CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- expresstech quiz and survey master (qsm) – easy quiz and survey makerQuiz and Survey Master (QSM) <= 11.1.4 - Missing Authorization to Authenticated (Contributor+) Arbitrary Quiz Modification and Email Reroute via Leaked Nonce from /quiz/structure4.3 Medium
- saturdaydrive ninja forms - file uploadsNinja Forms - File Uploads <= 3.3.29 - Missing Authorization to Unauthenticated Log Disclosure and Deletion via debug-log/delete-all and debug-log/get-all REST Endpoints5.3 Medium
- wedevs wedocs: ai powered knowledge base, docs, documentation, wiki & ai chatbotweDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Data Migration via wedocs_migrate_betterdocs_to_wedocs AJAX Ac…4.3 Medium
- kiwitcms kiwiKiwi TCMS: The /init-db/ page renders and responds to requests after first use0.0 None
- kimaiKimai before 2.57.0 Improper Authorization via Favorite Endpoints8.7 High
- decolua 9router9Router < 0.4.44 - OS Command Injection via sudoPassword Parameter in Tailscale Install Endpoint9.2 Critical
- taiga taiga-backTaiga < 6.10.2 - Unauthorized Due-Date Creation via API Viewsets6.9 Medium
@grackle-ai/authnpm,@grackle-ai/mcpnpm,@grackle-ai/plugin-corenpm +2 moreGrackle: Fail-open authorization in the MCP tool layer lets scoped agents perform cross-task and cross-session mutations (IDOR)8.7 High- craftcms cmsCraft CMS: Unauthorized Deletion of Destination Folders During Forced Moves4.9 Medium
- sendcloud shippingWordPress Sendcloud Shipping plugin <= 1.0.29 - Broken Access Control vulnerability5.3 Medium
- keksdieb ez form calculator premiumWordPress ez Form Calculator Premium plugin <= 2.14.1.2 - Broken Access Control vulnerability5.3 Medium
- themerex bookedWordPress Booked plugin <= 3.0.0 - Broken Access Control vulnerability7.1 High
- ux-themes flatsomeWordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability6.5 Medium
- ux-themes flatsomeWordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability4.3 Medium
- fuelthemes werkstattWordPress Werkstatt theme <= 4.7.2 - Broken Access Control vulnerability4.3 Medium
- gurmehub pos entegratörWordPress POS Entegratör plugin <= 3.7.103 - Broken Access Control vulnerability8.2 High
- drfuri martfury - woocommerce marketplace wordpress themeWordPress Martfury - WooCommerce Marketplace WordPress theme theme <= 3.2.8 - Broken Access Control vulnerability4.3 Medium
- vsourz digital advanced contact form 7 dbWordPress Advanced Contact form 7 DB plugin <= 2.0.9 - Broken Access Control vulnerability6.5 Medium
- radiustheme classified listingWordPress Classified Listing plugin <= 5.4.2 - Broken Access Control vulnerability6.5 Medium
- linkwhisper link whisper premiumWordPress Link Whisper Premium plugin <= 2.9.0 - Broken Access Control vulnerability6.5 Medium
- coderpress nowpayments for woocommerceWordPress NOWPayments for WooCommerce plugin <= 1.4.0 - Broken Access Control vulnerability7.5 High
- stylemixthemes motorsWordPress Motors theme < 5.6.85 - Broken Access Control vulnerability6.5 Medium
- merkulove openai chatbot for wordpress – helperWordPress OpenAI Chatbot for WordPress – Helper plugin <= 1.1.4 - Arbitrary Content Deletion vulnerability7.5 High
- dylan ngo woostify sites libraryWordPress Woostify Sites Library plugin <= 1.6.2 - Broken Access Control vulnerability5.3 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.11 - Missing Authorization to Unauthenticated Arbitrary Email Content Injection (Mail Relay / Phishing) via 'emailBody' and 'emailSubject' Parameters5.3 Medium
- beardev joomsport – for sports: team & league, football, hockey & moreJoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Creation/Modification via season_groupedit AJAX action4.3 Medium
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via kirki_post_apis_nopriv AJAX Action5.3 Medium
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter5.3 Medium
- icegram email subscribers & newsletters by icegram express – email marketing, post notifications & woocommerce marekting automation for wordpressEmail Subscribers & Newsletters <= 5.9.27 - Missing Authorization to Authenticated (Contributor+) Settings Modification via ig_es_handle_request AJAX Action4.3 Medium
- envothemes envo's templates & widgets for elementor and woocommerceEnvo's Templates & Widgets for Elementor and WooCommerce <= 1.4.26 - Missing Authorization to Authenticated (Author+) Private Content Disclosure via Envo Tabs Widget 'templates' Setting4.3 Medium
- craftcms cmsCraft CMS: Missing peer-permission check in `AssetsController::actionDeleteFolder` allows deletion of other users' assets7.1 High
- craftcms cmsCraft CMS: Unauthorized Deletion of Source Assets During File Replacement5.3 Medium
- surrealdbSurrealDB before 3.1.0 Authentication Bypass via USE statement6.9 Medium
- surrealdbSurrealDB before 3.1.0 Authorization Bypass via KILL Statement5.3 Medium
- imagemagickImageMagick: Policy Bypass in concatenate operation due to missing checks5.5 Medium
- geonetwork core-geonetworkGeoNetwork: ACL bypass on Elasticsearch search when request body omits query field7.5 High
- drupal flowdropFlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-0685.4 Medium
- drupal flowdropFlowDrop - Moderately critical - Access bypass - SA-CONTRIB-2026-0675.4 Medium
- unknown applyonlineWordPress ApplyOnline plugin <= 2.6.7.6 - Broken Access Control vulnerability5.3 Medium
- codexpert inc thumbpressWordPress ThumbPress plugin <= 6.3.2 - Broken Access Control vulnerability4.3 Medium
- webba appointment booking bookingWordPress Webba Booking plugin <= 6.4.13 - Broken Access Control vulnerability5.3 Medium
- feast feature server, red hat openshift ai (rhoai) +1 moreFeast: unauthenticated arbitrary file write9.1 Critical
- wofficeio wofficeWordPress Woffice theme < 5.4.33 - Broken Access Control vulnerability5.3 Medium
- stylemix motors – car dealership & classified listings pluginMotors <= 1.4.111 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'stm_mark_as_sold_car' Parameter4.3 Medium
- kstover ninja forms – the contact form builder that grows with youNinja Forms <= 3.14.1 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via token/refresh REST Endpoint7.5 High
- codepeople appointment booking calendarAppointment Booking Calendar <= 1.4.02 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Disclosure4.3 Medium
- stellarwp kadence blocks — page builder toolkit for gutenberg editorKadence Blocks <= 3.7.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Attachment Creation via kadence_import_process_pattern/kadence_import_process_data AJAX Actions4.3 Medium
- themeisle visualizer – tables & charts manager with built-in ai generatorVisualizer <= 4.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via /visualizer/v1/action/{chart}/{type}/ REST Endpoint7.5 High
- beardev joomsport – for sports: team & league, football, hockey & moreJoomSport <= 5.7.8 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Group Deletion via season_groupdel AJAX action4.3 Medium
- google chromeInsufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47...6.5 Medium
- Show moreLoading…