CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- wp chill image photo gallery final tiles gridWordPress Image Photo Gallery Final Tiles Grid plugin <= 3.6.11 - Broken Access Control vulnerability4.3 Medium
- add-ons.org pdf for elementor forms + drag and drop template builderWordPress PDF for Elementor Forms + Drag And Drop Template Builder plugin <= 5.5.1 - Broken Access Control vulnerability5.0 Medium
- acyba acymailing – an ultimate newsletter plugin and marketing automation solution for wordpressAcyMailing <= 10.8.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'acymailing_router'8.8 High
- six apart ltd. movable type, movable type advanced, movable type premium +1 more +3 moreMissing authorization vulnerability exists in Movable Type. Under certain conditions, when a user...5.3 Medium
- xpro addons — 140+ widgets for elementorXpro Addons — 140+ Widgets for Elementor <= 1.5.0 - Missing Authorization to Unauthenticated Xpro Template Creation5.3 Medium
- conoha typesquare webfonts for conohaTypeSquare Webfonts for ConoHa <= 2.0.4 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Modification via 'fontThemeUseType' Parameter4.3 Medium
- convoypanel panelCtrlPanel: Missing Authorization on Admin Write Endpoints Allows RBAC Bypass8.1 High
- convoypanel panelCtrlPanel has Missing Authentication Checks in Datatable Admin Endpoints6.5 Medium
- discourseDiscourse has a subscription access bypass in its discourse-subscriptions plugin2.1 Low
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.6 - Missing Authorization to Authenticated (Subscriber+) Sensitive Form Submission Data Exposure via 'kirki_wp_admin_get_apis' Action6.5 Medium
- wwbn avideoWWBN AVideo: Unauthenticated Arbitrary Image Read via Path Traversal in `view/img/image404Raw.php`6.9 Medium
- funnelkit funnel builder for woocommerce checkoutFunnel Builder for WooCommerce Checkout < 3.15.0.3 Missing Authorization via AJAX8.7 High
- brainstorm force presto player, presto made, inc player +1 moreWordPress Presto Player plugin <= 4.1.3 - Broken Access Control vulnerability4.3 Medium
- discourseDiscourse: Information Disclosure in Form Template API Due to Missing Authorization6.0 Medium
- glpi-project glpiGLPI: Unauthorized export of form structure5.1 Medium
- significant-gravitas autogptAutoGPT has Authenticated Session Hijacking via IDOR7.1 High
- steipete summarizeSummarize < 0.15.1 Unapproved Browser Automation Execution2.1 Low
- steipete summarizeSummarize < 0.15.1 Path Traversal via slidesDir Parameter7.1 High
- steipete summarizeSummarize < 0.15.1 Browser Extension Missing Authorization via Content Script5.3 Medium
- shopperdotcom shopperShopper: Authorization bypass in multiple Livewire admin components8.1 High
- getarcaneapp arcaneArcane: Missing admin authorization on git repository endpoints allows non-admin users to exfiltrate stored Git credentials and tamper with GitOps configs9.9 Critical
- mattermost, mattermost server +1 moreMissing authorization check in AI message rewrite endpoint allows access to private thread content6.5 Medium
- mattermost, mattermost server +1 moreInstance and webhook GitLab plugin commands were able to be run by non-admin users6.5 Medium
- mattermost, mattermost server +1 moreMattermost fails to enforce create_post permission when editing posts4.3 Medium
- smub feeds for youtube (youtube video, channel, and gallery plugin)Feeds for YouTube < 2.6.4 - Subscriber+ License Data Deletion5.4 Medium
- multicollab multicollab: content team collaboration and editorial workflowMulticollab: Content Team Collaboration and Editorial Workflow <= 5.2 - Missing Authorization to Authenticated (Subscriber+) Collaboration Comment4.3 Medium
- essentialplugin essential chat supportEssential Chat Support <= 1.0.1 - Missing Authorization to Unauthenticated Settings Reset via 'ecs_reset_settings' Parameter5.3 Medium
- mathesar-foundation mathesarMathesar: Missing collaborator checks allowed access to database-scoped Mathesar metadata5.3 Medium
- mathesar-foundation mathesarMathesar: Missing collaborator checks allowed access to saved explorations in other databases5.3 Medium
- budibaseBudibase: `PUT /api/datasources/:datasourceId` is protected only by `TABLE/READ` permission instead of builder access, allowing any authenticated app user to overwrite datasource connection parameters…8.8 High
- google cloud internal integration platform apisGoogle Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution.10.0 Critical
- techlabpro1 classified listing – ai-powered classified ads & business directory pluginClassified Listing <= 5.3.10 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via add_order_note and send_email_to_user_by_moderator AJAX Actions4.3 Medium
- smartcatai smartcat translator for wpmlSmartcat Translator for WPML <= 3.1.77 - Missing Authorization to Unauthenticated Plugin Settings Update6.5 Medium
- realmag777 fox – currency switcher professional for woocommerceFOX – Currency Switcher Professional for WooCommerce <= 1.4.5 - Missing Authorization to Authenticated (Contributor+) Configuration Deletion8.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Unauthenticated endpoint can trigger embedding generation (cost/DoS)6.5 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Low-privilege authenticated users can enumerate and stop global background tasks, causing system-wide chat disruption7.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Missing `workspace.tools` Authorization Check on Tool Update Endpoint Allows Privilege Escalation to Code Execution7.2 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Chat completion API allows tool restrictions to be bypassed7.1 High
- google chromeInsufficient policy enforcement in Passwords in Google Chrome on Windows prior to 148.0.7778.168...7.5 High
- wavelens gradientGradient: Unauthenticated worker on /proto → arbitrary NAR write / cache poisoning9.4 Critical
- midoks mdserver-webmdserver-web: Missing Authorization and Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')9.3 Critical
- portainerPortainer: Missing authorization on custom template file endpoint exposes template content6.0 Medium
- portainerPortainer: Endpoint security bypass via Swarm service create/update9.4 Critical
- portainerPortainer: Missing authorization on Docker plugin endpoints allows host RCE9.4 Critical
- flowiseai flowiseFlowise: Vector Store No Permission Checks8.7 High
- richardhbtz soundcloud-rpcsoundcloud-rpc: Remote Code Execution via XSS in Track Title9.6 Critical
- postgresqlPostgreSQL CREATE TYPE does not check multirange schema CREATE privilege5.4 Medium
- wpengine database backup for wordpressDatabase Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Arbitrary File Read and Deletion8.1 High
- wpengine database backup for wordpressDatabase Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Export7.5 High
- wpengine database backup for wordpressDatabase Backup for WordPress <= 2.5.2 - Missing Authorization to Unauthenticated Database Backup Interception7.5 High
- Show moreLoading…