CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- infused addons infusedwoo proInfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Arbitrary Post Deletion via Multiple Parameters9.1 Critical
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 5.1.5 - Unauthenticated Missing Authorization to Admin Approval Bypass via 'action' Parameter5.3 Medium
- infused addons infusedwoo proInfusedWoo Pro <= 5.1.2 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary User Meta Update8.8 High
- infused addons infusedwoo proInfusedWoo Pro <= 5.1.2 - Unauthenticated Missing Authorization to Privilege Escalation via 'iwar_save_recipe'9.8 Critical
- gitlabMissing Authorization in GitLab2.7 Low
- gitlabMissing Authorization in GitLab2.6 Low
- gitlabMissing Authorization in GitLab4.3 Medium
- gowebsmarty wp encryption – one click free ssl certificate & ssl / https redirect, security & ssl scanWP Encryption - One Click SSL & Force HTTPS <= 7.8.5.10 - Missing Authorization to Authenticated (Subscriber+) SSL Setup Tampering5.4 Medium
- joedolson my calendar – accessible event managerMy Calendar <= 3.7.9 - Authenticated (Custom+) Missing Authorization to Unauthorized Event Publication via 'event_approved' Parameter4.3 Medium
- frappe erpnextERPNext: Unauthorised Document modification due to missing validation5.9 Medium
- frappe erpnextERPNext: Unauthorised Document modification due to missing validation9.9 Critical
- grafana, grafana oss +1 moreBAC in Snapshot API allows deletion of unauthorized dashboard snapshots6.5 Medium
- palo alto networks prisma access agentPrisma Access Agent: Local Privilege Escalation Vulnerability5.9 Medium
- date ical project ical, drupal date ical +1 moreDate iCal - Critical - Information disclosure - SA-CONTRIB-2026-0379.8 Critical
- siyuan-note siyuanSiYuan: SiYuan publish-mode Reader can mutate Conf and SQL index via 8 ungated APIs7.2 High
- siyuan-note siyuanSiYuan: Broken access control in SiYuan `/api/tag/getTag` — Reader role can mutate `Conf.Tag.Sort` and persist to disk4.3 Medium
- nautobotNautobot: REST API permits creation of GenericForeignKey references to objects that the user should not be able to reference5.4 Medium
- metagauss profilegrid – user profiles, groups and communitiesProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Group Joining7.1 High
- metagauss profilegrid – user profiles, groups and communitiesProfileGrid <= 5.9.8.4 - Missing Authorization to Authenticated (Subscriber+) Group Settings Modification4.3 Medium
- rometheme rtmkitRTMKit Addons for Elementor <= 2.0.2 - Authenticated (Author+) Missing Authorization to Widget Configuration Modification4.3 Medium
- hostinger reach – ai-powered email marketing for wordpressHostinger Reach <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Integration API Key Update5.3 Medium
- pr-gateway blog2social: social media auto post & schedulerBlog2Social: Social Media Auto Post & Scheduler <= 8.9.0 - Missing Authorization to Authenticated (Subscriber+) Delete Arbitrary B2S Post Records via 'postId' Parameter5.4 Medium
- stylemix cost calculator builderCost Calculator Builder <= 4.0.1 - Unauthenticated Price Manipulation and Insecure Direct Object Reference5.3 Medium
- chriscct7 monsterinsights – google analytics dashboard for wordpress (website stats made easy)MonsterInsights <= 10.1.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure And Plugin Integration Reset7.1 High
- devolutions serverImproper access control in the notification management endpoints in Devolutions Server allows an...4.3 Medium
- microsoft windows admin centerWindows Admin Center Elevation of Privilege Vulnerability8.3 High
- fortinet fortisandbox, fortisandbox cloud, fortisandbox paas +2 moreA missing authorization vulnerability in Fortinet FortiSandbox 5.0.0 through 5.0.1, FortiSandbox...9.1 Critical
- wpmu dev hustleWordPress Hustle plugin <= 7.8.10.1 - Broken Access Control vulnerability5.3 Medium
- devolutions serverMissing authorization in the PAM module in Devolutions Server allows an authenticated user with a...4.3 Medium
- gabe livan asset cleanup: page speed boosterWordPress Asset CleanUp: Page Speed Booster plugin <= 1.4.0.3 - Broken Access Control vulnerability5.3 Medium
- broadstreet adsWordPress Broadstreet Ads plugin <= 1.52.2 - Broken Access Control vulnerability5.4 Medium
- stylemix motors – car dealership & classified listings pluginMotors – Car Dealership & Classified Listings Plugin <= 1.4.103 - Missing Authorization to Authenticated (Subscriber+) Payment Bypass via 'stm_payment_status' Parameter4.3 Medium
- arraytics timeticsWordPress Timetics plugin <= 1.0.53 - Broken Access Control vulnerability8.2 High
- zealopensource smart appointment & bookingSmart Appointment & Booking <= 1.0.8 - Missing Authorization to Unauthenticated Arbitrary Booking Cancellation5.3 Medium
- coderpress coinbase commerce for contact form 7Coinbase Commerce for Contact Form 7 <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) API Key Modification via 'cccf7_api_key' Parameter4.3 Medium
- rbplugins forms rbForms Rb <= 1.1.9 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via 'form_id' Parameter4.3 Medium
- thewebsitesupply gwd conexGWD Connect <= 2.9 - Unauthenticated Limited Code Execution via update_agent4.8 Medium
- videowhisper rate star review vote – ajax reviews, votes, star ratingsRate Star Review Vote <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'rating_id' Parameter4.3 Medium
- higheredlab hel online classroom: ai-powered online classroomsHEL Online Classroom: AI-powered Online Classrooms <= 1.0.3 - Missing Authorization to Unauthenticated Arbitrary Classroom Deletion via 'id' Parameter5.3 Medium
- sap se incentive and commission managementMissing Authorization Check in SAP Incentive and Commission Management4.3 Medium
- sap se s/4hana condition maintenanceMissing Authorization check in SAP S/4HANA Condition Maintenance6.3 Medium
- sap se strategic enterprise management (bsp application balanced scorecard wizard)Missing Authorization Check in SAP Strategic Enterprise Management (BSP application Balanced Scorecard Wizard)5.4 Medium
- mem0mem0 server lacks authentication and authorization controls for its memory creation API endpoint5.3 Medium
- mem0The mem0 1.0.0 server lacks authentication and authorization controls for its memory deletion API...6.5 Medium
- mem0The mem0 1.0.0 server lacks authentication and authorization controls for its memory reset and...6.5 Medium
- mem0The mem0 v1.0.0 server lacks authentication and authorization controls for its memory reset...9.1 Critical
- mem0mem0 server lacks authentication and authorization controls for its memory deletion API endpoint6.5 Medium
- apple macosAn authorization issue was addressed with improved state management. This issue is fixed in macOS...5.5 Medium
- mantisbtMantisBT: Private Bugnote Attachment Content Leak via REST API7.2 High
- bitwarden serverBitwarden Server < 2026.4.0 Missing Authorization via Provider Clients8.9 High
- Show moreLoading…