CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- signalk signal k server, signalk-server +1 moresignalk-server: Privilege Escalation by Admin Role Injection via /enableSecurity9.4 Critical
- jahlives openssl encryptopenssl_encrypt before 1.4.0 Missing Ownership Verification via revoke_key8.7 High
- cisco evolved programmable network manager (epnm), evolved programmable network manager +1 moreCisco Evolved Programmable Network Manager Improper Authorization Vulnerability8.0 High
- devolutions serverImproper access control in the multi-factor authentication (MFA) management API in Devolutions...5.0 Medium
- devolutions serverImproper access control in the users MFA feature in Devolutions Server allows an authenticated...5.0 Medium
- crmperks database for contact form 7, wpforms, elementor formsDatabase for Contact Form 7, WPforms, Elementor forms <= 1.4.9 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via Shortcode4.3 Medium
- openclawOpenClaw 2026.2.14 < 2026.3.28 - Policy Enforcement Bypass in Discord Component Interactions5.3 Medium
- openclawOpenClaw < 2026.3.28 - Unauthenticated Discovery Endpoint Credential Exfiltration via Remote Onboarding7.4 High
- wwbn avideoAVideo: Arbitrary Stripe Subscription Cancellation via Debug Endpoint and retrieveSubscriptions() Bug6.5 Medium
- wwbn avideoAVideo: Mass User PII Disclosure via Missing Authorization in YPTWallet users.json.php6.5 Medium
- floragunn search guard flx, search-guard flx +1 moreSome management operations on data streams are not properly restricted when user does not have the necessary privileges6.8 Medium
- openclawOpenClaw < 2026.3.28 - Unauthorized Media Download via Zalo Channel6.9 Medium
- themetechmount truebooker – appointment booking and scheduler systemTruebooker - Appointment Booking and Scheduler Plugin <= 1.1.4 - Sensitive Information Exposure via Views Files5.3 Medium
- openclawOpenClaw < 2026.3.24 - Missing Authorization in /send and /allowlist Chat Commands5.3 Medium
openclawnpmOpenClaw: Mutating internal `/allowlist` chat commands missed `operator.admin` scope enforcement6.5 Medium- openclawOpenClaw < 2026.3.24 - Privilege Escalation via chat.send to Allowlist Persistence7.1 High
- avideoAVideo - Unauthenticated Access to Payment Log DataTables Endpoints via list.json.php8.7 High
- unknown restaurant cafeteriaRestaurant Cafeteria <= 0.4.6 - Subscriber+ Arbitrary Plugin Installation/Activation5.4 Medium
- langflow, langflow langflow-base +1 moreLangflow: Authenticated Users Can Read, Modify, and Delete Any Flow via Missing Ownership Check8.7 High
- nektos actact: actions/cache server allows malicious cache injection8.2 High
- sourcecodester note taking appSourceCodester Note Taking App cross-site request forgery5.3 Medium
- fleetdm fleetFleet's team maintainer can transfer hosts from any team via missing source team authorization4.9 Medium
- wwbn avideoAVIdeo has Video Password Protection Bypass via API Endpoints Returning Full Playback Sources Without Password Verification5.3 Medium
- sourcecodester diary appSourceCodester Diary App diary.php cross-site request forgery5.3 Medium
- wwbn avideoAVideo's IDOR in uploadPoster.php Allows Any Authenticated User to Overwrite Scheduled Live Stream Posters and Trigger False Socket Notifications5.4 Medium
- wwbn avideoAVideo's Missing Authorization in Playlist Schedule Creation Allows Cross-User Broadcast Hijacking6.3 Medium
- langflowLangflow - Application Logs Exposed to All Authenticated Users6.5 Medium
- langflowLangflow - Missing Authorization on download_image Endpoint6.3 Medium
- nec aterm w1200ex-ms firmware, aterm wf1200cr firmware, aterm wg1200cr firmware +41 more +43 moreMissing Authorization vulnerability in NEC Platforms, Ltd. Aterm Series allows a attacker to get...6.3 Medium
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.33 - Authenticated (Subscriber+) Arbitrary File Read via actionExportAll6.5 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI has unauthorized deletion of knowledge files5.4 Medium
- openclawOpenClaw < 2026.3.22 - Missing controlScope Enforcement in Send Action5.3 Medium
- openclawOpenClaw < 2026.3.22 - Missing Authorization Enforcement in Internal ACP Chat Commands7.1 High
- craigjbass clearancekitClearanceKit: opfilter policy bypass via exchangedata and clone operations8.4 High
- craigjbass clearancekitClearanceKit: opfilter policy bypass via non-open file operations8.7 High
- statamic cms, statamic +1 moreStatamic allows unauthorized content access through missing authorization in its revision controllers5.4 Medium
- openclawOpenClaw < 2026.3.23 - Insufficient Access Control in Gateway Agent Session Reset7.2 High
- wwbn avideoAVideo: Unauthenticated Access to Scheduler Plugin Endpoints Leaks Scheduled Tasks, Email Content, and User Mappings5.3 Medium
- wwbn avideoAVideo: Unauthenticated IDOR in playlistsVideos.json.php Exposes Private Playlist Contents5.3 Medium
- craftcms cmsCraft CMS - Authorization Bypass in assets/preview-file Endpoint5.3 Medium
- blakeblackshear frigateFrigate has cross-camera snapshot disclosure via unrestricted timeline IDs and missing authorization in /api/events/{event_id}/snapshot-clean.webp6.5 Medium
- nodejs node, node.js +1 moreAn incomplete fix for CVE-2024-36137 leaves `FileHandle.chmod()` and `FileHandle.chown()` in the...3.3 Low
- trainingbusinesspros formlift for infusionsoft web formsFormLift for Infusionsoft Web Forms <= 7.5.21 - Missing Authorization to Unauthenticated Infusionsoft Connection Hijack via OAuth Connection Flow5.3 Medium
- pr-gateway blog2social: social media auto post & schedulerBlog2Social: Social Media Auto Post & Scheduler <= 8.8.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Deletion via 'b2s_reset_social_meta_tags' AJAX Action4.3 Medium
- masteriyo lms – online course builder for elearning, lms & educationMasteriyo LMS <= 2.1.6 - Missing Authorization to Authenticated (Student+) Privilege Escalation to Administrator8.8 High
- open-emr openemrOpenEMR Missing Authorization in Procedure Order AJAX Deletion Handler7.1 High
- open-emr openemrOpenEMR's Missing Authorization in show-signature.php Allows Portal Patients to Read Staff Signatures4.3 Medium
- open-emr openemrOpenEMR Missing Authorization on Claim File Download Endpoint7.6 High
- open-emr openemrOpenEMR Missing ACL Checks on Insurance Company API Routes5.4 Medium
- gitlabMissing Authorization in GitLab4.3 Medium
- Show moreLoading…