CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- tips and tricks hq wp ememberWordPress WP eMember plugin <= v10.2.2 - Broken Access Control vulnerability5.3 Medium
- hytalemodding wikiHytale Modding Wiki has Insecure Direct Object Reference / GDPR PII Exposure4.3 Medium
- statamic cms, statamic +1 moreStatamic is missing authorization check on taxonomy term creation via fieldtype4.3 Medium
- iqonicdesign kivicare – clinic & patient management system (ehr)KiviCare <= 4.1.2 - Missing Authorization to Unauthenticated Privilege Escalation via Setup Wizard8.2 High
- saadiqbal post smtp – complete email deliverability and smtp solution with email logs, alerts, backup smtp & mobile appPost SMTP <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Office 365 OAuth Configuration Overwrite5.3 Medium
- ajay contextual related postsWordPress Contextual Related Posts plugin < 4.2.2 - Broken Access Control vulnerability5.3 Medium
- yoast duplicate postYoast Duplicate Post <= 4.5 - Authenticated (Contributor+) Missing Authorization to Arbitrary Post Duplication and Overwrite5.4 Medium
- wp swings subscriptions for woocommerceSubscriptions for WooCommerce <= 1.9.2 - Missing Authorization to Unauthenticated Arbitrary Subscription Cancellation5.3 Medium
- devolutions powershell universalMissing authorization checks on multiple gRPC service endpoints in PowerShell Universal before...8.3 High
- apache airflowApache Airflow: Execution API HITL Endpoints Missing Per-Task Authorization8.1 High
- ayacoo redirect tab, typo3 extension "redirect tabs" +1 moreBroken Access Control in extension "Redirect Tab"2.3 Low
- pluggabl booster for woocommerceWordPress Booster for WooCommerce plugin < 7.11.3 - Broken Access Control vulnerability5.3 Medium
- wproyal royal addons for elementor – addons and templates kit for elementorRoyal Addons for Elementor – Addons and Templates Kit for Elementor <= 1.7.1049 - Missing Authorization to Unauthenticated Custom Post Type Contents Exposure5.3 Medium
- admidioAdmidio is Missing Authorization on Forum Topic and Post Deletion6.5 Medium
- admidioAdmidio is Missing Authorization and CSRF Protection on Document and Folder Deletion9.1 Critical
- craftcms azure-blobAzure Blob Storage for Craft CMS Potential Sensitive Information Disclosure vulnerability8.7 High
- saad iqbal wp easypayWordPress WP EasyPay plugin <= 4.2.11 - Broken Access Control vulnerability5.4 Medium
- webnus inc. modern events calendarWordPress Modern Events Calendar plugin <= 7.29.0 - Broken Access Control vulnerability5.3 Medium
- mattermost, mattermost server +1 moreUnauthorized channel enumeration in private teams after member removal4.3 Medium
- mattermost, mattermost server +1 moreUnauthorized access to invite ID during team creation4.3 Medium
- growi, inc. growiGROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and...8.7 High
- wedevs user frontend: ai powered frontend posting, user directory, profile, membership & user registrationUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.2.8 - Missing Authorization to Unauthenticated Arbitrary Post Modification via 'post_id' Parame…5.3 Medium
- thimpress thim kit for elementor – pre-built templates & widgets for elementorThim Kit for Elementor <= 1.3.7 - Missing Authorization to Unauthenticated Private Course Disclosure5.3 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms – Ultimate Forms Plugin for WordPress <= 9.1.9 - Missing Authorization to Authenticated (Subscriber+) License Deactivation via deactivate_license4.3 Medium
- openclawOpenClaw < 2026.3.12 - Scope Elevation in WebSocket Shared-Auth Connections9.4 Critical
- openclawOpenClaw < 2026.3.11 - Account-Scoped configWrites Policy Bypass via Channel Commands7.1 High
- cyberchimps responsive blocksWordPress Responsive Blocks plugin <= 2.2.0 - Broken Access Control vulnerability5.3 Medium
- raratheme lawyer landing pageWordPress Lawyer Landing Page theme <= 1.2.7 - Broken Access Control vulnerability5.3 Medium
- wptravelengine travel bookingWordPress Travel Booking theme <= 1.3.9 - Broken Access Control vulnerability5.3 Medium
- really simple plugins simple sslWordPress Really Simple SSL plugin <= 9.5.7 - Broken Access Control vulnerability4.3 Medium
- wombat plugins advanced product fields (product addons) for woocommerceWordPress Advanced Product Fields (Product Addons) for WooCommerce plugin <= 1.6.18 - Broken Access Control vulnerability5.3 Medium
- themefusion avada coreWordPress Avada Core plugin < 5.15.0 - Broken Access Control vulnerability5.3 Medium
- themefusion fusion builderWordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability5.3 Medium
- themefusion fusion builderWordPress Fusion Builder plugin < 3.15.0 - Broken Access Control vulnerability6.5 Medium
- vito peleg atarimWordPress Atarim plugin <= 4.3.2 - Broken Access Control vulnerability4.3 Medium
- syed balkhi contact form by wpformsWordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability4.3 Medium
- elementor website builderWordPress Elementor Website Builder plugin <= 3.35.5 - Broken Access Control vulnerability2.7 Low
- e2pdfWordPress e2pdf plugin <= 1.28.15 - Broken Access Control vulnerability5.0 Medium
- ex-themes wp foodWordPress WP Food plugin < 2.7.1 - Broken Access Control vulnerability5.3 Medium
- webgeniuslab bigheartsWordPress BigHearts theme <= 3.1.14 - Broken Access Control vulnerability5.3 Medium
- vowelweb vw school educationWordPress VW School Education theme <= 1.4.6 - Broken Access Control vulnerability5.3 Medium
- vowelweb vw portfolioWordPress VW Portfolio theme <= 1.3.3 - Broken Access Control vulnerability5.3 Medium
- vowelweb vw photographyWordPress VW Photography theme <= 1.3.8 - Broken Access Control vulnerability5.3 Medium
- vowelweb vw pet shopWordPress VW Pet Shop theme <= 1.4.7 - Broken Access Control vulnerability5.3 Medium
- vowelweb vw fitnessWordPress VW Fitness theme <= 4.3.4 - Broken Access Control vulnerability5.3 Medium
- codepeople wp time slots booking formWordPress WP Time Slots Booking Form plugin <= 1.2.42 - Broken Access Control vulnerability5.3 Medium
- ays pro popup like boxWordPress Popup Like box plugin <= 3.7.7 - Broken Access Control vulnerability5.3 Medium
- vowelweb vw education liteWordPress VW Education Lite plugin <= 2.2.0 - Broken Access Control vulnerability5.3 Medium
- linknacional payment gateway pix for givewpWordPress Payment Gateway Pix For GiveWP plugin <= 2.2.3 - Broken Access Control vulnerability5.3 Medium
- bowo admin and site enhancements (ase)WordPress Admin and Site Enhancements (ASE) plugin <= 8.4.0 - Broken Access Control vulnerability5.4 Medium
- Show moreLoading…