CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- paolo geodirectoryWordPress GeoDirectory plugin <= 2.8.157 - Broken Access Control vulnerability6.5 Medium
- themefic hydra bookingWordPress Hydra Booking plugin <= 1.1.41 - Broken Access Control vulnerability7.3 High
- ben balter wp document revisionsWordPress WP Document Revisions plugin <= 3.8.1 - Broken Access Control vulnerability7.5 High
- tomdever wpforo forumWordPress wpForo Forum plugin <= 3.0.6 - Broken Access Control vulnerability9.1 Critical
- mervinpraison praisonai-platformpraisonai-platform: Any workspace member can delete the entire workspace via DELETE /workspaces/{id}8.1 High
- mervinpraison praisonai-platformpraisonai-platform: Any workspace member can add arbitrary user as owner via POST /workspaces/{id}/members9.6 Critical
- mervinpraison praisonai-platformpraisonai-platform: Any workspace member can rewrite workspace name, description, and settings via PATCH /workspaces/{id}6.5 Medium
- vitest-dev vitestVitest: Arbitrary file can be read and executed when Vitest UI server is listening9.8 Critical
- nezhahq nezhaNezha Monitoring: Authenticated agents can forge service-monitor results for other users' services7.1 High
- soplanningMissing Authorization in SOPlanning8.8 High
- apache airflowApache Airflow: per-DAG RBAC bypass on /ui/partitioned_dag_runs endpoints4.3 Medium
- google androidIn Camera, there is a possible unauthorized way to access photos due to a missing permission...4.0 Medium
- google androidIn keymint, there is a possible Permission Bypass due to a logic error in the code. This could...4.0 Medium
- google androidIn smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime...7.8 High
- google androidIn setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to...7.8 High
- wpengine advanced custom fields (acf®)Advanced Custom Fields (ACF®) <= 6.8.1 - Unauthenticated Arbitrary Post Modification via Front-End Form '_post_title' and '_post_content' Parameters5.3 Medium
- mervinpraison praisonai-platformpraisonai-platform: Any workspace member can promote themselves (or any other member) to owner via PATCH /workspaces/{id}/members/{user_id}9.6 Critical
- mervinpraison praisonai-platformpraisonai-platform: Any workspace member can remove any other member (including the owner) via DELETE /workspaces/{id}/members/{user_id}8.1 High
- mervinpraison praisonai-platformPraisonAI Platform missing role checks let any workspace member become owner and take over workspace membership8.8 High
- mervinpraison praisonai-platformPraisonAI has Cross-Workspace IDOR and Privilege Escalation via Platform API8.8 High
- mervinpraison praisonaiPraisonAI vulnerable to unauthenticated arbitrary file read via MCP workflow.show, workflow.validate, deploy.validate8.7 High
- eidetic-labs stigmemstigmem before 0.9.0a2 Authentication Bypass via Disabled Auth9.2 Critical
- admidioAdmidio: Any logged-in user can delete inventory fields via `mode=field_delete` — incomplete fix of #20246.5 Medium
- admidioAdmidio: Authorization bypass in file_delete enables cross-folder file removal by authenticated users without delete privileges6.5 Medium
- freescout-help-desk freescoutFreeScout: Thread Deletion Bypasses Mailbox Access Revocation4.3 Medium
github.com/metal3-io/ironic-standalone-operatorGoIronic Standalone Operator's controller modifies user-owned resources without consent4.3 Medium- jetbrains youtrackIn JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to...6.5 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion4.3 Medium
- jetbrains teamcityIn JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration...7.6 High
- jetbrains intellij ideaIn JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account8.0 High
- shopperdotcom shopperShopper: Missing authorization on Product admin Livewire sub-form components6.5 Medium
- shopperdotcom shopperShopper: Missing per-action authorization on PaymentMethods, Currencies and Carriers admin tables6.5 Medium
- dokployDokploy: Schedule Authorization Bypass Enables Host/Server Command Execution9.9 Critical
- openclawOpenClaw < 2026.5.18 - Scope Bypass via Inherited chat.send Route8.7 High
- openclawOpenClaw < 2026.4.29 - SSRF Policy Bypass via Browser Debug/Export Routes5.9 Medium
- openclawOpenClaw < 2026.5.18 - QQBot Missing Approver Identity Enforcement in Native Approval Buttons7.5 High
- openclawOpenClaw < 2026.5.4 - Unauthorized Device-Pairing Bootstrap Code Issuance via Chat Command8.7 High
- sitejo hape pkhHaPe PKH 1.1 Missing Authorization Allows Unauthenticated Record Deletion8.7 High
- wptravel wp travel proWP Travel Pro <= 10.6.0 - Missing Authorization to Unauthenticated Arbitrary User Deletion Including Administrators9.1 Critical
- rankmath rank math seo – ai seo tools to dominate seo rankingsRank Math SEO – AI SEO Tools to Dominate SEO Rankings <= 1.0.271 - Missing Authorization to Unauthenticated Homepage Settings Modification5.3 Medium
- frangoteam fuxaFUXA provides guest and invalid-token access to protected read APIs in secure mode5.5 Medium
- espocrmEspoCRM: Broken Access Control / IDOR in Note Pinning API allows unauthorized modification of notes4.3 Medium
- linux, linux kernel, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp (6es7518-4ax00-1ab0) +4 more +6 morex86/CPU/AMD: Prevent improper isolation of shared resources in Zen2's op cache8.8 High
- equalizedigital equalize digital accessibility checker – wcag, ada, eaa and section 508 complianceEqualize Digital Accessibility Checker <= 1.42.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Accessibility Issue Modification via edac_insert_ignore_data AJAX Action4.3 Medium
- themeisle visualizer: tables and charts manager for wordpressVisualizer: Tables and Charts Manager for WordPress <= 3.11.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Chart Creation and Modification via renderChartPages() and uploadData()…4.3 Medium
- croixhaug appointment booking calendar — simply schedule appointments booking pluginAppointment Booking Calendar <= 1.6.11.8 - Missing Authorization to Unauthenticated Arbitrary Modification via Bulk Appointments REST API Endpoint5.3 Medium
- hasanazizul 3d viewer – 3d model viewer – augmented reality – virtual try on3D Viewer <= 2.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via settings REST endpoint4.3 Medium
- smtp2go for wordpress – email made easySMTP2GO for WordPress <= 1.16.0 - Missing Authorization to Authenticated (Subscriber+) Log Read/Truncate4.3 Medium
- cyberhobo geo mashupGeo Mashup <= 1.13.19 - Missing Authorization to Unauthenticated Plugin Settings Disclosure via 'geo_mashup_content' Parameter5.3 Medium
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter8.8 High
- Show moreLoading…