地图 / 授权不当

授权不当

Improper Authorization · 访问控制

访问控制 / 授权不当

55公开报告

—CWE 编号

0已标注发现方式

55关联报告

发现方式分布

暂无发现方式标注。

关联报告

Email address of any user can be queried on Report Invitation GraphQL type when username is knownHackerOne · 2020-02-20 · 中危 · 671 票 [Razer Pay Mobile App] Broken access control allowing other user's bank account to be deletedRazer · — · 未评级 · $1,000 · 311 票 Shopify admin authentication bypass using partners.shopify.comShopify · 2017-09-28 · 高危 · 311 票 Stealing Users OAuth authorization code via redirect_uripixiv · 2023-03-22 · 中危 · $2,000 · 253 票 Hacker can bypass 2FA requirement and reporter blacklist through embedded submission formHackerOne · 2018-10-31 · 低危 · $10,000 · 208 票 TikTok 2FA BypassTikTok · 2023-02-03 · 低危 · $1,564 · 194 票 Email verification bypass via request to endpoint "accounts.insightly.com/signup/provisionuser"Insightly · 2025-08-18 · 高危 · 148 票 Account takeover - improper validation of jwt signature (with regards to experiation date claim)Linktree · 2022-12-26 · 中危 · 147 票 Using gossip to drain miner walletsZilliqa · — · 未评级 · $10,000 · 111 票 Claiming the listing of a non-delivery restaurant through OTP manipulationEternal · 2022-02-22 · 高危 · $3,250 · 108 票 Unauthorized access to https://shipit.analogpond.com/DigitalOcean · — · 未评级 · 86 票 [Razer Pay Android App] Multiple vulnerabilities chained to allow "RedPacket" money to be stolen by a 3rd partyRazer · — · 未评级 · $1,000 · 84 票 Improper Authorization Leads to Editor can toggle admin-only workspace features (Lovable AI)Lovable VDP · 2025-11-04 · 低危 · 79 票 TikTok's pixel/sdk.js leaks current URL from websites using postMessageTikTok · 2022-08-30 · 低危 · 79 票 Improper authorization allows disclosing users' notification data in Notification channel serverLY Corporation · 2021-12-31 · 中危 · $2,000 · 78 票 Hijack all emails sent to any domain that uses Cloudflare Email ForwardingCloudflare Public Bug Bounty · 2022-07-28 · 高危 · $6,000 · 76 票 2FA doesn't work in "https://insider.razer.com"Razer · — · 未评级 · $200 · 72 票 Improper Authorization Leads to Editor can toggle admin-only workspace features (Lovable Cloud)Lovable VDP · 2025-11-04 · 低危 · 66 票 Attacker can generate cancelled transctions in a user's transaction history using only Steam IDCS Money · 2021-02-03 · 低危 · $300 · 66 票 Bypass SMS verification to delete TikTok accountTikTok · 2020-12-23 · 低危 · 64 票 Low-privileged user can enable or disable Lovable AI for new projects in workspaceLovable VDP · 2025-11-07 · 低危 · 56 票 Account Takeover via billingChaturbate · 2018-09-19 · 高危 · $8,000 · 56 票 [www.stripo.email] There is no rate limit for contact-us endpointsStripo Inc · 2020-05-26 · 低危 · 47 票 Forget password link not expiring after email change.Chaturbate · 2018-09-20 · 低危 · 46 票 H1514 Removed Staff members who had "Apps" permission can still modify flow app connectionsShopify · 2019-06-14 · 低危 · 44 票 User with privilege to maintain External Programs can update certain churned HackerOne programsHackerOne · 2018-10-25 · 低危 · $500 · 41 票 Improper Authorization at https://api-my.pay.razer.com/v1/trxDetail?trxId=[Id] allowing unauthorised access to other user's transaction detailsRazer · — · 未评级 · $500 · 40 票 [HTA2] Authorization Bypass on https://██████ leaks confidential aircraft/missile informationU.S. Dept Of Defense · 2023-04-14 · 高危 · 40 票 Tomcat Servlet Examples accessible at https://44.240.33.83:38443 and https://52.36.56.155:38443Stripe · 2022-10-19 · 低危 · 39 票 Removed Guest role user who dosent have access to private project in members able to view jobsGitLab · 2024-09-18 · 低危 · 38 票 Removed staff members who had "Manage shops" permission can still create development storesShopify · 2019-11-08 · 低危 · 38 票 [www.stripo.email] You can override the speed limit by adding the X-Forwarded-For header.Stripo Inc · 2020-04-23 · 低危 · 34 票 Subscription check bypass of NordVPN serviceNord Security · — · 未评级 · 31 票 Any user can vote on `Friend Only` video pullTikTok · 2023-01-27 · 低危 · 27 票 CVE-2023-47037: Airflow Broken Access Control VulnerabilityInternet Bug Bounty · 2023-11-29 · 低危 · 23 票 Hacker can request mediation for published reportsHackerOne · 2018-11-27 · 低危 · $500 · 23 票 Oauth Misconfiguration Lead To Account TakeoverReddit · 2021-10-21 · 低危 · 21 票 staffOrderNotificationSubscriptionDelete Could Be Used By Staff Member With Settings PermissionShopify · 2022-02-09 · 低危 · 21 票 staffOrderNotificationSubscriptionCreate Is Not Blocked Entirely From Staff Member With Settings PermissionShopify · 2022-02-09 · 低危 · 21 票 [dubmash] Lack of authorization checks - Update Sound TitlesReddit · 2021-10-21 · 中危 · 21 票 Improper AuthorizationStripo Inc · 2020-02-03 · 中危 · 20 票 [h1-2102] Partner's team member with no permission can retrieve services financial dataShopify · 2021-04-08 · 低危 · 17 票 Unauthenticated Access Control Bypass — Private WordPress Post Disclosure (Outdated WordPress 4.9.40)Tucows (VDP) · 2025-10-14 · 未评级 · 16 票 Order notifications being sent for a deactivated staff accountShopify · 2018-04-12 · 低危 · $500 · 16 票 Improper enforcement of CURLOPT_SOCKS5_AUTH due to missing reuse key validation in libcurlcurl · 2026-04-07 · 低危 · 15 票 User with no Develop apps permission can Uninstall Custom AppShopify · 2022-04-21 · 低危 · 15 票 [h1-2102] [PLUS] User with Store Management Permission can Make enforceSamlOrganizationDomains call - that should be limited to User Management OnlyShopify · 2022-04-21 · 低危 · 15 票 Gitlab Pages token theft using service workersGitLab · 2022-06-08 · 低危 · $1,680 · 14 票 [Transportation Management Services Solution 2.0] Improper authorization at tmss.gsa.gov leads to data exposure of all registered usersU.S. General Services Administration · 2021-12-08 · 高危 · 14 票 Leftover back-end system on www.zest.co.th allows an unauthorized attacker to generate Razer Gold Pin for freeRazer · — · 未评级 · $375 · 14 票 Unauthenticated access to internal API at██████████.███.edu [HtUS]U.S. Dept Of Defense · 2024-07-19 · 中危 · 13 票 Aws bucket writable mobile.razer.comRazer · — · 未评级 · $250 · 9 票 Impersonation and ticket id enumeration on support.innogames.comInnoGames · — · 未评级 · $550 · 8 票 Grafana Improper authorizationKubernetes · 2020-10-31 · 低危 · 6 票 API key is not validated for C.R.M integration [Pipedrive] of LOGGED IN USER, A user can use another USER'S API key for this operation.Dropcontact · 2020-08-20 · 低危 · 4 票