CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- chainlitChainlit < 2.10.1 Session Hijacking via WebSocket Session Restoration8.8 High
- mattermost, mattermost server +1 moreGitLab Plugin Allows Non-Admin Users to Modify Default Instance Configuration5.4 Medium
- mispBroken access control in MISP core allows cross-organization unauthorized modification or deletion of analyst data, event reports, collections, templates, and decaying models7.1 High
- mispMISP Core: Broken access control allows instance-wide unauthorized deletion of event reports and sharing groups via bulk deletion endpoints9.4 Critical
- apache nifiApache NiFi: Missing Authorization of Restricted Permissions when Replacing Flow Contents7.5 High
- stylemixthemes motorsMotors Car Dealership & Classified Listings < 1.4.110 - Unauthenticated Post-Meta Write via stm_ajax_add_a_car_media5.3 Medium
- phpmyfaqphpMyFAQ - Privilege Escalation via Missing Authorization in editUser() and updateUserRights()8.7 High
- craftcms cmsCraft CMS - Missing Authorization in assets/preview-thumb Endpoint5.3 Medium
- eemitch simple file listSimple File List <= 6.3.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary File Operations (Deletion / Move / Folder Creation / Download) via 'frontmanage' Shortcode Attribute6.5 Medium
- eemitch simple file listSimple File List <= 6.3.7 - Missing Authorization to Unauthenticated File Modification via simplefilelist_edit_job AJAX Action7.5 High
- cap-go capgoCapgo - Unauthenticated Cross-Tenant Metrics Poisoning via upsert_version_meta RPC6.9 Medium
- jovancoding network-aiNetwork-AI: ApprovalInbox HTTP server has no authentication — anyone can approve pending agent actions5.9 Medium
- microsoft exchange online, microsoft exchange online +1 moreMicrosoft Exchange Online Elevation of Privilege Vulnerability9.6 Critical
- wpgmaps wp go maps – google map, openstreetmap, leaflet mapWP Go Maps <= 10.1.01 - Unauthenticated Arbitrary Record Creation5.3 Medium
- statamic cmsStatamic CMS missing authorization on Control Panel fieldtype endpoints allows disclosure of restricted resources4.3 Medium
- doobidoo mcp-memory-servicemcp-memory-service: OAuth read-only clients can write and delete memories through MCP tools/call8.1 High
- alchemycms alchemy cmsAlchemy: Unauthenticated nested page API leaks restricted & unpublished content7.5 High
- riganti dotvvmDotVVM: Missing authorization in AuthorizeActionFilter9.2 Critical
- nl-portal nl-portal-backend-librariesNL Portal Backend Libraries: Unauthenticated form resolver forwards the privileged Objecten-API token to a caller-supplied URL (SSRF)5.3 Medium
- dtwang line-desktop-mcpStreamable HTTP mode exposes LINE Desktop read/send tools without MCP authentication8.8 High
- 2download connector for 2dl hosted checkout2Download Connector for 2DL Hosted Checkout <= 0.1.5 - Missing Authorization to Unauthenticated Sensitive Customer Subscription Data Exposure via 'ToDownload_email' Parameter5.3 Medium
- strablengineering strabl – a checkout solutionSTRABL <= 4.5 - Unauthenticated Arbitrary Webhook Creation via REST API Endpoint5.3 Medium
- legalweb wp dsgvo tools (gdpr)WP DSGVO Tools (GDPR) <= 3.1.39 - Missing Authorization to Unauthenticated Sensitive Personal Data Disclosure via subject-access-request AJAX Endpoint (process_now/is_ajax Parameters)5.3 Medium
- rocklobsterinc bogoBogo <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via REST API4.3 Medium
- techlabpro1 classified listing – ai-powered classified ads & business directoryClassified Listing <= 5.4.2 - Missing Authorization to Authenticated (Subscriber+) Feature Modification via Multiple AJAX Handlers ('listingId'/'id' Parameters)4.3 Medium
- apollo pharmacy blood glucose monitoring system (model no. apg-01 bt)Apollo Pharmacy Blood Glucose Monitoring System APG-01 BT Missing Authorization7.1 High
- thorsten phpmyfaqphpMyFAQ: Missing userHasPermission() in 4 API write endpoints (CVE-2026-24421 Incomplete Fix)6.5 Medium
- agenticmail @agenticmail/apiAgenticMail: Cross-agent task authorization bypass in AgenticMail API7.1 High
- pipecatPipecat: Telephony WebSocket `/ws` Unauthenticated Call-Control Abuse via Attacker-Supplied Call SID7.5 High
- getkirby kirbyKirby: `pages.access` permission is not checked in the `site/find` REST API route7.1 High
- getkirby kirbyKirby: Access to files of top-level drafts is not protected by permissions6.3 Medium
- getkirby kirbyKirby: `pages.access` permission is not checked in the pages picker for parent pages5.3 Medium
- mervinpraison praisonaiPraisonAI AgentLoop onToolCall approval runs after tool execution8.8 High
- mervinpraison praisonaiPraisonAI MCPServer exposes unauthenticated HTTP tools/call9.8 Critical
- mervinpraison praisonaiPraisonAI: AgentOS remains unauthenticated after GHSA-pm96 patched version and allows remote agent invocation9.8 Critical
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI AgentTeam.launch exposes unauthenticated remote agent listing and invocation endpoints9.8 Critical
- mervinpraison praisonaipraisonai: Jobs API exposes agent-execution endpoints with no authentication9.8 Critical
- mervinpraison praisonaiPraisonAI Slack app_mention bypasses configured user/channel authorization8.3 High
- mervinpraison praisonaiPraisonAI recipe serve Typer command bypasses the non-localhost authentication guard8.2 High
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI ToolsMCPServer legacy SSE transport accepts attacker Host/Origin and exposes registered tools8.3 High
- google mcp toolbox for databases, mcp toolbox for databases (googleapis/mcp-toolbox) +1 moreMCP Toolbox for Databases: authenticated authorization bypass8.6 High
- google androidIn AndroidManifest.xml, there is a possible persistent denial of service due to a missing...10.0 Critical
- wpinsider-1 simple membershipSimple Membership <= 4.7.5 - Missing Authorization to Unauthenticated Arbitrary Member Account Deactivation via Forged Stripe 'charge.refunded' Webhook5.3 Medium
- eventkoi event koi lite – events calendar, event management, rsvp, and ticketsEvent Koi Lite <= 1.3.13.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via REST API Endpoints5.3 Medium
- equalizedigital equalize digital accessibility checker – wcag, ada, eaa and section 508 complianceEqualize Digital Accessibility Checker <= 1.42.1 - Missing Authorization to Authenticated (Author+) Arbitrary Accessibility Issue Modification via 'largeBatch' Parameter4.3 Medium
- oleksandrz e2pdf – export pdf tool for wordpressE2Pdf <= 1.32.26 - Missing Authorization to Authenticated (Custom+) Arbitrary Option Update / Privilege Escalation via 'screen_action' Parameter8.8 High
- avo-hq avoAvo: Missing Authorization in Avo Association Attach Endpoint Allows Unauthorized Relationship Manipulation and Privilege Escalation9.6 Critical
- openwebui open webui, open-webui +1 moreOpen WebUI: RAG ACL Bypass in Milvus Multitenancy Mode6.5 Medium
- red hat hardened images, satellite 6, satellite 6.16 for rhel 8 +4 more +6 moreKatello: missing repository authorization in content_uploads exposes cross-product content existence4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Open WebUI BOLA: `search_knowledge_files` Allows Unauthorized Knowledge Base File Enumeration4.3 Medium
- Show moreLoading…