CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- hubspotdev hubspot all-in-one marketing – forms, popups, live chatHubSpot All-In-One Marketing - Forms, Popups, Live Chat <= 11.3.32 - Missing Authorization to Authenticated (Contributor+) Installed Plugin Disclosure4.3 Medium
- mhmrajib wp books gallery – build stunning book showcases & libraries in minutesWP Books Gallery <= 4.8.0 - Missing Authorization to Unauthenticated Settings Update via 'permalink_structure' Parameter5.3 Medium
- smub exactmetrics – google analytics dashboard for wordpress (website stats plugin)ExactMetrics <= 9.1.2 - Authenticated (Subscriber+) Missing Authorization to Google Ads Access Token Retrieval via AJAX Action 'exactmetrics_ads_get_token'5.3 Medium
- wpdevteam betterdocs – knowledge base docs & faq solution for elementor & block editorBetterDocs <= 4.3.11 - Missing Authorization to Authenticated (Subscriber+) Unauthorized AI API Usage4.3 Medium
- senselive x3050, x3500 firmware +1 moreSenseLive X3050 Missing Authorization7.2 High
- actualbudget actualActual has Privilege Escalation via 'change-password' Endpoint on OpenID-Migrated Servers8.8 High
- navneil naicker acf galerie 4WordPress ACF Galerie 4 plugin <= 1.4.2 - Broken Access Control vulnerability4.3 Medium
- smub exactmetrics – google analytics dashboard for wordpress (website stats plugin)ExactMetrics <= 9.1.2 - Authenticated (Editor+) Arbitrary Plugin Installation/Activation via exactmetrics_connect_process7.2 High
- wekanWeKan < 8.35 Missing Authorization via Integration REST API8.7 High
- rustfsRustFS missing admin authorization on notification target endpoints, which allows unauthenticated configuration of event webhooks8.3 High
- hanicker emailchefEmailchef <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion4.3 Medium
- jppreus create db tablesCreate DB Tables <= 1.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Database Table Creation/Deletion via admin-post.php9.1 Critical
- calj shabbat timesCalJ <= 1.5 - Authenticated (Subscriber+) Arbitrary Settings Modification via 'save-obtained-key' Action5.3 Medium
- sendmachine for wordpressSendmachine for WordPress <= 1.0.20 - Unauthenticated SMTP Hijack to Privilege Escalation via manage_admin_requests9.8 Critical
- tplugins tp restore categories and taxonomiesTP Restore Categories And Taxonomies <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Taxonomy Deletion via 'tpmcattt_delete_term' AJAX Action4.3 Medium
- aenrich a+hrdaEnrich｜a+HRD - Missing Authorization7.1 High
- freescout-help-desk freescoutFreeScout's client-controlled attachment IDs allow deletion of existing conversation attachments7.1 High
- freescout-help-desk freescoutFreeScout's cross-user undo reply allows mailbox peers to recall another agent's outbound reply5.9 Medium
- freescout-help-desk freescoutFreeScout's Missing Authorization in load_customer_info Allows Any Authenticated User to Access Full Customer PII5.7 Medium
- cyberchimps responsive blocks – page builder for blocks & patternsResponsive Blocks <= 2.2.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via AJAX Actions4.3 Medium
- m1k1o nekoNeko has Self-service Privilege Escalation for Authenticated Users8.8 High
- openmage magento, magento-lts +1 moreOpenMage LTS imports cross-user wishlist item via shared wishlist code, leading to private option disclosure and file-disclosure variant5.3 Medium
- vexaVexa's unauthenticated internal transcript endpoint exposed by default7.5 High
- No product listedComfyUI server.py create_origin_only_middleware cross-site request forgery5.3 Medium
- leepeuker movaryAuthenticated Movary User Can Self-Escalate to Administrator via PUT /settings/users/{userId} by Setting isAdmin=true8.8 High
- churchcrm crmChurchCRM: Cross-Site Request Forgery (CSRF) in SelectDelete.php Leading to Permanent Data Deletion8.1 High
- churchcrm crmChurchCRM has Missing Object-Level Authorization / IDOR in `/api/person/{personId}`7.1 High
- openclawOpenClaw < 2026.4.10 - Unauthorized Matrix Profile Config Persistence Access via operator.write Message Tools7.1 High
- openclawOpenClaw < 2026.4.10 - Incomplete Navigation Guard Coverage in Browser Interactions4.9 Medium
- openclawOpenClaw < 2026.4.9 - Arbitrary File Read via Browser Interaction Routes7.1 High
- openclawOpenClaw < 2026.4.10 - SSRF Policy Bypass in Existing-Session Browser Interaction Routes4.9 Medium
- openclawOpenClaw < 2026.4.10 - SSRF Policy Bypass in Browser Tabs Action Routes4.9 Medium
- openclawOpenClaw < 2026.4.10 - Insufficient Access Control in Nostr Profile Mutation Routes6.0 Medium
- openclawOpenClaw < 2026.4.10 - Untrusted Workspace Plugin Shadow Resolution in Channel Setup7.7 High
- openclawOpenClaw < 2026.4.10 - Path Traversal in screen_record outPath Parameter7.1 High
- openclawOpenClaw < 2026.4.12 - Improper Authorization via Empty Approver Lists6.0 Medium
- openclawOpenClaw 2026.4.5 through 2026.4.9 - Privilege Escalation via Memory Dreaming Configuration in /dreaming Endpoint7.1 High
- openclawOpenClaw 2026.4.10 < 2026.4.14 - Missing Sender Authorization in Microsoft Teams SSO Invoke Handler6.3 Medium
- openclawOpenClaw 2026.4.10 < 2026.4.14 - Loss of Group Tool-Policy Context in Delivery Queue Recovery6.0 Medium
- openclawOpenClaw < 2026.4.14 - Internal Page Content Exposure via Browser Snapshot and Screenshot Routes4.9 Medium
- openclawOpenClaw 2026.2.21 < 2026.4.10 - Authentication Bypass in Sandbox noVNC Helper Route9.2 Critical
- anviz cx2 lite firmware, cx7 firmware +1 moreAnviz Products Missing Authorization5.3 Medium
- anviz cx7 firmwareAnviz Products Missing Authorization5.3 Medium
- anviz cx7 firmwareAnviz Products Missing Authorization5.3 Medium
- flightbycanto cantoCanto <= 3.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Setting Modification4.3 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 3.9.8 - Authenticated (Subscriber+) Arbitrary Course Content Manipulation via tutor_update_course_content_order5.3 Medium
- extendthemes kubio ai page builderKubio AI Page Builder <= 2.7.2 - Missing Authorization to Authenticated (Contributor+) Limited File Upload via Kubio Block Attributes5.3 Medium
- tomdever wpforo forumwpForo Forum <= 2.4.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Forum Post Modification via 'guestposting' Parameter6.5 Medium
- veronalabs wp statistics – simple, privacy-friendly google analytics alternativeWP Statistics <= 14.16.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure and Privacy Audit Manipulation6.5 Medium
@paperclipai/servernpmPaperclip: Cross-tenant agent API token minting via missing assertCompanyAccess on /api/agents/:id/keys9.9 Critical- Show moreLoading…