CWE-285: Improper authorization

1,778 published CVEs are weaknesses of this kind, as the records or NVD name it; CISA lists 2 of them as exploited in the wild.

Critical 152High 460Medium 1,080Low 86Not scored 0

CVEs per yearBy the year they were published

CVE-2026-58704
In Cellular Modem, there is a possible permission bypass due to a logic error in the code. This could lead to remote (proximal/adjacent) escalation of…
Google · Android
ExploitedHigh8.8
CVE-2021-28799
Improper Authorization Vulnerability in HBS 3 (Hybrid Backup Sync)
QNAP Systems Inc. · HBS 3
ExploitedCritical10.0

CVE-2026-19307
Improper Authorization vulnerability affects IBM Sterling B2B Integrator and IBM Sterling File Gateway
IBM · Sterling B2B Integrator
Medium4.3
CVE-2026-19133
TS4500 Tape Library addresses security vulnerability
IBM · Storage TS4500 Library
High8.1
CVE-2026-16699
Vulnerability exists in IBM Netezza Appliance
IBM · Netezza Appliance
Medium6.5
CVE-2026-123677
xxyopen/201206030 novel Book Chapter Read BookServiceImpl.java getBookChapter authorization
xxyopen · novel
Medium5.3
CVE-2026-123676
xxyopen/201206030 novel Book Content Service BookServiceImpl.java BookServiceImpl.getBookContentAbout improper authorization
xxyopen · novel
Medium6.9
CVE-2026-123664
nasa-gcn gcn.nasa.gov Email Notification email improper authorization
nasa-gcn · gcn.nasa.gov
Medium5.3
CVE-2026-88984
Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines
kubeflow · pipelines
High7.2
CVE-2026-54143
OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution
tinyhumansai · openhuman
Critical9.8
CVE-2026-54144
OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture
tinyhumansai · openhuman
Medium6.1
CVE-2026-123023
agentscope-ai AgentScope Bash Tool _bash.py check_permissions authorization
agentscope-ai · AgentScope
Medium6.9