On this page
CWE-863: Incorrect Authorization
Weakness Summary
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
- Canonical source: MITRE CWE-863 (opens in a new tab)
- Published Atomicorp CVE observations: 25
- Distinct affected products in those observations: 25
- Active Atomicorp rules associated with this weakness: 49
Atomicorp Research Context
Atomicorp has published CVE-specific research observations associated with this weakness category. Each linked CVE page states whether the tested request was detected or blocked and is the authoritative customer-facing finding.
The CVEs and rules shown here are selected published examples, not a complete list of Atomicorp protections. If a CWE, CVE, or rule is absent from this page, no conclusion should be drawn about whether Atomicorp protects against that weakness or attack method.
A CWE describes a class of software weakness. It does not identify one exploit request, and association with a CWE does not mean that every vulnerability or exploitation path in that category is detected or blocked.
Selected Published CVE Observations
| CVE | Vulnerability | Product | Atomicorp finding | Observed rules |
|---|---|---|---|---|
| CVE-2019-7192 | QNAP QTS and Photo Station Local File Inclusion | photo station | Protected by Atomicorp rules | 340007 , 344360 , 347009 , 390709 |
| CVE-2022-46169 | Cacti remote_agent.php Pre-Auth Command Injection (CVE-2022-46169) | cacti | Protected by Atomicorp rules | 344364 , 344370 |
| CVE-2023-22518 | Atlassian Confluence Unauth JSON setup-restore Improper Authorization leading to RCE (CVE-2023-22518) | confluence data center | Protected by Atomicorp rules | 330791 , 334168 , 340128 , 340152 , 344370 , 360152 , 380018 , 390700 , 390801 , 391213 |
| CVE-2024-6782 | Calibre Python Code Injection (CVE-2024-6782) | Calibre | Protected by Atomicorp rules | 330791 , 340014 , 340128 , 340152 , 344370 , 380018 , 390801 |
| CVE-2026-19598 | Pods <= 3.3.9 - Unauthenticated Privilege Escalation via pods_admin AJAX Router | pods | Detected by Atomicorp rules | 377360 |
| CVE-2025-29927 | Next.js Middleware Authorization Bypass (CVE-2025-29927) | next.js | Protected by Atomicorp rules | 345230 |
| CVE-2026-43945 | FUXA Vulnerable to Pre-auth RCE via Path Manipulation & Configuration Injection | FUXA | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2020-14321 | Moodle Teacher Enrollment Privilege Escalation to RCE | moodle | Protected by Atomicorp rules | 340128 , 360152 , 380018 , 390801 |
| CVE-2021-3577 | Motorola Baby Monitors - Remote Command Execution | halo+ camera firmware | Protected by Atomicorp rules | 340014 , 340193 , 344364 , 344370 , 393655 |
| CVE-2022-0824 | Webmin File Manager RCE | webmin | Protected by Atomicorp rules | 340128 , 340133 , 360152 , 380018 , 390801 , 392647 |
| CVE-2023-32749 | Pydio Cells 4.1.2 - Unauthorised Role Assignments | cells | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2026-105797 | SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport) | simplechat | Protected by Atomicorp rules | 340014 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 393655 |
| CVE-2026-35029 | LiteLLM - Arbitrary File Read | litellm | Protected by Atomicorp rules | 344360 , 390709 |
| CVE-2026-76836 | AzuraCast through 0.23.8 Liquidsoap Configuration Write via Profile Edit Serialization Group Bypass | AzuraCast | Protected by Atomicorp rules | 340014 , 340029 , 340193 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 , 347009 , 393655 |
| CVE-2026-86437 | Lara Dashboard before 1.3.2 Incorrect Authorization in Core-Upgrade Archive Upload | laradashboard | Protected by Atomicorp rules | 340014 , 340023 , 340029 , 344360 , 344361 , 344363 , 344364 , 344366 , 344370 |
| CVE-2013-4862 | MiCasaVerde VeraLite 1.5.408 - Multiple Vulnerabilities | veralite firmware | Protected by Atomicorp rules | 330791 , 340121 , 340152 , 344360 , 344370 , 390636 , 390726 , 392647 |
| CVE-2023-40315 | OpenNMS Horizon Authenticated RCE | horizon | Protected by Atomicorp rules | 330791 , 340152 |
| CVE-2026-46717 | Nezha Monitoring: RoleMember-reachable SSRF with full response-body reflection via POST /api/v1/notification | nezha | Protected by Atomicorp rules | 337109 , 337110 , 344360 , 398021 , 398022 |
| CVE-2021-24405 | WordPress Plugin Easy Cookie Policy 1.6.2 - Broken Access Control to Stored XSS | easy cookies policy | Protected by Atomicorp rules | 346755 , 390585 , 390726 , 392647 |
| CVE-2021-24947 | WordPress Responsive Vector Maps < 6.4.2 - Arbitrary File Read | responsive vector maps | Protected by Atomicorp rules | 344360 , 347009 , 390709 |
| CVE-2021-36749 | Apache Druid - Local File Inclusion | druid | Protected by Atomicorp rules | 340029 , 344360 |
| CVE-2026-114623 | baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure | basercms | Protected by Atomicorp rules | 344360 , 347009 |
| CVE-2026-85512 | SourceCodester Class and Exam Timetabling System session.php authorization | Class and Exam Timetabling System | Protected by Atomicorp rules | 340016 , 340017 , 340144 , 340145 , 340156 , 340157 , 341245 , 360147 , 360148 , 380026 , 380122 , 390572 |
| CVE-2019-8446 | Jira Improper Authorization | jira server | Protected by Atomicorp rules | 392301 |
| CVE-2024-2473 | WPS Hide Login <= 1.9.15.2 - Login Page Disclosure | wps hide login | Detected by Atomicorp rules | 377360 |
Associated Atomicorp WAF Rules
| Rule | Status | Behavior |
|---|---|---|
| 330791 | Active | disruptive (deny) |
| 334168 | Active | disruptive (deny) |
| 337109 | Active | disruptive (deny) |
| 337110 | Active | disruptive (deny) |
| 340007 | Active | disruptive (deny) |
| 340014 | Active | disruptive (deny) |
| 340016 | Active | disruptive (deny) |
| 340017 | Active | disruptive (deny) |
| 340023 | Active | disruptive (deny) |
| 340029 | Active | disruptive (deny) |
| 340121 | Active | disruptive (deny) |
| 340128 | Active | disruptive (deny) |
| 340133 | Active | disruptive (deny) |
| 340144 | Active | disruptive (deny) |
| 340145 | Active | disruptive (deny) |
| 340152 | Active | disruptive (deny) |
| 340156 | Active | disruptive (deny) |
| 340157 | Active | disruptive (deny) |
| 340193 | Active | disruptive (deny) |
| 341245 | Active | disruptive (deny) |
| 344360 | Active | disruptive (deny) |
| 344361 | Active | disruptive (deny) |
| 344363 | Active | disruptive (deny) |
| 344364 | Active | disruptive (deny) |
| 344366 | Active | disruptive (deny) |
| 344370 | Active | disruptive (deny) |
| 345230 | Active | disruptive (deny) |
| 346755 | Active | disruptive (deny) |
| 347009 | Active | disruptive (deny) |
| 360147 | Active | disruptive (deny) |
| 360148 | Active | disruptive (deny) |
| 360152 | Active | disruptive (deny) |
| 377360 | Active | non-disruptive (pass) |
| 380018 | Active | disruptive (deny) |
| 380026 | Active | disruptive (deny) |
| 380122 | Active | disruptive (deny) |
| 390572 | Active | disruptive (deny) |
| 390585 | Active | disruptive (deny) |
| 390636 | Active | disruptive (deny) |
| 390700 | Active | disruptive (deny) |
| 390709 | Active | disruptive (deny) |
| 390726 | Active | disruptive (deny) |
| 390801 | Active | disruptive (deny) |
| 391213 | Active | disruptive (deny) |
| 392301 | Active | disruptive (deny) |
| 392647 | Active | disruptive (deny) |
| 393655 | Active | disruptive (deny) |
| 398021 | Active | disruptive (deny) |
| 398022 | Active | disruptive (deny) |