CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- techjewel ninja tables – easy data table builderNinja Tables <= 5.2.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Table Creation4.3 Medium
- servmask all-in-one wp migration unlimited extensionAll-in-One WP Migration Unlimited Extension <= 2.83 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Backup Schedule Creation and Backup File Download6.5 Medium
- mercadopago mercado pago payments for woocommerceMercado Pago payments for WooCommerce <= 8.7.11 - Missing Authorization to Unauthenticated PIX Payment QR Code Image Disclosure5.3 Medium
- wwbn avideoWWBN AVideo: Exposure of Sensitive Information to an Unauthorized Actor and Missing Authorization7.7 High
- kubewarden kubewarden-controllerKubewarden: RBAC Reconnaissance via unchecked can_i host capability call4.3 Medium
- getgrav gravGrav: Privilege Escalation via Missing Server-Side Validation of groups/access9.4 Critical
- dani-garcia vaultwardenVaultwarden missing authorization check allows Manager-role users to enumerate all collections5.3 Medium
- openclawOpenClaw < 2026.4.23 - Unsafe Config Mutation via Gateway Tool Denylist Bypass7.7 High
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 5.1.4 - Missing Authorization to Authenticated (Contributor+) Limited Page Content Modification4.3 Medium
- roxnor elementskit elementor addons – advanced widgets & templates addons for elementorElementsKit Elementor Addons <= 3.8.2 - Missing Authorization to Unauthenticated Widget Content Overwrite6.5 Medium
- ahmadgb geekybot — ai copilot, chatbot, woocommerce lead gen & zero-prompt contentGeekyBot <= 1.2.2 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation via 'geekybot_frontendajax' AJAX Action9.8 Critical
- phpvmsphpvms: /importer authorization bypass causing full database wipe9.4 Critical
- azuracastAzuraCast before 0.23.6 Missing Permission Check via /play7.1 High
- azuracastAzuraCast before 0.23.6 Metadata Injection via Liquidsoap API5.3 Medium
- openclawOpenClaw < 2026.4.22 - Authentication Bypass in Gateway Control UI Bootstrap Config Endpoint6.3 Medium
- argoproj argo workflows, argo-workflows, red hat openshift ai (rhoai) +2 moreArgo Workflows Is Missing Authorization in Sync ConfigMap Provider8.5 High
- getkirby kirbyKirby: System API endpoint leaks license data and installed version to authenticated users5.3 Medium
- getkirby kirbyKirby: User avatar creation, replacement and deletion are not gated by user update permissions5.3 Medium
- getkirby kirbyKirby: Read access to site, user and role information is not gated by permissions7.1 High
- apache polarisApache Polaris: staged table creation could vend storage credentials for unvalidated locations9.4 Critical
- strangerstudios paid memberships pro – content restriction, user registration, & paid subscriptionsPaid Memberships Pro <= 3.6.5 - Missing Authorization to Authenticated (Subscriber+) Stripe Webhook Deletion and Payment Processing Disruption7.1 High
- wproyal royal addons for elementor – addons and templates kit for elementorRoyal Addons for Elementor <= 1.7.1056 - Missing Authorization to Unauthenticated Form Action Meta Modification5.3 Medium
- thimpress fundpress – wordpress donation pluginFundPress <= 2.0.8 - Missing Authorization to Unauthenticated Arbitrary Donation Status Modification via donate_action_status AJAX Handler5.3 Medium
- shahariaazam wp mail gatewayWP Mail Gateway <= 1.8 - Missing Authorization to Authenticated (Subscriber+) SMTP Configuration Modification via 'wmg_save_provider_config' AJAX Action8.8 High
- boldgrid total upkeep – wordpress backup plugin plus restore & migrate by boldgridTotal Upkeep <= 1.17.1 - Missing Authorization to Unauthenticated Rollback Cancellation5.3 Medium
- getkirby kirbyKirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog7.1 High
- getarcane arcaneArcane Vulnerable to Unauthenticated Disclosure of Custom Compose Template Content (incl. `.env` secrets)8.7 High
- chartbrewChartbrew: Missing Authorization in /api/chart/:chart_id/query via team-level refresh toggle7.5 High
- admidioAdmidio: Missing Authorization on Inventory Module Destructive Endpoints Allows Any Authenticated User to Delete Items6.5 Medium
- openclawOpenClaw < 2026.4.21 - Authorization Bypass in Owner-Enforced Commands via Wildcard Channel Senders2.3 Low
- n8nn8n: Credential Authorization Bypass in dynamic-node-parameters Allows Foreign API Key Replay7.1 High
- n8nn8n: Hijacking of Unauthenticated Chat Execution6.3 Medium
- jenkins github branch source, jenkins project github branch source plugin +1 moreJenkins GitHub Branch Source Plugin: Missing permissions check allows attackers to perform a connection test4.3 Medium
- jenkins script security, jenkins project script security plugin +1 moreJenkins Script Security Plugin: Missing permission checks allow enumeration of pending and approved classpaths4.3 Medium
- brainstorm force spectraWordPress Spectra plugin <= 2.19.22 - Broken Access Control vulnerability4.3 Medium
- stellarwp givewpWordPress GiveWP plugin <= 4.14.5 - Broken Access Control vulnerability5.3 Medium
- complianz – gdpr/ccpa cookie consentComplianz – GDPR/CCPA Cookie Consent <= 7.4.5 - Missing Authorization to Unauthenticated Private Post Content Disclosure via Consent Area REST Endpoint5.3 Medium
- wedevs wp user frontendWordPress WP User Frontend plugin <= 4.3.1 - Broken Access Control vulnerability6.5 Medium
- brainstorm force sureforms proWordPress SureForms Pro plugin <= 2.8.0 - Broken Access Control vulnerability7.3 High
- corednsCoreDNS transfer plugin subzone ACL bypass via lexicographic zone comparison8.2 High
- devolutions serverImproper access control in the vault documentation feature in Devolutions Server 2026.1.14.0...6.5 Medium
- cisco intersight device connector, nutanix cisco intersight device connector for prism central +1 moreCisco Intersight Device Connector for Nutanix Prism Central Unauthenticated API Access6.7 Medium
- spring boot, vmware spring boot, red hat amq broker 7 +14 more +16 moreSpring Boot's default security filter chain has no authorization rule with Actuator but without Health9.1 Critical
- projeqtorProjeQtor < 12.4.4 Missing Authorization via objectDetail.php7.1 High
- code-projects invoice system in laravelcode-projects Invoice System in Laravel cross-site request forgery5.3 Medium
- openclawOpenClaw < 2026.4.20 - Gateway Config Mutation Guard Bypass via Agent Tool Access6.0 Medium
- openclawOpenClaw < 2026.4.20 - Tool Policy Bypass via Bundled MCP/LSP Tools2.3 Low
- deskflowDeskflow: Local privilege escalation via unauthenticated IPC7.8 High
- kimaiKimai: Team API Missing Object-Level Authorization3.3 Low
- liaison site proberLiaison Site Prober <= 1.2.1 - Missing Authorization to Unauthenticated Information Exposure in '/logs' REST API Endpoint5.3 Medium
- Show moreLoading…