CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- cyberlord92 miniorange otp login, verification and sms notificationsminiOrange OTP Login, Verification and SMS Notifications <= 5.5.1 - Authentication Bypass to Administrator Account Takeover via 'username_b' Parameter9.8 Critical
- metagauss memberships and user profiles for woocommerce – profilegrid woocommerce integrationMemberships and User Profiles for WooCommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) ProfileGrid Plugin Installation and Activation4.3 Medium
- wedevs user frontend: ai powered frontend posting, user directory, profile builder, membership & user registrationUser Frontend <= 4.3.7 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'attach_id' Parameter5.3 Medium
- revmakx backup and staging by wp time capsuleBackup and Staging by WP Time Capsule <= 1.22.26 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via download_recent_decrypted_file_wptc Function6.5 Medium
- tokenoftrust age verification & identity verification by token of trustAge Verification & Identity Verification by Token of Trust <= 4.0.2 - Missing Authorization to Unauthenticated Information Exposure via 'tot_export_table' Parameter5.3 Medium
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabMissing Authorization in GitLab4.3 Medium
- antiwork gumroadGumroad < 2026.07.06.2 - Insecure Direct Object Reference in PurchasesController7.1 High
- hashicorp nomad, nomad enterprise +1 moreNomad Docker driver Linux host namespace bypass7.7 High
- affine monorepoAFFiNE - Unauthorized Document Edit History Access via GraphQL histories Field7.1 High
- cap-go capgoCapgo - Arbitrary R2 Object Deletion via Mutable r2_path in app_versions8.7 High
- mispMISP importModule missing authorization allows read-only users to modify events via misp_standard imports5.3 Medium
- flask-dashboard flask-monitoringdashboardflask-dashboard Flask-MonitoringDashboard cross-site request forgery5.3 Medium
- latepoint – calendar booking plugin for appointments and eventsLatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass7.5 High
- rabilal wp learn managerWP Learn Manager <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Plugin Installation and Activation via jslearnmanager_ajax AJAX Action9.8 Critical
- saadiqbal user managementUser Management <= 1.2 - Missing Authorization to Unauthenticated Plugin Settings Modification5.3 Medium
- No product listedIn CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0,...8.1 High
- No product listedImproper authorization in the /tequilapi/config/user endpoint of Mysterium Node before v1.36.0...9.8 Critical
- kiteKite has an authenticated cluster RBAC bypass in /api/v1/overview4.3 Medium
- capCap - Missing Access Control in Video AI Metadata Endpoint7.1 High
- better-auth scimbetter-auth SCIM 1.5.0 before 1.7.0-beta.4 Authorization Bypass8.7 High
- better-auth better auth, better-auth +1 moreBetter Auth: Unauthorized invitation acceptance via unverified email match in organization plugin7.7 High
- actualbudget actualActual: Shared users can perform owner-only file management actions7.2 High
- topoteretes cogneeCognee < 1.2.0 Unauthorized LLM Configuration Overwrite via /api/v1/settings9.3 Critical
- dataeaseDataEase: Unauthorized Access to Engine Database via previewSql Endpoint8.7 High
- chevere spa chevereto, chevereto chevereto/chevereto, rodber/chevereto-free +2 moreChevereto private profile setting leaks username on /json endpoint6.9 Medium
- ghostfolioGhostfolio - Unauthorized Portfolio Data Exposure via Public Endpoint8.7 High
- ghostfolioGhostfolio - Unauthorized Portfolio Holding Tag Modification via Missing Permission Check5.3 Medium
- havelsan liman mysAuthorization Bypass in HAVELSAN's Open Source Project Liman MYS8.3 High
- armiya information technologies ltd. co. access control system (gks)Improper Authorization in Armiya Technologies' Access Control System8.2 High
- coollabsio coolifyCoolify: Missing authorization on terminal websocket bootstrap routes allows low-privileged members to execute commands on team servers9.9 Critical
- fossbillingFOSSBilling vulnerable to unauthenticated API key configuration disclosure via guest Serviceapikey get_info endpoint6.9 Medium
- fossbillingFOSSBilling allows low-privileged staff accounts to perform unauthorized actions via admin API endpoints8.7 High
- fossbillingFOSSBilling missing authorization checks on read-only admin API endpoints expose sensitive staff, client, and redirect data2.3 Low
- decolua 9router9Router 0.4.41 - Unauthenticated Information Disclosure via API Usage Endpoints8.7 High
- decolua 9router9Router 0.4.41 - Unauthenticated API Key Exposure via /api/usage/stats9.3 Critical
- decolua 9router9Router 0.4.41 - Unauthenticated API Exposure via /api/providers9.3 Critical
- coderCoder: Devcontainer recreate endpoint missing write authorization allows read-only roles to destroy containers5.4 Medium
- coderCoder's sub-agent app registration bypasses template port-sharing policy enforcement5.4 Medium
- coollabsio coolifyCoolify Settings/Updates Livewire component missing instance administrator authorization6.5 Medium
- ciliumCilium: Sensitive information disclosure and cluster disruption via local Envoy admin socket access9.2 Critical
- openremoteOpenRemote read-only asset users can write predicted datapoints4.3 Medium
- imhamzaazam ecommerceflaskimhamzaazam ecommerceFlask cross-site request forgery5.3 Medium
- craft cmsCraft CMS Charts Endpoint ChartsController.php actionGetNewUsersData improper authorization5.3 Medium
- craft cmsCraft CMS reorder-sets Endpoint GlobalsController.php actionReorderSets authorization5.3 Medium
- tubitak bilgem software technologies research institute pardus updatePrivilege Escalation in TUBITAK BILGEM's Pardus Update7.8 High
- gitea open source git serverGitea Composer package source links use insufficient permission checks8.2 High
- gitea open source git serverGitea private organization labels are visible to unauthorized users7.5 High
- tubitak bilgem software technologies research institute pardus-softwareMissing Authorization in TUBITAK BILGEM's pardus-software8.8 High
- latepoint – calendar booking plugin for appointments and eventsLatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step5.3 Medium
- Show moreLoading…