CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- drupal paragraphsParagraphs - Less critical - Access bypass - SA-CONTRIB-2026-0606.5 Medium
- drupal wisskiWissKI - Critical - Access bypass - SA-CONTRIB-2026-0596.5 Medium
- drupal ai agents, artificial intelligence project intelligence +1 moreAI Agents - Less critical - Access bypass - SA-CONTRIB-2026-0564.2 Medium
- artificial intelligence project intelligence, drupal ai (artificial intelligence) +1 moreAI (Artificial Intelligence) - Moderately critical - Access bypass - SA-CONTRIB-2026-0553.3 Low
- jenkins zowe zdevops, jenkins project zowe zdevops plugin +1 moreJenkins Zowe zDevOps Plugin has a missing permission check4.2 Medium
- jenkins assembla, jenkins project assembla plugin +1 moreJenkins Assembla Plugin has a missing permission check5.4 Medium
- jenkins mcp server, jenkins project mcp server plugin +1 moreJenkins MCP Server Plugin missing a permission check4.3 Medium
- jenkins contrast continuous application security, jenkins project contrast continuous application security plugin +1 moreJenkins Contrast Continuous Application Security Plugin missing permission checks4.3 Medium
- jenkins contrast continuous application security, jenkins project contrast continuous application security plugin +1 moreJenkins Contrast Continuous Application Security Plugin has a missing permission check4.3 Medium
- jenkins ec2 fleet, jenkins project ec2 fleet plugin +1 moreJenkins EC2 Fleet Plugin has a missing permission check5.4 Medium
- jenkins project gitee pluginJenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs4.3 Medium
- jenkins project gitee pluginJenkins Gitee Plugin missing permission checks5.4 Medium
- jenkins git parameter, jenkins project git parameter plugin +1 moreJenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names4.3 Medium
- jenkins github branch source, jenkins project github branch source plugin +1 moreJenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs4.3 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.11.4 - Authenticated (Contributor+) Account Takeover via Password Reset Link Disclosure8.8 High
- hancock11 wp forms connectorWP Forms Connector <= 1.8 - Missing Authorization to Unauthenticated Information Exposure via 'user/list' REST Endpoint7.5 High
- rentmy real-time rental management pluginRentMy Real-Time Rental Management Plugin <= 4.0.4.1 - Missing Authorization to Unauthenticated Settings Update via rentmy_cdn_request AJAX Action5.3 Medium
- krishaweb advance nav menu managerAdvance Nav Menu Manager <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm_save_menu_data AJAX Action4.3 Medium
- ajitdas devs accounting – simple accounting and invoicing solutionDevs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint5.3 Medium
- verenigingvanregistrars generate security.txtGenerate Security.txt <= 1.0.12 - Missing Authorization to Authenticated (Subscriber+) Security.txt Deletion via delete_securitytxt AJAX Action4.3 Medium
- ailchev searchplusSearchPlus <= 1.7.1 - Missing Authorization to Unauthenticated Settings Modification and Deletion via searchplus_save_token & searchplus_reset_token AJAX Actions5.3 Medium
- 24liveblog – live blog tool24liveblog <= 2.2 - Missing Authorization to Authenticated (Author+) Settings Modification via update_lb24_token AJAX action4.3 Medium
- berfect reviews and rating – docplannerReviews and Rating <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via sync_reviews AJAX Action4.3 Medium
- assistioai assistioAssistio <= 1.1.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Settings Deletion via assistio_plugin_delete_assistio_settings AJAX Action4.3 Medium
- secufor oauthSecufor_OAuth <= 1.0.7 - Missing Authorization to Unauthenticated Account Logout via 'secuforoauth_unregister_action' AJAX Action5.3 Medium
- newscred welcome software publishingWelcome Software Publishing <= 0.0.31 - Authenticated (Subscriber+) Arbitrary Options Update to Privilege Escalation via 'nc.setOption' XML-RPC Method8.8 High
- iamranit advanced contact form 7 – compact dbAdvanced Contact Form 7 <= 1.0.0 - Missing Authorization to Unauthenticated Arbitrary Contact Form Submission Deletion via 'form_id' Parameter5.3 Medium
- ajitdas devs accounting – simple accounting and invoicing solutionDevs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Parameter5.3 Medium
- grokability snipe-itSnipe-IT: Cross-Tenant Accessory Injection in Snipe-IT API8.5 High
- grokability snipe-itSnipe-IT's S3 signature image retrieval lacks authorization before temporary URL1.3 Low
- grokability snipe-itSnipe-IT: Privilege Escalation via Missing admin Permission Check in User Creation4.9 Medium
- grokability snipe-itSnipe-IT: 2FA reset privilege bypass5.8 Medium
- grokability snipe-itSnipe-IT: User Account Escalation via CSV Import6.5 Medium
- grokability snipe-itSnipe-IT's selectlist visibility is too permissive4.9 Medium
- red hat ansible automation platform 2, ansible automation platform 2.5, ansible automation platform 2.5 for rhel 8 +4 more +6 moreEda-server: websocket missing authorization allows credential theft via activation_id spoofing9.6 Critical
- motioneye-project motioneyemotionEye: Missing authentication on ActionHandler allows unauthenticated camera action execution5.3 Medium
- gogsGogs: LFS dedupe path leaks private repo content across tenants7.1 High
- bootimusBootimus 0.1.70 Broken Access Control via JWTMiddleware Authorization Bypass8.7 High
- hkuds openharnessOpenHarness - Prompt Injection via /issue and /pr_comments Slash Commands5.3 Medium
- hkuds openharnessOpenHarness - Cross-Session Disclosure via /resume and /summary Commands7.1 High
- nanocoai nanoclawNanoClaw < 2.1.17 - Privilege Escalation via Unverified Approval Response Handler7.1 High
- fossbillingFOSSBilling: Improper API Role Validation (system) Enables Unauthenticated Access to Privileged Admin Functions10.0 Critical
- redhat cluster logging operator, red hat logging subsystem for red hat openshift 6.5, redhat logging subsystem for red hat openshift +2 moreOpenshift/cluster-logging-operator: cluster logging operator creates and forwards serviceaccount tokens without verifying clf creator authorization6.8 Medium
- gogsGogs: Missing Authorization in Attachment Download7.5 High
- budibaseBudibase: POST /api/attachments/:datasourceId/url is unauthenticated and lets anonymous callers mint S3 PUT pre-signed URLs using stored datasource IAM credentials8.2 High
- filamentphp filamentFilament: Unauthenticated temporary file upload on auth pages6.5 Medium
- cap-go capgoCap-go - Privilege Inversion in Build Log Stream via SSE Disconnect7.1 High
- paymenterPaymenter: Broken object level authorization via service reference manipulation on ticket creation5.4 Medium
- wwbn avideoAVideo's Privilege AVideo: Escalation via Unguarded Permission Parameters in signUp API Allows Self-Granting Upload/Stream/Meet Permissions5.3 Medium
- google cloud cloud console uisCross-Project Information Leakage in Google App Engine UI6.9 Medium
- Show moreLoading…