CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- cartasi nexi xpay, nexi payments xpay +1 moreWordPress Nexi XPay plugin <= 8.3.1 - Broken Access Control vulnerability7.5 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Forged model meta.knowledge allows cross-user file read and deletion7.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Forged chat-file link allows cross-user file read and deletion8.3 High
- azuriom cmsBroken Access Control in Azuriom CMS Server Routes Allows Account Takeover8.6 High
- e-plugins jobbankWordPress JobBank plugin <= 1.2.3 - Broken Access Control vulnerability7.3 High
- rara themes metro magazineWordPress Metro Magazine theme <= 1.3.7 - Broken Access Control on Notice Dismissal vulnerability4.3 Medium
- ali2woo alinextWordPress AliExpress Dropshipping with AliNext Lite plugin <= 3.3.5 - Broken Access Control vulnerability6.5 Medium
- avirtum ipages flipbookWordPress iPages Flipbook plugin <= 1.5.1 - Broken Access Control vulnerability5.3 Medium
- prince integrate google driveWordPress Integrate Google Drive plugin <= 1.3.8 - Broken Access Control vulnerability8.3 High
- quanos solutions gmbh schema st4Missing authorization in Quanos SCHEMA ST4 Client Update Service allows arbitrary file overwrite as SYSTEM8.4 High
- shareaholicWordPress Shareaholic plugin <= 9.7.11 - Broken Access Control vulnerability4.3 Medium
- inisev social media & share iconsWordPress Social Media Share Buttons & Social Sharing Icons plugin <= 2.8.6 - Broken Access Control vulnerability4.3 Medium
- jegstudio startupzyWordPress Startupzy theme <= 1.1.1 - Broken Access Control vulnerability4.3 Medium
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications plugin <= 3.9.3 - Broken Authentication vulnerability7.5 High
- themegrill user registration stripeWordPress User Registration Stripe plugin <= 1.3.12 - Broken Access Control vulnerability8.2 High
- opmc woocommerce anti-fraudWordPress WooCommerce Anti-Fraud plugin <= 7.2.6 - Broken Access Control vulnerability6.5 Medium
- rain-task ltd. wpbakery page builder, wpbakery page builder +1 moreWordPress WPBakery Page Builder plugin <= 8.7.2 - Broken Access Control vulnerability6.5 Medium
- themegrill user registration stripeWordPress User Registration Stripe plugin <= 1.3.14 - Broken Access Control vulnerability8.2 High
- bricks builderWordPress Bricks Builder theme <= 2.1.4 - Broken Access Control vulnerability4.3 Medium
- boldgrid w3 total cacheWordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability4.7 Medium
- wpmet metform proWordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerability9.1 Critical
- wpmet metform proWordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerability4.3 Medium
- membership software wishlist member x, wishlist member x +1 moreWordPress WishList Member X plugin <= 3.29.0 - Broken Access Control vulnerability4.3 Medium
- premiumpress limited. wordpress dating themeWordPress WordPress Dating Theme theme <= 11.2.0 - Broken Access Control vulnerability8.6 High
- yoast bv seo premiumWordPress Yoast SEO Premium plugin <= 26.6 - Broken Access Control vulnerability5.5 Medium
- google androidIn MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive...10.0 Critical
- google androidIn Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions...10.0 Critical
- google androidIn NFC, there is a possible way to spoof an NFC event due to a missing permission check. This...10.0 Critical
- google androidIn SettingsLib, there is a possible missing permission check due to a logic error in the code....10.0 Critical
- google androidIn Package Manager, there is a possible device lock controller bypass due to a missing permission...10.0 Critical
- thimpress learnpressLearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API5.3 Medium
- google androidIn Contacts Provider, there is a possible way to access an incoming call's phone number and...3.3 Low
- google androidIn multiple locations, there is a possible 3rd party passkey entry pairing approval due to a...8.0 High
- google androidIn overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to...7.8 High
- gitea open source git serverGitea issue-template APIs bypass repository unit authorization4.3 Medium
- gitea open source git serverGitea user organization API bypasses public-only token filtering4.3 Medium
- mcp-tool-shop-org backpropagate, @mcptoolshop/backpropagate +1 moreBackpropagate: backprop ui --auth and backprop ui --share do not enforce authentication9.3 Critical
- gitroomhq postiz-appPostiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription4.8 Medium
- daytonaio daytonaDaytona: Cross-org IDOR in organization role update/delete — any org owner can rewrite or destroy another org's roles7.7 High
- eyecix jobsearchWordPress JobSearch plugin <= 3.2.7 - Broken Access Control vulnerability7.5 High
- mojoomla wpamsWordPress WPAMS plugin < 49.5.3 - Arbitrary Content Deletion vulnerability6.5 Medium
- jthemes genemyWordPress Genemy theme <= 1.6.6 - Broken Access Control vulnerability6.5 Medium
- utillz brikkWordPress Brikk theme <= 3.0.0 - Arbitrary Content Deletion vulnerability7.5 High
- devolutions serverImproper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user...6.5 Medium
- openclawOpenClaw < 2026.5.12 - Allowlist Bypass in Shell Inline-Command Parsing7.6 High
- openclawOpenClaw < 2026.5.12 - Slack Reaction Event Notification Bypass6.3 Medium
- openclawOpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus Command6.8 Medium
- openclawOpenClaw < 2026.4.29 - Session Visibility Check Bypass in Shared Memory Search6.0 Medium
- rockwell automation factorytalk analytics pavilionxRockwell Automation FactoryTalk Analytics PavilionX8.3 High
- moxa cn2600 series, nport 6000 series +1 moreImproper Authorization of Break Signal Commands in Devices6.9 Medium
- Show moreLoading…