CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- edward plainview mycryptocheckoutWordPress MyCryptoCheckout plugin <= 2.161 - Broken Access Control vulnerability7.5 High
- webtoffee smart coupons for woocommerceWordPress Smart Coupons for WooCommerce plugin < 2.3.0 - Broken Access Control vulnerability7.5 High
- cornel raiu wp search analyticsWordPress WP Search Analytics plugin < 1.5.0 - Broken Access Control vulnerability5.3 Medium
- wp chill rsvp and event managementWordPress RSVP and Event Management plugin <= 2.7.16 - Broken Access Control vulnerability5.3 Medium
- kings plugins b2bkingWordPress B2BKing plugin < 5.2.10 - Broken Access Control vulnerability4.9 Medium
- patterns in the cloud autoship cloud for woocommerce subscription productsWordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.14.0 - Broken Access Control vulnerability4.3 Medium
- themeansar newsesWordPress Newses theme <= 2.0.0.77 - Broken Access Control vulnerability5.4 Medium
- lucian apostol auto affiliate linksWordPress Auto Affiliate Links plugin <= 6.8.8.3 - Broken Access Control vulnerability5.3 Medium
- unknown flextableWordPress FlexTable plugin <= 3.24.0 - Broken Access Control vulnerability4.3 Medium
- nikki blight qr redirectorWordPress QR Redirector plugin <= 2.0.3 - Broken Access Control vulnerability4.3 Medium
- sourcecodester student grades management systemSourceCodester Student Grades Management System cross-site request forgery5.3 Medium
- ruben garcia gamipressWordPress GamiPress plugin <= 7.6.3 - Broken Access Control vulnerability5.3 Medium
- lfprojects mlflow, mlflow mlflow/mlflow, red hat openshift ai (rhoai) +2 moreMissing Authorization Validation in mlflow/mlflow9.0 Critical
- nousresearch hermes-agentNousResearch hermes-agent Batch Runner approval.py check_all_command_guards authorization6.9 Medium
- calcom cal.diycalcom cal.diy cross-site request forgery5.3 Medium
- woocommerce paypal paymentsWooCommerce PayPal Payments <= 4.0.1 - Missing Authorization to Unauthenticated Order Manipulation and Information Disclosure8.2 High
- nezhahq nezhaNezha Monitoring: RoleMember can run shell on every server (cross-tenant RCE) via POST /api/v1/cron9.9 Critical
- getarcaneapp arcaneArcane: Missing admin authorization on global variables endpoint8.8 High
- nezhahq nezhaNezha Monitoring: RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check)7.1 High
- tp link systems inc. archer re360 v1, tp-link re305 firmware, re360 firmware +7 more +9 moreAuthentication Logic Vulnerability on Multiple TP-Link Range Extenders8.7 High
- baptistearno typebot.ioTypeBot: Cross-Typebot Result Data Access via Missing typebotId Filter3.1 Low
- baptistearno typebot.ioTypeBot: Unauthenticated SSRF via isolated-vm fetch in preview chat endpoint bypasses SSRF controls10.0 Critical
- amazon kiro cliTool Execution Without Authorization via Piped Stdin in Kiro CLI8.4 High
- devolutions serverMissing authorization in the entry status management feature in Devolutions Server allows a non...5.4 Medium
- devolutions serverImproper access control in the entry documentation and attachment features in Devolutions Server...4.3 Medium
- devolutions serverMissing authorization in the user profile update feature in Devolutions Server allows an...4.3 Medium
- teamviewer dex (on-premises)Broken Access Control in TeamViewer DEX Platform (On Premises)5.4 Medium
- jetmonsters motopress hotel bookingMotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action5.3 Medium
- metaphorcreations ditty – responsive news tickers, sliders, and listsDitty <= 3.1.65 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via ditty_init AJAX Action7.5 High
- registrationformbuilder vedrixa forms – user registration form, signup form & drag & drop form builderVedrixa Forms <= 1.1.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Form Structure Modification via wefb_save_form_structure AJAX Action4.3 Medium
- wpxpo fastxFastX <= 1.0.2 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Installation and Activation4.3 Medium
- zte mu5250, mu5250 firmware +1 moreInformation disclosure vulnerability in ZTE MU52505.7 Medium
- shapedplugin location weather – wordpress weather forecast, aqi, temperature and weather widgetLocation Weather <= 3.0.2 - Missing Authorization to Authenticated (Contributor+) Block Settings Modification and Cache Purging4.3 Medium
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh/agent +1 moreInvoking key constraints not enforced in golang.org/x/crypto/ssh/agent9.1 Critical
- golang crypto, golang.org/x/crypto golang.org/x/crypto/ssh +1 moreInvoking bypass of FIDO/U2F security keys physical interaction in golang.org/x/crypto/ssh9.1 Critical
- smithyhq sqladminSQLAdmin: Authorization Bypass on `ajax_lookup`4.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to File Download Authorization Bypass in submit_password()6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/message_page' allowing unauthenticated read of any conversation message6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in the`/ccm/frontend/conversations/message_detail` endpoint6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR in '/ccm/frontend/conversations/get_rating'6.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.5.0 and below is vulnerable to IDOR combined with a missing authentication gate for endpoint /ccm/system/dialogs/file/usage/{fID}6.3 Medium
- fissionFission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any function without an HTTPTrigger9.8 Critical
- mrdollar4444 gsheet for woo importerGSheet For Woo Importer <= 2.3.1 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Reset4.3 Medium
- villatheme happyWordPress HAPPY plugin <= 1.0.10 - Broken Access Control vulnerability6.5 Medium
- saleswonder team tobias cf7 wow stylerWordPress CF7 WOW Styler plugin <= 1.7.6 - Broken Access Control vulnerability5.3 Medium
- xwiki xwiki-platformXWiki Platform has an Unauthenticated XAR Import via REST /wikis/{wikiName}9.3 Critical
- thorsten phpmyfaqphpMyFAQ - Insecure Direct Object Reference in User Password API8.7 High
wgerPyPIwger: cross-tenant account deletion / deactivation / activation by gym.manage_gym + gym=None8.5 High- hclsoftware dominoiqHCL DominoIQ is affected by broken access control6.5 Medium
- magepeople inc. wpbookinglyWordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability6.5 Medium
- Show moreLoading…