CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- yunaiv yudao-cloudyudao-cloud < 2026.06 - BPM Module Broken Access Control via process-instance API7.1 High
- github enterprise serverMissing authorization vulnerability in GitHub Enterprise Server allowed disclosure of private repository contents via the Copilot pull request diff summary endpoint6.0 Medium
- jeecgbootJeecgBoot 3.9.2 - Missing Authorization on OpenAPI Credential Management Endpoints Exposes Access/Secret Keys8.6 High
- cvat-ai cvat, cvat computer vision annotation tool +1 moreCVAT < 2.69.0 - Missing Authorization on Quality Reports parent_id Filter Leaks Cross-Organization Report Existence5.3 Medium
- dromara ruoyi-vue-plusRuoYi-Vue-Plus - Missing Authorization on Workflow Task Management Endpoints7.1 High
- hkuds deeptutorDeepTutor < 1.4.10 - Insecure Default Grants Unrestricted MCP Tool Access to Non-Admin Users7.7 High
- ccfos nightingaleNightingale < 9.0.0-beta.2 - Datasource Credential Disclosure to Low-Privilege Users7.1 High
- openziti zitiOpenZiti - Privilege Escalation to Admin via Unauthorized Enrollment Creation8.7 High
- apache activemq, activemq broker, apache software foundation activemq all +2 moreApache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ: Temporary destination ownership takeover7.5 High
- octagonwebstudio premium addons for kingcomposerPremium Addons for KingComposer <= 1.1.1 - Missing Authorization to Unauthenticated Arbitrary Custom Sidebar Creation and Deletion via 'add_custom_sidebar' and 'remove_custom_sidebar' AJAX actions5.3 Medium
- coollabsio coolifyCoolify Cross-Team IDOR: Livewire Components Accept Unscoped server_id and destination_uuid — Deploy to Other Teams' Servers9.6 Critical
- yahoo elideElide 7.1.17 - Permission Bypass in Sort Expression Validation5.3 Medium
- its-a-feature mythicMythic < 3.4.0.60 - Unauthorized C2 Profile Configuration Access via Unverified Payload UUID6.0 Medium
- yunai ruoyi-vue-proruoyi-vue-pro - Missing Authorization in CRM Follow-up Record GET Endpoint7.1 High
- iv-org invidiousInvidious - Private Playlist Disclosure via Unauthenticated RSS Feed Endpoint6.3 Medium
- shohei.tanaka japanized for woocommerceWordPress Japanized For WooCommerce plugin <= 2.9.12 - Broken Access Control vulnerability6.5 Medium
- strategy11 team business directoryWordPress Business Directory plugin <= 6.4.23 - Broken Access Control vulnerability6.6 Medium
- ads by wpquads by wpquadsWordPress Ads by WPQuads plugin <= 3.0.3 - Broken Access Control vulnerability6.5 Medium
- wedevs wp user frontendWordPress WP User Frontend plugin <= 4.3.7 - Broken Access Control vulnerability6.5 Medium
- wp swings wallet system for woocommerceWordPress Wallet System for WooCommerce plugin <= 2.7.6 - Broken Access Control vulnerability7.1 High
- mainwpWordPress MainWP plugin <= 6.1.1 - Broken Access Control vulnerability6.3 Medium
- hitachi virtual storage platform 5100, 5500, 5100h, 5500h, 5200, 5600, 5200h, 5600h, virtual storage platform e390, e590, e790, e990, e1090, e390h, e590h, e790h, e1090h, virtual storage platform g130, g150, g350, g370, g700, g900, f350, f370, f700, f900 +2 moreImproper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform8.3 High
- codeastro human resource management systemCodeAstro Human Resource Management System cross-site request forgery5.3 Medium
- lfprojects mlflowMLflow Experiment-scoped Label Schema CRUD API authorization2.3 Low
- frisbii pay, reepaydenmark frisbii pay +1 moreFrisbii Pay <= 1.8.9 - Missing Authorization to Authenticated (Subscriber+) Payment Token Modification6.5 Medium
- themeisle stripe payment forms by wp full pay – accept credit card payments, donations & subscriptionsStripe Payment Forms by WP Full Pay <= 8.4.3 - Missing Authorization to Unauthenticated Payment Record Manipulation via 'paymentIntentId' Parameter5.3 Medium
- expresstech quiz and survey master (qsm) – easy quiz and survey makerQuiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via qsm_insert_quiz_template AJAX Action4.3 Medium
- templatescoderthemes spexoSpexo <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Limited Plugin Activation4.3 Medium
- masteriyo lms – lms course builder, quizzes & certificatesMasteriyo LMS <= 2.2.1 - Missing Authorization to Authenticated (Student+) Arbitrary Course Announcement Modification4.3 Medium
- amin a.rezapour product specifications for woocommerceProduct Specifications for Woocommerce <= 0.8.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attribute/Group Creation, Modification, and Deletion via 'dwps_modify_groups' and 'dwps…4.3 Medium
- webaways nex-forms – ultimate forms plugin for wordpressNEX-Forms <= 9.2.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via CSVExport Class5.3 Medium
- nezhahq nezhaNezha Monitoring: Cross-tenant terminal/file-manager session hijack via WebSocket stream UUID without ownership check9.9 Critical
solidinvoice/solidinvoicePackagistSolidInvoice: IDOR in LiveComponent allows same-company cross-user access to API tokens and notification transport settings8.9 High- juev nebula-meshNebula Mesh: Web UI lacks ownership checks, enabling cross-operator access to hosts and networks (read, block, delete)8.8 High
@cardano402/mcp-servernpm@cardano402/mcp-server missing spending limits, LAN-exposed HTTP transport, and SSRF via catalog.server.url0.0 None- rustfsRustFS: ListRemoteTargetHandler authorization bypass leaks replication target credentials8.2 High
- rustfsRustFS Snowball Auto-Extract: Path Traversal allows cross-bucket object injection8.6 High
- rustfsRustFS: FTP frontend skips IAM authorization on object reads7.7 High
- rustfsRustFS: Missing admin authorization on /rustfs/admin/v3/metrics allows any authenticated user to read server metrics4.3 Medium
- opf openprojectOpenProject: Improper Access Control on OpenProject through the POST request to /projects/[PROJECT_NAME]/cost_reports/[REPORT_ID]/rename6.5 Medium
- opf openprojectOpenProject: Journal diff endpoint bypasses object, journal, and field visibility checks7.5 High
- lxc incusIncus has a restricted project bypass leading to arbitrary command execution9.9 Critical
- pagekitPagekit CMS 1.0.18 Privilege Escalation via UserApiController8.7 High
- canonical lxdBroken Access Control in Canonical LXD DevLXD API8.4 High
- nexcess wpcompleteWordPress WPComplete plugin <= 2.9.5.5 - Broken Access Control vulnerability5.4 Medium
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.7.1 - Broken Access Control vulnerability5.3 Medium
- mra13 affiliates managerWordPress Affiliates Manager plugin <= 2.9.49 - Broken Access Control vulnerability6.5 Medium
- studiowombat shoppable images liteWordPress Shoppable Images Lite plugin <= 1.3 - Broken Access Control vulnerability4.3 Medium
- nelio software contentWordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerability4.3 Medium
- tribulant software newslettersWordPress Newsletters plugin <= 4.13 - Broken Access Control vulnerability8.1 High
- Show moreLoading…