CWE-285 Improper Authorization

Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal

ixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass

Dozzle label filters do not restrict container event and statistics streams

Nautobot: Authorization bypass in approval workflow REST API allows self-approval and unauthorized activation of scheduled jobs

zot: Bearer authentication maps DELETE to push scope, allowing unauthorized deletion

BerriAI litellm has Security Feature Bypass in BannedKeywords and AzureContentSafety Guardrails via call_type Mismatch on Async Endpoints

Shopper: privilege escalation via improper Livewire admin component authorization

LiteLLM: M2M JWT Handler Has Improper Authorization

SurrealDB: Improper Authorization in Select Permissions

Duplicate Advisory: Improper Authorization in Select Permissions

Spring Security vulnerable to Authorization Bypass of Static Resources in WebFlux Applications

Pimcore: Insufficient Permission Check on Class Definition Creation Endpoint Allows Privilege Escalation

Yamcs's Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration

Vikunja vulnerable to Improper Authorization and Authorization Bypass Through User-Controlled Key

Vikunja has a project duplication bypasses write-permission check on the target parent project

djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls

django CMS: Structure endpoint bypasses page-view permission

Laravel Backpack CRUD: Arbitrary file deletion via attacker-controlled clear_<attr>[] in HasUploadFields::uploadMultipleFilesToDisk

GeoLens's authorization and cache-scope flaws disclose private dataset data and metadata to unauthorized users (fixed in 1.2.4)

langgraph-api: Incomplete assistant authorization in LangGraph Server run creation

vm2: NodeVM `builtin: ['*']` exposes `os` and `dns` — process-wide observability reads AND writes that hijack the host (sibling class of GHSA-9g8x-92q2-p28f)

OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check

Auth.js: Configuration errors can cause existence-based auth checks to fail open (auth object populated with an error)

Winter: Authenticated backend users can bypass Users controller permission checks