CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- vitest-dev vitestVitest: Exposed Browser Mode API Can Proxy CDP and Overwrite Config Files, Leading to RCE9.8 Critical
- nodemailerNodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess5.3 Medium
- stylemixthemes masterstudy lms proWordPress MasterStudy LMS Pro plugin < 4.7.16 - Broken Access Control vulnerability6.5 Medium
- really simple plugins simple sslWordPress Really Simple SSL plugin <= 9.5.9 - Broken Access Control vulnerability6.5 Medium
- mia technology inc. pizzy libraryImproper Access Control in Mia Technologies' Pizzy Library7.1 High
- wertheim gmbh safecontroller software for vault rooms (safe deposit locker system)Missing authorization checks in Wertheim SafeController Software allow low-privileged users to access restricted functions8.6 High
- No product listedBludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST ...9.8 Critical
- openclawOpenClaw < 2026.5.6 - Config-Write Enforcement Bypass in Feishu Dynamic-Agent Bindings2.3 Low
- openclawOpenClaw < 2026.5.18 - Scope Elevation in trusted-proxy Control UI WebSocket8.7 High
- openclawOpenClaw < 2026.5.12 - Exec Denylist Bypass in Bundle MCP Loopback Session Spawn6.9 Medium
- discourseDiscourse: Chat misauthorization and information disclosure5.3 Medium
- kitty project kitty@kitty-edit DCS + --color=geninclude vulnerable to Unauthenticated in-process RCE7.8 High
- camaleon cms cms, owen2345 camaleon cms +1 moreCamaleon CMS 2.9.2 - Improper authorization in draft autosave endpoint5.1 Medium
- naxclow ix cam, smart doorbell x3, v720 +1 more +3 moreNaxclow IoT Platform Missing Authorization6.9 Medium
- naxclow ix cam, smart doorbell x3, v720 +1 more +3 moreNaxclow IoT Platform Missing Authorization8.7 High
- mattermost, mattermost server +1 more*Missing* {{invite_user}} *permission check on team creation allows unprivileged users to set open-invite and allowed-domains team settings*4.3 Medium
- aqara cloud production apiAqara API cross-account access9.6 Critical
- elated-themes frappeFrappe: Lack of permissions checks in 'relink' and 'set_email_password' endpoints6.9 Medium
- elated-themes frappeFrappe: Missing authorization on reset form tours5.3 Medium
- yarbo android/ios mobile application, cloud mqtt infrastructure +1 moreYarbo Android/iOS Mobile Application and Cloud Infrastructure Missing Authorization8.6 High
- duck-organization questbotQuest Bot: Discord moderation role hierarchy bypass in ban, kick, mute, unmute, warn, and nickname commands7.2 High
- openclawOpenClaw < 2026.4.24 - Owner-Only Tool Policy Bypass via MCP Loopback6.9 Medium
- openclawOpenClaw < 2026.5.18 - Exec Lifecycle Event Forgery via Paired Node8.6 High
- openclawOpenClaw < 2026.5.19 - Channel Allowlist Bypass in Message Read Actions7.1 High
- duck-organization quest-botQuest Bot: Unprivileged users can create and remove AutoMod rules.7.2 High
- sparkle wp metrostoreWordPress MetroStore theme <= 1.3.2 - Broken Access Control4.3 Medium
- themehunk contact form & lead form elementor builderWordPress Contact Form & Lead Form Elementor Builder plugin <= 1.8.4 - Broken Access Control vulnerability5.4 Medium
- berocket advanced ajax product filtersWordPress Advanced AJAX Product Filters plugin <= 1.6.3.3 - Broken Access Control + CSRF5.4 Medium
- google cloud dialogflow cxPrivilege Escalation in Dialogflow CX via Playbook Import9.4 Critical
- pencidesign soledadWordPress Soledad premium theme <= 8.2.5 - Broken Access Control vulnerability5.4 Medium
- palo alto networks cloud ngfw, pan-os, prisma access +1 more +3 morePAN-OS: Privilege Escalation (PE) Vulnerability in the Command Line Interface (CLI)6.0 Medium
- code16 sharpSharp: Missing Authorization Check in Quick Creation Command Endpoints4.3 Medium
- fissionFission: Cross-namespace event leakage via KubernetesWatchTrigger allows persistent tenant surveillance7.7 High
- fissionFission: Cross-namespace Environment reference in Package allows build-time command execution and SA token exfiltration7.7 High
- drupal examples for developersExamples for Developers - Moderately critical - Access bypass - SA-CONTRIB-2026-0443.3 Low
- makeplane planePlane: Cross-workspace asset authorization bypass lets any authenticated user read, copy, delete, and overwrite assets in other Plane workspaces8.3 High
- roxy-wiRoxy-WI: IDOR on PUT /smon/check — any user can rewrite any tenant's monitoring URL/IP/body9.1 Critical
- roxy-wiRoxy-WI: Authorization bypass on POST /smon/agent/action/<action> — guest can stop or restart smon-agent on any host8.5 High
- roxy-wiRoxy-WI: Cross-tenant authorization bypass on /install/* — guest can run Ansible / SSH on every registered server9.9 Critical
- jenkinsJenkins exposes other users' timezone and view names to users with Overall/Read permission4.3 Medium
- jenkinsJenkins: Missing permission check allows unauthorized cancellation of queue items4.3 Medium
- debian debusineDebusine is an integrated solution to build, distribute and maintain a Debian-based distribution....6.5 Medium
- qnap qumagieQuMagie6.6 Medium
- open-emr openemrOpenEMR: Stored XSS in prescription CSS/HTML print view via patient demographics7.7 High
- microsoft visual studio codeVisual Studio Code Elevation of Privilege Vulnerability9.6 Critical
- nesquena hermes-webuiHermes WebUI < 0.51.269 Profile Isolation Bypass via sessions search7.1 High
- mem0ai mem0Mem0 0.2.8 Missing Authorization via POST /configure Endpoint8.6 High
- typo3 cmsTYPO3 CMS - Privilege Escalation & SQL Injection in Form Framework8.7 High
- typo3 cmsTYPO3 CMS - Broken Access Control in Backend API5.3 Medium
- typo3 cmsTYPO3 CMS - Broken Access Control in Clipboard5.3 Medium
- Show moreLoading…