CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builderEverest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder <= 3.4.7 - Missing Authorization to Authenticated (Subscriber+) Email Sending4.3 Medium
- pimcorePimcore: CustomReports Share Bypass7.1 High
- pimcorePimcore: WordExport Authorization Bypass for Unauthorized Document Export6.4 Medium
- microsoft ufoMicrosoft UFO WebSocket role spoofing allows authenticated peer task hijacking8.8 High
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabMissing Authorization in GitLab4.3 Medium
- getkirby kirbyKirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions5.3 Medium
- pimcorePimcore: Missing Authorization in WebDAV MOVE via unchecked asset move handling8.1 High
- budibaseBudibase: SCIM endpoints lack role-based authorization, BASIC users CRUD tenant users9.9 Critical
- budibaseBudibase: Webhook schema endpoint authorization bypass allows unauthenticated mutation of webhook and automation schema7.5 High
- bizswoop account manager for woocommerceWordPress Account Manager for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability4.3 Medium
- mamunur rashid the post gridWordPress The Post Grid plugin <= 7.9.2 - Broken Access Control vulnerability4.3 Medium
- roxnor elementskit elementor addons liteWordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability5.3 Medium
- roxnor elementskit elementor addons liteWordPress ElementsKit Elementor addons Lite plugin <= 3.9.6 - Broken Access Control vulnerability4.3 Medium
- prasad kirpekar wp meta and date removerWordPress WP Meta and Date Remover plugin <= 2.3.6 - Broken Access Control vulnerability4.3 Medium
- dearhive dearflipWordPress DearFlip plugin <= 2.4.27 - Broken Access Control vulnerability4.3 Medium
- wp media adminimizeWordPress Adminimize plugin <= 1.11.11 - Broken Access Control vulnerability4.3 Medium
- benbodhi svg supportWordPress SVG Support plugin <= 2.5.14 - Broken Access Control vulnerability4.3 Medium
- linux, linux kernel, red hat enterprise linux 10 +13 more +15 moreselinux: fix overlayfs mmap() and mprotect() access checks7.1 High
- webtoffee product import export for woocommerceWordPress Product Import Export for WooCommerce plugin <= 2.5.6 - Broken Access Control vulnerability4.3 Medium
- wc lovers wcfm membershipWordPress WCFM Membership plugin <= 2.11.10 - Broken Access Control vulnerability7.3 High
- strategy11 team awp classifiedsWordPress AWP Classifieds plugin <= 4.4.5 - Broken Access Control vulnerability6.5 Medium
- synology surveillance stationMissing authorization vulnerability in AddOns functionality in Synology Surveillance Station...4.9 Medium
- livemesh wpbakery page builder addons by livemeshWPBakery Page Builder Addons by Livemesh <= 3.9.4 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- livemesh siteorigin widgetsLivemesh SiteOrigin Widgets <= 3.9.2 - Missing Authorization to Authenticated (Subscriber+) Stored Cross-Site Scripting6.4 Medium
- livemesh addons for beaver builderLivemesh Addons for Beaver Builder <= 3.9.2 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Missing Authorization6.4 Medium
- clorith enable jquery migrate helperEnable jQuery Migrate Helper <= 1.4.1 - Missing Authorization to Authenticated (Subscriber+) jQuery Version Downgrade6.5 Medium
- rahulbhangale wp promoterWP Promoter <= 1.3 - Missing Authorization to Unauthenticated Statistics Reset via wpp-reset_stats AJAX Action5.3 Medium
- yoast seo – advanced seo with real-time guidance and built-in aiYoast SEO <= 26.5 - Insecure Direct Object Reference to Authenticated (Contributor+) Sensitive Information Exposure via 'post_id' Parameter4.3 Medium
- spaceapplications yamcsYamcs: Unauthorized user enumeration via IAM API endpoints4.3 Medium
- No product listedCraft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate...7.3 High
- getkirby kirbyKirby: `pages.access` permission is not checked during rendering of page drafts6.0 Medium
- sourcecodester edoc doctor appointment systemSourceCodester eDoc Doctor Appointment System delete-session.php authorization6.9 Medium
- aa-team woocommerce envato affiliatesWordPress Woocommerce Envato Affiliates plugin <= 1.2.1 - Settings Change vulnerability7.1 High
- sourcecodester cet automated grading system with ai predictive analyticsSourceCodester CET Automated Grading System with AI Predictive Analytics cross-site request forgery5.3 Medium
- 1panel-dev maxkbMaxKB: Broken Access Control in MaxKB OSS URL Fetch API5.3 Medium
- oban-bg oban webMissing authorization check on save-job event handler in oban_web5.3 Medium
- magepeople inc. taxi booking manager for woocommerceWordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.1 - Broken Access Control vulnerability5.3 Medium
- bplugins tiktok feedWordPress Tiktok Feed plugin <= 1.0.24 - Broken Access Control vulnerability4.3 Medium
- magepeople inc. wpbookinglyWordPress WpBookingly plugin <= 1.2.9 - Broken Access Control vulnerability4.3 Medium
- magepeople inc. wptravellyWordPress WpTravelly plugin <= 2.1.5 - Broken Access Control vulnerability6.3 Medium
- nvidia geforce, gpu display driver, rtx, quadro, nvs +1 more +3 moreNVIDIA Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer,...7.8 High
- bugsinkBugsink: Project scoping missing in sourcemap and debug-file lookup4.3 Medium
- videowhisper paid videochat turnkey siteWordPress Paid Videochat Turnkey Site plugin <= 7.3.23 - Broken Access Control vulnerability5.3 Medium
- ateeq rafeeq repairbuddyWordPress RepairBuddy plugin <= 4.1121 - Broken Access Control vulnerability4.3 Medium
- teconcetheme mayosis coreWordPress Mayosis Core plugin <= 5.4.7 - Broken Access Control vulnerability5.3 Medium
- zyxel gs1200-10v3 firmware, gs1200-5hpv3 firmware, gs1200-5v3 firmware +2 more +4 moreA missing authorization vulnerability in Zyxel GS1200-5v3 firmware versions through 1.00(ACPS.2...6.5 Medium
- linethemes nanocareWordPress NanoCare theme < 1.2.2 - Broken Access Control vulnerability5.4 Medium
- sepay team gatewayWordPress SePay Gateway plugin <= 1.1.20 - Sensitive Data Exposure vulnerability6.5 Medium
- sunshinephotocart sunshine photo cartWordPress Sunshine Photo Cart plugin <= 3.6.7 - Broken Access Control vulnerability6.3 Medium
- Show moreLoading…