CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- withastro astro, astro \@astrojs\/vercel +1 moreAstro: Unauthenticated Path Override via `x-astro-path` / `x_astro_path`6.5 Medium
- craftcms cms, craft cms +1 moreCraft CMS: Authorization bypass in "entries/move-to-section" allows control panel user to move entries without section permissions4.9 Medium
- craftcms cms, craft cms +1 moreCraft CMS: Anonymous "assets/image-editor" calls returns private asset editor metadata to unauthorized users1.3 Low
- craftcms cms, craft cms +1 moreCraft CMS: Anonymous "generate transform" calls for assets can expose private assets via transform URL2.7 Low
- craftcms cms, craft cms +1 moreCraft CMS: Unauthenticated users could execute project configuration sync operations that should be restricted trusted users6.9 Medium
- legalweb wp dsgvo tools (gdpr)WP DSGVO Tools (GDPR) <= 3.1.38 - Missing Authorization to Unauthenticated Account Destruction of Non-Admin Users9.1 Critical
- unknown product filter for woocommerce by wbwProduct Filter for WooCommerce by WBW <= 3.1.2 - Missing Authorization to Unauthenticated Filter Data Deletion via TRUNCATE TABLE6.5 Medium
- wp-graphqlWPGraphQL Repo's updateComment allows low-privileged authenticated users to change comment moderation status (comment_approved) without moderate_comments permission4.3 Medium
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Content Access Rule Manipulation5.4 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.3.2.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Quiz Answer Deletion4.3 Medium
- inc2734 smart custom fieldsSmart Custom Fields <= 5.0.6 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Relational Post Search4.3 Medium
- wwbn avideoAVideo Allows Unauthenticated Access to AD_Server reports.json.php that Exposes Ad Campaign Analytics and User Data5.3 Medium
- kalcaddle kodboxkalcaddle kodbox loginSubmit API index.class.php cross-site request forgery2.3 Low
- husobj expire usersExpire Users <= 1.2.2 - Authenticated (Subscriber+) Privilege Escalation to Administrator via save_extra_user_profile_fields8.8 High
- codeclove hr press liteHr Press Lite <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Employee Information Exposure6.5 Medium
- punnel – landing page builderPunnel <= 1.3.1 - Missing Authorization to Authenticated (Subscriber+) Settings Update via 'punnel_save_config' AJAX Action5.3 Medium
- hakeemnala build app onlineBuild App Online <= 1.0.23 - Missing Authorization to Arbitrary Post Author Modification via 'build-app-online-update-vendor-product' AJAX Action5.3 Medium
- atomchat group chat & video chat by atomchatGroup Chat & Video Chat by AtomChat <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Plugin Options Update4.3 Medium
- brainstation23 company posts for linkedinCompany Posts for LinkedIn <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary LinkedIn Post Data Deletion4.3 Medium
- charlycharm speedup optimizationSpeedup Optimization <= 1.5.9 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Update via 'speedup01_enabled' AJAX Action4.3 Medium
- larrykim wp-chatbot for messengerWP-Chatbot for Messenger <= 4.9 - Missing Authorization to Unauthenticated Chatbot Configuration Takeover5.3 Medium
- plugli linksy search and replaceLinksy Search and Replace <= 1.0.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Update via linksy_search_and_replace_item_details8.8 High
- acumenconsulting smarter analyticsSmarter Analytics <= 2.0 - Missing Authorization to Unauthenticated Plugin Settings Reset via 'reset' Parameter5.3 Medium
- flightbycanto cantoCanto <= 3.1.1 - Missing Authorization to Unauthenticated File Upload5.3 Medium
- sweetdaisy86 repairbuddy – repair shop crm & booking plugin for wordpressRepairBuddy <= 4.1132 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via wc_rep_shop_settings_submission AJAX Action5.3 Medium
- discourseDiscourse Authorization Page Displays Unvalidated Redirect Domain2.7 Low
- discourseDiscourse users can edit or synonymize hidden tags they can't see3.5 Low
- discourseDiscourse has inferable private group membership or existence via exclude_groups parameter6.9 Medium
- discourseDiscourse staff can modify any user's group notification level1.3 Low
- wwbn avideoAVideo has Unauthenticated Information Disclosure of User Group Permission Mappings via Permissions Plugin5.3 Medium
- ory oathkeeperOry Oathkeeper has an authentication bypass by usage of untrusted header6.5 Medium
- etcdetcd: Authorization bypasses in multiple APIs8.8 High
- langflowLangflow has Unauthenticated IDOR on Image Downloads7.5 High
- go-vikunja vikunjaVikunja’s Improper Access Control Enables Bypass of Administrator-Imposed Account Disablement8.1 High
- firetree rockpressRockPress <= 1.0.17 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via AJAX Actions5.3 Medium
- coderevolution aimogen pro - all-in-one ai content writer, editor, chatbot & automation toolkitAimogen Pro <= 2.7.5 - Unauthenticated Privilege Escalation via Arbitrary Function Call9.8 Critical
- discourseDiscourse has Unauthorized Post Data Exposure in discourse-user-notes5.3 Medium
- discourseDiscourse has Improper Authorization in "Post Edits" Report For Moderators2.2 Low
- discourseDiscourse missing permission check for policy creation in discourse-policy8.2 High
- dataease sqlbotSQLBot: Remote Code Execution via Terminology Poisoning8.6 High
- discourseDiscourse has a bypass of official warnings messages by non-staff users6.9 Medium
- discourseDiscourse has check revision visibility on posts endpoint5.3 Medium
- open-emr openemrOpenEMR has Authorization Bypass in FaxSMS AppDispatch Constructor5.4 Medium
- open-emr openemrOpenEMR has Authorization Bypass in Dated Reminders Log6.5 Medium
- charm soft serve, charmbracelet soft-serve +1 moreSoft Serve: Authenticated repo import can clone server-local private repositories7.1 High
- elastic kibanaMissing Authorization in Kibana Leading to Unauthorized Endpoint Response Action Configuration6.5 Medium
- dotstore fraud prevention for woocommerceWordPress Fraud Prevention For Woocommerce plugin <= 2.3.3 - Arbitrary Content Deletion vulnerability7.5 High
- instantpopupbuilder instant popup builder – powerful popup maker for opt-ins, email newsletters & lead generationInstant Popup Builder <= 1.1.7 - Unauthenticated Arbitrary Shortcode Execution via 'token' Parameter5.3 Medium
- metagauss eventprimeWordPress EventPrime plugin <= 4.2.8.3 - Payment Bypass vulnerability7.5 High
- uipress liteWordPress UiPress lite plugin <= 3.5.09 - Broken Access Control vulnerability6.3 Medium
- Show moreLoading…