CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- flowiseai flowiseFlowise: Sensitive Data Leak in public-chatbotConfig7.7 High
- onesignal – web push notificationsOneSignal – Web Push Notifications <= 3.8.0 - Missing Authorization to Authenticated (Subscriber+) Post Meta Deletion via 'post_id'3.1 Low
- wpxpo post grid gutenberg blocks for news, magazines, blog websites – postxPost Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX <= 5.0.5 - Missing Authorization to Limited Post Meta Modification5.3 Medium
- iandunn basic google maps placemarksBasic Google Maps Placemarks <= 1.10.7 - Missing Authorization to Unauthenticated Default Map Coordinate Update5.3 Medium
- acyba acymailing – an ultimate newsletter plugin and marketing automation solution for wordpressAcyMailing 9.11.0 - 10.8.1 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation8.8 High
- imprintnext riaxe product customizerRiaxe Product Customizer <= 2.1.2 - Missing Authorization to Unauthenticated Arbitrary Options Update to Privilege Escalation via 'install-imprint' AJAX Action9.8 Critical
- imprintnext riaxe product customizerRiaxe Product Customizer <= 2.1.2 - Unauthenticated Arbitrary User Deletion via 'user_id' Parameter5.3 Medium
- wgerwger has Broken Access Control in the Global Gym Configuration Update Endpoint7.6 High
- hkuds openharnessOpenHarness Remote Administrative Command Injection via Gateway Handler8.7 High
- properfraction paid membership plugin, ecommerce, user registration form, login form, user profile & restrict content – profilepressProfilePress <= 4.16.12 - Missing Authorization to Authenticated (Subscriber+) Inactive Membership Plan Subscription4.3 Medium
- weblateWeblate has improper access control for the translation memory API4.3 Medium
- plisio accept cryptocurrencies with plisioWordPress Accept Cryptocurrencies with Plisio plugin <= 2.0.5 - Payment Bypass vulnerability7.5 High
- aveva pipeline simulation 2025AVEVA Pipeline Simulation Missing Authorization9.3 Critical
- long watch studio myrewardsWordPress MyRewards plugin <= 5.7.3 - Broken Access Control vulnerability4.3 Medium
- majestic support supportWordPress Majestic Support plugin <= 1.1.2 - Broken Access Control vulnerability5.3 Medium
- wp royal royal elementor addonsWordPress Royal Elementor Addons plugin <= 1.7.1056 - Broken Access Control vulnerability5.3 Medium
- nelio software ab testingWordPress Nelio AB Testing plugin <= 8.2.8 - Sensitive Data Exposure vulnerability5.3 Medium
- themeum tutor lmsWordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability5.4 Medium
- themegrill demo importerWordPress ThemeGrill Demo Importer plugin <= 2.0.0.6 - Broken Access Control vulnerability5.3 Medium
- bplugins 3d viewer – embed 3d modelsWordPress 3D viewer – Embed 3D Models plugin <= 1.8.5 - Broken Access Control vulnerability4.3 Medium
- blockart magazine blocksWordPress Magazine Blocks plugin <= 1.8.3 - Broken Access Control vulnerability4.3 Medium
- mattermost, mattermost server +1 moreConnected Workspaces: Malicious remote server can manipulate arbitrary user's status2.7 Low
- colbeinformatik katalogportal-pdf-sync widgetKatalogportal-pdf-sync Widget <= 1.0.0 - Missing Authorization to Authenticated (Subscriber+) Information Disclosure via 'katalogportal_shortcodePrinter' AJAX Action5.3 Medium
- forfront e-shote-shot <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Form Settings Modification via AJAX5.3 Medium
- wpengine advanced custom fields (acf®)Advanced Custom Fields (ACF®) <= 6.7.0 - Unauthenticated Missing Authorization to Arbitrary Post/Page Disclosure via AJAX Field Query Parameters5.3 Medium
- craftcms cmsCraft CMS has a Missing Authorization Check on User Group Removal via save-permissions Action5.3 Medium
- iberezansky 3d flipbook – pdf embedder, pdf flipbook viewer, flipbook image gallery3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery <= 1.16.17 - Missing Authorization to Unauthenticated Private/Draft Flipbook Data Exposure5.3 Medium
- jellyfinJellyfin: Potential SSRF + Arbitrary file read via stream argument injection9.3 Critical
- decidimDecidim's comments API allows access to all commentable resources7.5 High
- cartasi nexi xpayNexi XPay <= 8.3.0 - Missing Authorization to Unauthenticated Order Status Modification5.3 Medium
- fortinet fortisoar, fortisoar on-premise, fortisoar paas +2 moreA improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR...6.7 Medium
- arraytics eventin – event calendar, event registration, tickets & booking (ai powered)Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) <= 4.1.8 Missing Authorization to Authenticated (Subscriber+) Order Information Exposure4.3 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.3.2.8 - Missing Authorization to Unauthenticated Arbitrary Quiz Answer Deletion9.1 Critical
- sap se business analytics and sap content managementMissing Authorization check in SAP Business Analytics and SAP Content Management6.5 Medium
- sap se erp and sap s/4 hana (private cloud and on-premise)Missing Authorization check in SAP ERP and SAP S/4 HANA (Private Cloud and On-Premise)7.1 High
- sap manage reference structures, sap se s/4hana frontend odata service (manage reference structures) +1 moreMissing Authorization check in SAP S/4HANA Frontend OData Service (Manage Reference Structures)6.5 Medium
- sap se s/4hana backend odata service (manage reference structures)Missing Authorization check in SAP S/4HANA Backend OData Service (Manage Reference Structures)6.5 Medium
- sap se s/4hana odata service (manage reference equipment)Missing Authorization check in SAP S/4HANA OData Service (Manage Reference Equipment)6.5 Medium
- sap se s/4hana odata service (manage technical object structures)Missing Authorization check in SAP S/4HANA OData Service (Manage Technical Object Structures)4.3 Medium
- sap se s/4hana (private cloud and on-premise)Missing Authorization Check in SAP S/4HANA (Private Cloud and On-Premise)4.9 Medium
- sap se material master applicationMissing Authorization check in Material Master Application4.3 Medium
- craftcms commerceCraft Commerce: Unauthenticated information disclosure in `commerce/payments/pay` can leak some customer order data on anonymous payments1.7 Low
- enchant97 note-markNote Mark has Broken Access Control on Asset Download5.9 Medium
- deepwisdom metagptFoundationAgents MetaGPT Mineflayer HTTP API index.js evaluateCode cross-site request forgery5.3 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.7 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Private Course Enrollment5.4 Medium
- paperclipai paperclip, paperclip paperclipai, paperclipai\/server +1 more +3 morePaperclip Vulnerable to Unauthenticated Remote Code Execution via Import Authorization Bypass10.0 Critical
- lin-snow ech0Ech0 before 4.4.3 Missing Authorization on System Logs5.3 Medium
- lin-snow ech0Ech0 before 4.4.3 Authentication Bypass via Comment Panel7.0 High
- goshsgoshs has a file-based ACL authorization bypass in goshs state-changing routes9.3 Critical
- mauriceboe trekMissing Authorization on Immich Trip Photo Routes in TREK7.1 High
- Show moreLoading…