CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- typo3 cmsTYPO3 CMS - Broken Access Control in DataHandler5.3 Medium
- typo3 cmsTYPO3 CMS - Broken Access Control in Recycler5.3 Medium
- typo3 cmsTYPO3 CMS - Broken Access Control in Form Framework7.6 High
- typo3 cmsTYPO3 CMS - Destructive Actions on File Mount Folders7.2 High
- typo3 cmsTYPO3 CMS - Broken Access Control in Form Framework7.6 High
- wedevs user frontend: ai powered frontend posting, user directory, profile, membership & user registrationUser Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration <= 4.3.2 - Missing Authorization to Authenticated (Subscriber+) Subscription Pack Cancellation4.3 Medium
- syed balkhi wpformsWPForms Lite < 1.10.0.5 – Unauthenticated PayPal Webhook Forgery5.3 Medium
- qnap qumagieQuMagie6.6 Medium
- sap se odp data replication apisMissing caller identification check-in for ODP Data Replication APIs6.6 Medium
- sap se netweaver as abap and abap platformMissing Authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform7.1 High
- sap se mdg (review match groups application)Missing Authorization check in SAP MDG (Review Match Groups Application)4.3 Medium
- juev nebula-meshnebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation9.9 Critical
- frangoteam fuxaFUXA: Scheduler API missing admin check enables operator-to-admin escalation via scheduled device actions6.3 Medium
- devolutions serverMissing authorization in the deleted user groups API in Devolutions Server allows an...4.3 Medium
- stackit iaas apiSTACKIT IaaS API Privilege Escalation via Service Account Attachment7.7 High
- cifi seo plugin by squirrly seo, seo squirrly plugin by squirrly seo +1 moreSEO Plugin by Squirrly SEO <= 12.4.16 - Missing Authorization to Authenticated (Contributor+) Privileged Cloud API Operations4.3 Medium
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.3.6 - Unauthenticated Sensitive Information Exposure via 'c_status' and 'return_type' Parameters5.3 Medium
- webvitaly page-listPage-list <= 6.2 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure via Shortcode Attributes4.3 Medium
- themeisle rss aggregator by feedzy – feed to post, autoblogging, news & youtube video feeds aggregatorRSS Aggregator by Feedzy <= 5.1.7 - Missing Authorization to Authenticated (Contributor+) Import Job Creation, Execution, Purge, Log Clearing, and Information Disclosure via Multiple AJAX Sub-Actions4.3 Medium
- alejo30 alba boardAlba Board <= 2.1.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'card_id' Parameter4.3 Medium
- runzero platform, shopware +1 moreShopware: Admin API ACL Bypass in Order State Transition Endpoints6.5 Medium
- runzero platform, shopware +1 moreShopware: Privilege Escalation via Sync API Integration Admin Flag Bypass6.5 Medium
- lakshayd02 hostel-management-system-phpLakshayD02 Hostel-Management-System-PHP Admin Dashboard index.php authorization5.3 Medium
- nuclioNuclio: Missing authorization on project write paths allows any authenticated user to modify or delete any project8.3 High
- kurt software studio writeup mobile appImproper Access Control in Kurt Software Studio's WriteUp Mobile App8.8 High
- mispMISP Event template importer authorization bypass5.1 Medium
- octopus serverIn affected versions of Octopus Server, permissions were not checked correctly resulting in any...6.0 Medium
- smartypants sp project & document managerSP Project & Document Manager <= 4.71 - Missing Authorization to Unauthenticated Arbitrary File Information Disclosure via view_file() Function7.5 High
- drupal localgov workflowsLocalGov Workflows - Moderately critical - Information disclosure - SA-CONTRIB-2026-0399.8 Critical
- glpi-project glpiGLPI vulnerable to arbitrary file access5.9 Medium
- glpi-project glpiGLPI Vulnerable to Arbitrary Item Deletion via Planning Endpoint7.0 High
- glpi-project glpiGLPI vulnerable to arbitrary files deletion by technician7.0 High
- glpi-project glpiGLPI vulnerable to unauthorized reading of a specific asset object7.0 High
- danny-avila librechatLibreChat has IDOR in API Keys Management that allows any authenticated user to overwrite other users' API keys7.1 High
- nextlevelbuilder goclawnextlevelbuilder GoClaw Team Task Completion team_tasks_lifecycle.go TeamTasksTool.executeComplete authorization5.3 Medium
- namelessmc namelessNamelessMC: Reactions on private or blocking profile posts can be modified without proper authorization5.3 Medium
- namelessmc namelessNamelessMC: Reactions on private or blocking profile posts can be read and modified without proper authorization6.9 Medium
- namelessmc namelessNamelessMC: Forum reactions bypass the "view own topics only" restriction5.3 Medium
- elementor website builderWordPress Elementor Website Builder plugin <= 4.1.0 - Broken Access Control vulnerability5.4 Medium
- crew hrm hrm, sekander badsha crew hrm +1 moreWordPress Crew HRM plugin <= 1.2.2 - Broken Access Control vulnerability5.4 Medium
- etoile web design incorporated five star restaurant reservationsWordPress Five Star Restaurant Reservations plugin <= 2.7.14 - Payment Bypass vulnerability7.5 High
- eventprimeWordPress EventPrime plugin <= 4.3.2.0 - Broken Access Control vulnerability7.5 High
- thimpress thim coreWordPress Thim Core Plugin <= 2.3.3 - Broken Access Control Vulnerability4.3 Medium
- thimpress thim coreWordPress Thim Core plugin <= 2.3.3 - Arbitrary plugin Installation vulnerability8.8 High
- anton shevchuk constructorWordPress Constructor theme <= 1.6.5 - Broken Access Control Vulnerability5.3 Medium
- printeers print & shipWordPress Printeers Print & Ship plugin <= 1.17.0 - Broken Access Control vulnerability6.5 Medium
- ntbyk jtl-connector for woocommerceJTL-Connector for WooCommerce <= 2.4.1 - Missing Authorization to Authenticated (Subscriber+) Settings Modification via Multiple Functions4.3 Medium
- revolution slider slider revolutionSlider Revolution 6.0.0-6.7.55 and 7.0.0-7.0.14 - Missing Authorization to Authenticated (Contributor+) Arbitrary Plugin Deactivation4.3 Medium
- kiteworks security-advisories, nextcloud server +1 moreNextcloud: Hidden Public Link creation when sharing to a Team External Member6.4 Medium
- kiteworks security-advisoriesNextcloud: Missing permission check for from submissions6.5 Medium
- Show moreLoading…