the aggregation framework. An authenticated user with minimal privileges can craft a specially formatted aggregation request that causes the server's authorization subsystem to evaluate a different operation than what is actually executed, resulting in unauthorized read access to collection data within the target database.

A security issue in the MongoDB Server aggregation framework allows an authenticated user with limited read privileges to bypass view-level authorization checks and access data from unauthorized collections when Atlas Search features are in use. The issue stems from insufficient validation of an internal command parameter that can be set by external clients, causing a security check to be improperly skipped.

A security issue in MongoDB Server allows an authenticated user with elevated internal privileges to bypass a disabled feature gate in the applyOps command by specifying an internal replication mode value that was not intended to be client-selectable. This bypass enables execution of container operations that are disabled by default in production configurations, allowing direct storage-engine writes to arbitrary internal storage tables. The authorization check for these operations validates only the operation's namespace, not the actual storage target, enabling writes to unrelated internal metadata or other collections' data.

A security issue exists in MongoDB's LDAP authorization integration where pooled LDAP connections can retain stale authentication identities after user authentication under certain configurations. Subsequent authorization queries may execute under an unintended LDAP identity rather than the expected one. This can result in incorrect role assignments based on the LDAP directory's access control configuration, potentially allowing an authenticated user to acquire elevated privileges that were not intended by the deployment's authorization policy.

CVE-2026-33391 is an access control vulnerability in Nozomi Networks Guardian affecting the Smart Polling configuration. Authenticated users with limited privileges can bypass intended access controls on the web management interface to modify Smart Polling discovery settings. This unauthorized modification can disrupt asset visibility within the monitored network. The vulnerability has a medium severity rating with a CVSS 4.0 base score of 5.3.

CVE-2026-33388 is an access control vulnerability in Nozomi Networks Guardian's Credentials Manager. A remote authenticated user with limited privileges can view a subset of credential entries and can delete or edit these entries, potentially disrupting authentication for dependent devices or indirectly obtaining credentials. The actual credential values are not directly exposed. This vulnerability affects versions before 26.3.0.

CVE-2026-86498 is a high-severity vulnerability in JetBrains YouTrack that affects versions before 2025.3.160480 and 2026.1.14047. It allows PUT requests on link sub-resources to modify linked entities without requiring update permissions, violating proper access control.

CVE-2026-86493 is a vulnerability in JetBrains YouTrack before version 2026.2.18634 where improper permission checks allowed users with read-only access to create and modify whiteboard cards. This issue is classified under CWE-863 (Incorrect Authorization). The vulnerability has a CVSS 3.1 score of 6.5, indicating a medium severity level. No known exploits in the wild have been reported. The affected versions are all releases prior to 2026.2.18634.

CVE-2026-86490 is a medium severity vulnerability in JetBrains YouTrack before version 2026.2.18634. It involves improper permission checks that allow an attacker with limited privileges to overwrite bundled applications via the app import endpoint. This could lead to unauthorized modification of application components without user interaction.

CVE-2026-86487 is a low-severity vulnerability in JetBrains YouTrack before version 2026.2.18634. It allows users with read-only whiteboard permissions to modify canvas content by sending a crafted WebSocket message. This issue is classified under CWE-863 (Incorrect Authorization). No confidentiality or availability impact is reported.

Eclipse Ankaios versions 0.5.1 through 1.0.1 contain an authorization flaw in the agent-side Control Interface authorizer. The flaw arises when multi-segment allow rules start with a wildcard, allowing authenticated workloads to submit requests with empty field masks that bypass intended access restrictions. This can lead to unauthorized reading or modification of cluster state beyond the authorized scope. The vulnerability is tracked as CVE-2026-84173 and has a high severity rating.

A vulnerability in Avo, a Ruby on Rails admin panel framework, allows authenticated users to bypass upload authorization on the direct attachment upload endpoint. Versions from 2.28.0 up to but not including 3.32.0 are affected. This flaw permits users to replace or add attachment content on resolved records despite policy restrictions, impacting deployments with multi-role access controls. The issue has been fixed in version 3.32.0.

IBM i 7.6, 7.5, and 7.4 could allow a remote authenticated attacker to modify certain system messages due to improper authorization.

IBM Observability with Instana (Agent) Build 1.0.303 through 1.0.323 IBM Instana Agent Operator could allow an authenticated remote attacker to obtain sensitive information, caused by missing destination namespace validation when copying etcd mTLS client credentials from the openshift-etcd system namespace into an attacker-controlled namespace.

A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment. This vulnerability was patched on 11 December 2025, and no customer action is needed.

The WPFunnels WordPress plugin before 3.13.0 does not check whether user registration is enabled on the site before creating accounts from opt-in form submissions, relying on a value supplied in the request instead, allowing unauthenticated attackers to create WordPress user accounts even when registration is disabled. This is an incomplete fix for CVE-2025-12353: the check added in 3.6.3 covers only one of the three registration paths.

Incorrect Authorization (CWE-863) in Kibana can lead to unauthorized configuration modification via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

Incorrect Authorization (CWE-863) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).

Incorrect Authorization (CWE-863) in Kibana can lead to denial of service via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180).