CWE-425 Direct Request ('Forced Browsing')
Description
The web application does not adequately enforce appropriate authorization on all restricted URLs, scripts, or files.
Associated Reviewed Advisories
Vulnerabilities classified under CWE-425 ordered by modification date.
| Advisory ID | NVD ID | Severity | PURLs | Summary | Last Modified |
|---|---|---|---|---|---|
| GHSA-6w3v-mcfh-m3q7 | CVE-2026-11986 | MODERATE |
Keycloak Admin UI REST Extensions: bulk role-removal endpoints fail to perform granular permission checks |
2026-08-19 | |
| GHSA-hm32-hfmw-rhvg | CVE-2026-7500 | MODERATE |
Keycloak has a Forced Browsing issue |
2026-06-26 | |
| GHSA-46xh-7854-f568 | CVE-2026-8205 | MODERATE | - |
Concrete CMS is vulnerable to authorization bypass in the Calendar Block |
2026-06-24 |
| GHSA-mf92-479x-3373 | CVE-2026-22732 | CRITICAL |
Spring Security HTTP Headers Are not Written Under Some Conditions |
2026-03-20 | |
| GHSA-pv4c-p2j5-38j4 | CVE-2018-3774 | CRITICAL |
Open Redirect in url-parse |
2026-01-23 | |
| GHSA-rwp9-5g7q-73q3 | CVE-2026-0650 | CRITICAL |
OpenFlagr contains an authentication bypass vulnerability in the HTTP middleware |
2026-01-07 | |
| GHSA-xph3-vjcq-g488 | CVE-2023-3426 | MODERATE |
Liferay Portal and Liferay DXP Organization Selector Does Not Check User Permissions |
2025-08-08 | |
| GHSA-cvgc-mx2w-h3w8 | CVE-2025-48205 | HIGH | - |
The Front End User Registration extension for TYPO3 (sr_feuser_register) allows Insecure Direct Object Reference |
2025-05-21 |
| GHSA-hq4f-5qjv-fwrg | CVE-2025-48201 | HIGH | - |
The Backup Plus extension for TYPO3 (ns_backup) has a Predictable Resource Location |
2025-05-21 |
| GHSA-jjwh-4x89-7f5w | CVE-2025-48207 | MODERATE | - |
reint_downloadmanager TYPO3 Extension is susceptible to Insecure Direct Object Reference |
2025-05-21 |
| GHSA-xxwr-wv9g-7jw3 | CVE-2025-48202 | MODERATE | - |
The femanager TYPO3 extension allows Insecure Direct Object Reference |
2025-05-21 |
| GHSA-pfrc-5hhq-6hvr | CVE-2018-19620 | MODERATE | - |
Showdoc Unauthenticated Access |
2025-05-06 |
| GHSA-h3vp-qwmx-5j25 | CVE-2025-47226 | MODERATE | - |
Grokability Snipe-IT has incorrect authorization for accessing asset information |
2025-05-05 |
| GHSA-3gqj-cmxr-p4x2 | CVE-2016-1000111 | MODERATE |
Forced Browsing in Twisted |
2024-11-18 | |
| GHSA-fhpf-pp6p-55qc | CVE-2022-23607 | HIGH |
Unsafe handling of user-specified cookies in treq |
2024-11-13 | |
| GHSA-x5w2-wcr8-9q45 | - | MODERATE | - |
Silverstripe Missing security check on dev/build/defaults |
2024-05-23 |
| GHSA-w8fq-xgvh-cxc2 | - | MODERATE | - |
Silverstripe Forum Module CSRF Vulnerability |
2024-05-23 |
| GHSA-fc75-58r8-rm3h | CVE-2023-45809 | LOW |
Wagtail vulnerable to disclosure of user names via admin bulk action views |
2023-10-19 | |
| GHSA-ff7x-qrg7-qggm | CVE-2020-8116 | HIGH |
dot-prop Prototype Pollution vulnerability |
2022-08-11 | |
| GHSA-6jfc-mc97-c7wg | CVE-2019-10354 | MODERATE |
Missing Authorization in Jenkins |
2022-06-28 | |
| GHSA-v7vq-3x77-87vg | CVE-2022-29238 | MODERATE |
Token bruteforcing. |
2022-06-16 |