CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- bitwarden serverBitwarden Server < 2026.4.1 Missing Authorization via Organization Cipher Import5.3 Medium
- meari alibaba oss hostedMeari unauthenticated alert image access in cloud object storage7.5 High
- meari com.meari.sdkMeari OpenAPI device status IDOR7.5 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Improper Authorization in Standard Channels Allows Message Updates with Read Permission6.5 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Insecure Message Access Breaks Authorization7.1 High
- dell automation platformDell Automation Platform versions prior to 2.0.0.0, contains a missing authorization...8.0 High
- thecartpressWordPress TheCartPress 1.5.3.6 Privilege Escalation Unauthenticated9.3 Critical
- No product listedosTicket Dispatcher class.dispatcher.php cross-site request forgery5.3 Medium
- hclsoftware bigfix webui, hcltech bigfix webui api, bigfix webui application administration +19 more +21 moreHCL BigFix WebUI is affected by a missing authorization vulnerability5.3 Medium
- pgbouncerPgBouncer missing authorization check in KILL_CLIENT admin command4.3 Medium
- free5gcfree5GC: SMF UPI management interface lacks auth middleware; unauthenticated topology read/write requests reach handlers10.0 Critical
- free5gcfree5GC: SMF UPI DELETE /upi/v1/upNodesLinks/{ref} panics on AN-node deletion via nil UPF dereference; unauthenticated, state-mutating8.2 High
- free5gcfree5GC: NEF nnef-oam route group is unauthenticated; no-token requests reach the OAM handler10.0 Critical
- free5gcfree5GC: NEF 3gpp-traffic-influence API is unauthenticated; missing or forged bearer tokens can create, read, patch, and delete subscriptions9.4 Critical
- free5gcfree5GC: SMF UPI POST /upi/v1/upNodesLinks exits the SMF process on overlapping UE pools (unauthenticated, reachable Fatalf)7.5 High
- free5gcfree5GC: NEF nnef-callback route group is unauthenticated; forged callback requests are accepted into the processing path7.3 High
- free5gcfree5GC: NEF 3gpp-pfd-management API is unauthenticated; forged bearer tokens can create, read, and delete PFD transactions9.4 Critical
- openwebui open webui, open-webui +1 moreOpen WebUI: Open WebUI Improper Authorization Control7.3 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Unauthorized File and Knowledge Base Content Access via RAG Vector Search6.5 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Ollama Model Access Control Bypass via /api/generate, /api/embed, /api/embeddings, and /api/show5.4 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Model Import Overwrites Any Model Without Ownership Check6.5 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Missing Access Check on Channel Members Endpoint for Standard Channels4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Global Knowledge Base Enumeration via knowledge-bases Meta-Collection4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Knowledge Base Destruction and RAG Poisoning via Unauthorized Collection Overwrite8.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Channel Access Grants Bypass filter_allowed_access_grants5.4 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: responses passthrough endpoint lacks access control authorization7.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Base Model Routing Bypasses Access Control via Model Chaining7.6 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Mass Assignment via Pydantic extra='allow' Allows Creating Folders in Other Users' Accounts5.0 Medium
- apache nifiApache NiFi: Missing Execute Code Required Permission on TinkerpopClientService7.5 High
- seppmail ag secure email gatewayMissing Authorization in GINAv29.3 Critical
- cashdro 3 administration panelWeak credentials vulnerability in the CashDro 3 web administration panel8.6 High
- lin-snow ech0Ech0 before 4.7.3 Unauthenticated fav_count Modification6.9 Medium
- lin-snow ech0Ech0 before 4.7.3 Unauthenticated Like Endpoint Metric Inflation6.9 Medium
- bplugins pdf posterWordPress PDF Poster plugin <= 2.4.1 - Broken Access Control vulnerability5.3 Medium
- magepeople inc. bus ticket booking with seat reservationWordPress Bus Ticket Booking with Seat Reservation plugin < 5.6.8 - Broken Access Control vulnerability5.3 Medium
- wproyal royal elementor addonsWordPress Royal Elementor Addons plugin < 1.7.1053 - Broken Access Control vulnerability5.3 Medium
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.53.0 - Missing Authorization to Authenticated (Subscriber+) Scheduled Form Submission Export via forminator_export_entries Action on wp_loaded Hook6.5 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.10.6 - Unauthenticated Arbitrary Appointment View, Modification and Deletion6.5 Medium
- free5gcfree5GC: PCF Npcf_SMPolicyControl missing authentication middleware allows unauthenticated access to SM policy handlers and disclosure of subscriber SUPI8.2 High
- wpmudev forminator forms – contact form, payment form & custom form builderForminator Forms <= 1.51.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'forminator_action' Parameter5.3 Medium
github.com/getaxonflow/axonflowGoAxonflow fixed bugs by implementing multi-tenant isolation and access-control hardening9.1 Criticallemmy_apicrates.ioLemmy may expose private community data through community, saved, liked, and modlog API views5.3 Mediumlemmy_apicrates.ioPrivate Lemmy instances expose multi-community metadata without authentication5.3 Mediumgithub.com/cloudnativelabs/kube-routerGo,github.com/cloudnativelabs/kube-router/v2Go +1 morekube-router: GoBGP gRPC Admin Port Exposed on Node Primary IP Without Authentication, Allowing Cluster-Wide BGP Route Injection6.3 Medium- thorsten phpmyfaqphpMyFAQ - Missing Permission Check on 12 Configuration API Endpoints Allows Information Disclosure5.3 Medium
- thorsten phpmyfaqphpMyFAQ - Missing Authorization in Tag Deletion Endpoint5.3 Medium
- craftcms cmsCraft CMS: Missing Volume Permission Check in AssetsController::actionShowInFolder Allows Information Disclosure7.1 High
- craftcms cmsCraft CMS: Missing Authorization in GraphQL Address Resolver Allows Cross-Scope PII Disclosure7.1 High
- cisco prime infrastructureCisco Prime Infrastructure Information Disclosure Vulnerability4.3 Medium
- cisco identity services engine, identity services engine software +1 moreCisco Identity Services Engine Authentication Bypass Vulnerability4.3 Medium
- Show moreLoading…