CWE-863


Incorrect Authorization

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

We have discovered 2,212,463 live websites that are affected by CWE-863.

Contact us to get more info







CVEs

  • Count - 355



Website Distribution by Country

Number of websites using CWE-863
United States499,743 websites


British Virgin Islands239,359 websites
Japan195,938 websites
Germany150,095 websites
GB126,080 websites
Russia93,805 websites
France92,594 websites
Italy86,108 websites
Netherlands44,172 websites
Spain43,871 websites

Website Distribution by TLD

Number of websites using CWE-863
.com980,714 websites
.org109,183 websites
.net83,905 websites
.ru81,844 websites
.de76,990 websites
.co.uk70,143 websites
.it61,986 websites
.jp41,997 websites
.fr38,585 websites
.nl37,068 websites

Newest CVEs

List of the most recent CVEs that are part of CWE-863
DiscoveredCVEDescriptionWebsites
Sep, 2026CVE-2026-81842 Library panel can be moved into a folder without library panel create permission75
Sep, 2026CVE-2026-100371 InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery1
Sep, 2026CVE-2026-100392 InvoicePlane: Primary Administrator Privilege Downgrade via `Users::form()` (Missing Object-Level Authorization)1
Sep, 2026CVE-2026-88003 InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade2
Sep, 2026CVE-2026-88848 MasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass1,485
Sep, 2026CVE-2026-87720 Incorrect Authorization via Stale ProjectCache Eviction and Repeated .git Suffixes in Gerrit Code Review82
Sep, 2026CVE-2026-84098 Directorist 3.1.0 - 8.9.4 - Subscriber+ Arbitrary Listing Deletion via remove_listing888
Sep, 2026CVE-2026-84742 The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API45,054
Sep, 2026CVE-2026-84743 The Events Calendar 6.15.16.1 - 6.17.4.1 - Contributor+ Event/Venue/Organizer Update, Trash and Ownership Takeover via by-slug REST Routes39,634
Sep, 2026CVE-2026-90951 Paid Member Subscriptions < 3.1.0 - Unauthenticated In-Flight Checkout State Deletion via pms_process_payment2,926

The most widespread CVEs

List of the most common CVEs that are part of CWE-863
DiscoveredCVEDescriptionWebsites
Jul, 2026CVE-2026-10755 All in One SEO < 4.9.9 – Contributor+ Incorrect Authorization via AI Integration597,148
Mar, 2026CVE-2026-28755 NGINX ngx_stream_ssl_module vulnerability430,047
Jun, 2026CVE-2026-10753 Site Kit by Google < 1.176.0 - Editor+ Email Reporting Settings Update373,083
Jan, 2024CVE-2022-0775 WooCommerce < 6.2.1 - Subscriber+ Arbitrary Comment Deletion157,778
Feb, 2025CVE-2025-23419 TLS Session Resumption Vulnerability130,820
Nov, 2024CVE-2024-9926 Jetpack < 13.9.1 - Subscriber+ Arbitrary Feedback Access114,041
Mar, 2025CVE-2025-31673 Drupal core - Moderately critical - Access bypass - SA-CORE-2025-002101,580
Jun, 2021CVE-2010-1435 Joomla! Core is prone to a security bypass vulnerability. Exploiting this issue may allow attackers ...92,593
Sep, 2025CVE-2025-8944 OceanWP < 4.1.2 - Subscriber+ Limited Option Update56,307
Sep, 2026CVE-2026-84742 The Events Calendar 6.15.0 - 6.17.4.1 - Contributor+ Content Publication via TEC V1 REST API45,054

Websites affected by CWE-863

Top websites that are affected by CWE-863. Please click on the "Contact us" link to get more information.
DomainCountryRankContacts
******.com British Virgin Islands***
****.*********.com British Virgin Islands***
****.******.org United States***
*****.net Canada***
***.**.uk GB***
***.**.**.com China***
*********.com United States***
*********.com United States***
***.gov United States***
****.****.******.org United States***
See full domain list