Improper Authorization · Common Weaknesses

The chart below shows the most common weaknesses found in vulnerabilities across the Erlang ecosystem. Understanding which weakness types recur most often helps library authors and application developers focus their security efforts where they matter most.

Each CVE is mapped to its CWE (Common Weakness Enumeration) using the MITRE CWE hierarchy. A slice's count includes every CVE reachable anywhere below it in the hierarchy, not just CVEs assigned that exact CWE — click a slice or legend row to drill into its direct children and see the same breakdown one level down.

Improper Authorization CWE-285 CWE-285 at MITRE

The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

Incorrect Authorization CWE-863 8 (88.9%) Missing Authorization CWE-862 1 (11.1%) Files or Directories Accessible to External Parties CWE-552 0 (0.0%) Incorrect Permission Assignment for Critical Resource CWE-732 0 (0.0%) Improper Export of Android Application Components CWE-926 0 (0.0%) Use of Implicit Intent for Sensitive Communication CWE-927 0 (0.0%) Exposure of Sensitive Information Through Metadata CWE-1230 0 (0.0%) Improper Restriction of Software Interfaces to Hardware Features CWE-1256 0 (0.0%) Unprotected Confidential Information on Device is Accessible by OSAT Vendors CWE-1297 0 (0.0%) Security Version Number Mutable to Older Versions CWE-1328 0 (0.0%)

CVEs

CVEs for Improper Authorization CWE-285

Summary	Publication	CVE ID	Published
Authorization bypass via path binding override in elixir-grpc/grpc HTTP transcoding	`pkg:hex/grpc` `pkg:github/elixir-grpc/grpc`	CVE-2026-48599	2026-06-15
Distribution-over-TLS LAN allowlist silently bypassed due to sockname/peername confusion in inet_tls_dist	`pkg:otp/ssl` `pkg:github/erlang/otp`	CVE-2026-48860	2026-06-10
Missing authorization check on save-job event handler in oban_web	`pkg:hex/oban_web` `pkg:github/oban-bg/oban_web`	CVE-2026-48592	2026-05-26
Cross-session PubSub topic injection via URL parameter in phoenix_storybook	`pkg:hex/phoenix_storybook` `pkg:github/phenixdigital/phoenix_storybook`	CVE-2026-47068	2026-05-20
ScriptAlias CGI targets bypass directory auth in inets httpd (mod_auth vs mod_cgi path mismatch)	`pkg:otp/inets` `pkg:github/erlang/otp`	CVE-2026-28808	2026-04-07
Improper authorization in device bulk actions and device update API allows cross-organization device control	`pkg:otp/nerves_hub` `pkg:oci/nerves-hub` `pkg:github/nerves-hub/nerves_hub_web`	CVE-2026-28806	2026-03-10
Improper Scope Enforcement in OAuth client_credentials Flow Allows Read-Only API Key to Escalate to Full Access	`pkg:github/hexpm/hexpm`	CVE-2026-21621	2026-03-05
Authorization bypass when bypass policy condition evaluates to true	`pkg:hex/ash` `pkg:github/ash-project/ash`	CVE-2025-48044	2025-10-17
Bypass and runtime policies that can never pass may be incorrectly applied in filter authorization	`pkg:hex/ash` `pkg:github/ash-project/ash`	CVE-2025-48043	2025-10-10
Before action hooks may execute in certain scenarios despite a request being forbidden	`pkg:hex/ash` `pkg:github/ash-project/ash`	CVE-2025-48042	2025-09-07

10 CVEs