CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- embedplus youtube embed plusWordPress Youtube Embed Plus plugin <= 14.2.4 - Broken Access Control vulnerability4.3 Medium
- brainstorm force cartflowsWordPress CartFlows plugin <= 2.2.3 - Broken Access Control vulnerability4.3 Medium
- syed balkhi user feedbackWordPress User Feedback plugin <= 1.10.1 - Broken Access Control vulnerability4.3 Medium
- projectzealous01 pz frontend managerPZ Frontend Manager <= 1.0.6 - Missing Authorization to Arbitrary User Deletion via 'dataType' Parameter5.3 Medium
- burlingtonbytes wp blockade – visual page builderWP Blockade <= 0.9.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shortcode Execution via 'shortcode' Parameter6.5 Medium
- enituretechnology ltl freight quotes – r+l carriers editionLTL Freight Quotes – R+L Carriers Edition <= 3.3.13 - Missing Authorization to Unauthenticated Settings Update5.3 Medium
- mainwp child reportsMainWP Child Reports <= 2.2.6 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via Heartbeat API5.3 Medium
- felixmartinez users manager – pnUsers manager – PN <= 1.1.15 - Unauthenticated Privilege Escalation via Account Takeover via 'userspn_form_save' AJAX Action9.8 Critical
- wpmudev hustle – email marketing, lead generation, optins, popupsHustle – Email Marketing, Lead Generation, Optins, Popups <= 7.8.10.2 - Missing Authorization to Unauthenticated Conversion Tracking Data Manipulation5.3 Medium
- nextendweb smart slider 3Smart Slider 3 <= 3.5.1.33 - Missing Authorization to Authenticated (Contributor+) Slider Data Read and Image Record Manipulation5.4 Medium
- croniclePrivilege Escalation via update_event Job Output in Cronicle5.3 Medium
- delmaredigital payload-puck@delmaredigital/payload-puc is missing authorization on /api/puck/* CRUD endpoints allows unauthenticated access to Puck-registered collections9.4 Critical
- rustfsRustFS has an authorization bypass in multipart UploadPartCopy enables cross-bucket object exfiltration5.3 Medium
- kreaweb genealogyGenealogy is Missing Authorization in `TeamController::transferOwnership()` Allows Any Authenticated User to Hijack Any Team (Broken Access Control)10.0 Critical
- elated-themes frappeFrappe allows unrestricted Doctype access via API exploit6.9 Medium
- orangehrmOrangeHRM is Missing Authorization Checks in AbstractFileController Subclasses Expose Job Specification and Vacancy Attachments5.3 Medium
- openclawOpenClaw < 2026.4.2 - Authorization Bypass in Session Termination Endpoint5.3 Medium
- volcengine openvikingOpenViking < 0.3.3 Missing Authorization via Task Polling6.9 Medium
- nextcloud flow, windmill, windmill labs ce (community edition) +1 more +3 moreWindmill < 1.615.0 Operator Role Missing Authorization Checks RCE8.7 High
- filebrowserFile Browser discloses text file content via /api/resources endpoint bypassing Perm.Download check5.3 Medium
- inisev backupbliss – backup & migration with free cloud storageBackup Migration <= 2.0.0 - Missing Authorization to Unauthenticated Backup Upload to Offline Storage5.3 Medium
- djangoproject djangoPrivilege abuse in ModelAdmin.list_editable2.7 Low
- djangoproject djangoPrivilege abuse in GenericInlineModelAdmin9.8 Critical
- lfprojects mlflowAuthorization Bypass in MLflow AJAX Endpoint5.3 Medium
- oceanwp ocean extraWordPress Ocean Extra plugin <= 2.5.3 - Broken Access Control vulnerability5.4 Medium
- eniture technology ltl freight quotes – worldwide express editionWordPress LTL Freight Quotes – Worldwide Express Edition plugin <= 5.2.1 - Broken Access Control vulnerability5.3 Medium
- ajax30 bravecms, bravecms-2.0 +1 moreMissing Authorization Privilege Escalation8.8 High
- twitch studioTwitch Studio LauncherHelper XPC Missing Authorization to Root File Write8.5 High
- mattermost legal hold, mattermost +1 moreAuthorization Bypass in Mattermost Legal Hold Plugin Due to Missing Return After Permission Check8.3 High
- projectsendProjectSend upload.php cross-site request forgery5.3 Medium
- technostrobe hi-led-wr120-g2, hi-led-wr120-g2 firmware +1 moreTechnostrobe HI-LED-WR120-G2 FsBrowseClean deletefile authorization6.9 Medium
- technostrobe hi-led-wr120-g2, hi-led-wr120-g2 firmware +1 moreTechnostrobe HI-LED-WR120-G2 cross-site request forgery5.3 Medium
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressPaid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress <= 4.16.11 - Missing Authorization to Authenticated (Subscriber+) Membership Payme…7.1 High
- stellarwp kadence blocks — page builder toolkit for gutenberg editorKadence Blocks — Page Builder Toolkit for Gutenberg Editor <= 3.6.3 - Missing Authorization to Authenticated (Contributor+) Media Upload4.3 Medium
- wwbn avideoWWBN AVideo Provides Unauthenticated Access to Payment Order Data via BlockonomicsYPT check.php3.7 Low
- genetechproducts pie register – user registration, profiles & content restrictionPie Register – User Registration, Profiles & Content Restriction <= 3.8.4.8 - Missing Authorization to Unauthenticated Registration Form Status Modification6.5 Medium
- wwbn avideoWWBN AVideo Unauthenticated Instagram Graph API Proxy via publishInstagram.json.php5.3 Medium
- piwigoPiwigo: Unauthenticated Information Disclosure via pwg.history.search API7.5 High
- f prompts.chatprompts.chat Authorization Bypass Information Disclosure8.7 High
- zulipZulip: Anonymous File Access After Disabling Spectator Access5.3 Medium
- amazon athena odbc driver, athena odbc +1 moreInsufficient authentication security controls in browser-based authentication components in Amazon Athena ODBC driver9.1 Critical
- ajentiAjenti has an authorization bypass during custom package installation7.2 High
- openclawOpenClaw < 2026.3.31 - Discord Voice Ingress Authorization Bypass via Channel and Role Validation Gaps2.3 Low
- openclawOpenClaw < 2026.3.31 - Privilege Escalation to Remote Code Execution via Unrestricted node.event Agent Dispatch7.7 High
- openclawOpenClaw < 2026.3.28 - Agentic Consent Bypass via config.patch8.7 High
- openclawOpenClaw < 2026.3.31 - Remote Code Execution via Node Scope Gate Bypass7.7 High
- electronElectron: USB device selection not validated against filtered device list3.3 Low
- openclawOpenClaw < 2026.3.31 - Unauthorized Operator Scope Access in Unauthenticated Plugin-Auth Routes8.8 High
- dgraphDgraph Affected by Pre-Auth Database Overwrite + SSRF + File Read via restoreTenant Missing Authorization10.0 Critical
- hackerbay oneuptimeOneUptime: Unauthenticated notification API endpoints - financial abuse via phone number purchase, service disruption, and SMTP credential exposure9.2 Critical
- Show moreLoading…