CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.7.30 - Broken Access Control vulnerability4.3 Medium
- omnisend email marketing for woocommerce by omnisendWordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.19.0 - Broken Access Control vulnerability5.4 Medium
- arraytics wpcafeWordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerability4.3 Medium
- seopress free proWordPress SEOPress PRO plugin <= 9.1.1 - Broken Access Control vulnerability4.3 Medium
- villatheme gift4uWordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability6.5 Medium
- bplugins flash & html5 videoWordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability5.8 Medium
- bplugins mailchimp blockWordPress MailChimp Block plugin <= 1.1.15 - Broken Access Control vulnerability8.3 High
- wp swings subscriptions for woocommerceWordPress Subscriptions for WooCommerce plugin <= 1.9.5 - Broken Access Control vulnerability7.5 High
- frisbii payWordPress Frisbii Pay plugin <= 1.8.2 - Privilege Escalation vulnerability8.8 High
- paymob for woocommerceWordPress Paymob for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability7.5 High
- design stylish cost calculatorWordPress Stylish Cost Calculator plugin <= 8.3.9 - Broken Access Control vulnerability7.5 High
- akosglys syncee premium dropshipping & wholesaleWordPress Syncee Premium Dropshipping & Wholesale plugin <= 1.0.27 - Broken Access Control vulnerability7.5 High
- tribulant software newslettersWordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability7.3 High
- syed balkhi intranet & private site – all-in-one intranetWordPress Intranet & Private Site – All-In-One Intranet plugin <= 1.8.1 - Broken Access Control vulnerability7.5 High
- five star plugins star restaurant menu, rustaurius five star restaurant menu +1 moreWordPress Five Star Restaurant Menu plugin <= 2.5.2 - Broken Access Control vulnerability7.5 High
- jegstudio gutenverse companionWordPress Gutenverse Companion plugin <= 2.5.0 - Broken Access Control vulnerability7.5 High
- themegrill user registrationWordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability6.5 Medium
- siteground email marketingWordPress SiteGround Email Marketing plugin <= 1.7.5 - Broken Access Control vulnerability5.3 Medium
- rhewlif donation thermometerWordPress Donation Thermometer plugin <= 2.2.7 - Broken Access Control vulnerability5.3 Medium
- bdthemes live copy paste for elementorWordPress Live Copy Paste for Elementor plugin <= 1.5.3 - Broken Access Control vulnerability4.3 Medium
- jetmonsters restaurant menu by motopressWordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerability4.3 Medium
- code amp forget about shortcode buttonsWordPress Forget About Shortcode Buttons plugin <= 2.1.3 - Broken Access Control vulnerability5.4 Medium
- teableio teableTeable - Missing Authorization in v2 REST API8.7 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries...4.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations...5.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible3.1 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private...4.3 Medium
- wpeverest user registration & membership – free & paid memberships, subscriptions, content restriction, user profile, custom user registration & login builderUser Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass6.5 Medium
- bitwarden serverBitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController5.3 Medium
- bitwarden serverBitwarden Server < 2026.5.0 Privilege Escalation via Bulk User Remove Endpoint7.1 High
- mattermost google drive, google drive plugin +1 moreImproper Access Control in Mattermost Google Drive Plugin File Creation Endpoint4.2 Medium
- haiwen seahubSeahub < 13.0.23 - Authentication Bypass in ShareLinkZipTaskView GET Method8.7 High
- getmaxun maxunMaxun < 0.0.42 - Cross-Tenant IDOR in Storage and Webhook API Handlers8.7 High
- danny-avila librechatLibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization6.5 Medium
- danny-avila librechatLibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter5.3 Medium
- getk2.com k2 extension for joomla, joomlaworks k2 +1 moreJoomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla < 2.266.5 Medium
- royal plugins mcpWordPress Royal MCP plugin <= 1.4.25 - Broken Access Control vulnerability8.1 High
- anh tran slim seoWordPress Slim SEO plugin <= 4.6.2 - Broken Access Control vulnerability6.5 Medium
- knit pay upi qr code payment gateway for woocommerceWordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.2 - Broken Access Control vulnerability5.4 Medium
- checkview automated testingWordPress CheckView Automated Testing plugin <= 2.1.0 - Broken Access Control vulnerability7.5 High
- etoile web design incorporated five star restaurant reservationsWordPress Five Star Restaurant Reservations plugin <= 2.7.19 - Broken Access Control vulnerability7.5 High
- stylemixthemes motorsWordPress Motors plugin <= 1.4.109 - Broken Access Control vulnerability7.5 High
- mainwp childWordPress MainWP Child plugin <= 6.1.1 - Broken Access Control vulnerability7.5 High
- elementor website builderWordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability6.5 Medium
- gitlabMissing Authorization in GitLab5.3 Medium
- gitlabMissing Authorization in GitLab3.1 Low
- rocket.chatRocket.Chat: Any Authenticated User Can Permanently Deregister Workspace from Rocket.Chat Cloud via Unprotected `/api/v1/fingerprint` Endpoint8.1 High
- rocket.chatRocket.Chat: Lack of SAML Signature Check During Logout Could Lead To DoS8.7 High
- fossbillingFOSSBilling: IDOR in Servicecustom Client API allows cross-client data access7.1 High
- drupal paragraphsParagraphs - Moderately critical - Access bypass - SA-CONTRIB-2026-0616.5 Medium
- Show moreLoading…