CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- surflabtech surflink – link manager & backup restoreSurfLink < 2.6.0 - Missing Authorization to Authenticated (Subscriber+) 410 Gone URL Import via 'surfl_import_410' AJAX Action4.3 Medium
- rainafarai notification for telegramNotification for Telegram <= 3.5.1 - Missing Authorization to Authenticated (Subscriber+) Cron Modification via nftb_cron_action_set AJAX Action4.3 Medium
- wp swings points and rewards for woocommercePoints and Rewards for WooCommerce <= 2.10.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions4.3 Medium
- richardperdaan myparcelMyParcel <= 4.25.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Data Disclosure and Modification via wcmp_get_shipment_options and wcmp_save_shipment_options AJAX Ac…4.3 Medium
- elated-themes frappeFrappe: Auth. bypass via update_page7.1 High
- elated-themes frappeFrappe: Arbitrary Attachment Injection via add_attachments and upload_file5.3 Medium
- elated-themes frappeFrappe: Unrestricted API access to save_report5.3 Medium
- arraytics eventin – event calendar, event registration, tickets & booking (ai powered)Eventin 4.0.26 - 4.1.15 - Missing Authorization to Unauthenticated Payment Bypass via REST API5.3 Medium
- broadcom rabbitmq server, rabbitmq rabbitmq-server +1 moreRabbitMQ: Passive queue/exchange declaration bypasses authorization checks, leaking queue metadata to unprivileged users5.3 Medium
- rustdeskRustDesk Missing Session Scope Enforcement Allows Out-of-Scope Control Message Injection8.7 High
- grokability snipe-itSnipe-IT: Unauthorized Asset Request Cancellation via Unguarded cancel_by_admin Parameter5.3 Medium
- zitadelZITADEL: Unauthorized Token Privilege Escalation in OAuth2 Token Exchange8.1 High
- cifi geo plugin by squirrly seoSEO Plugin by Squirrly SEO <= 14.0.0 - Unauthenticated Arbitrary Post Creation and Stored Cross-Site Scripting via savePost()7.2 High
- decolua 9router9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass8.6 High
- jetbrains teamcityIn JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper...8.1 High
- mervinpraison praisonai-platformPraisonAI: Platform members can delete owner issue dependencies through member-owned related issues6.5 Medium
- mervinpraison praisonaiPraisonAI Platform before 0.1.9 Authorization Bypass via Dependencies7.1 High
- cap-go capgoCapgo - Information Disclosure via get_orgs_v7 RPC Endpoint8.7 High
- iqonicdesign kivicare – clinic & patient management system (ehr)KiviCare <= 4.4.0 - Missing Authorization to Unauthenticated Payment Bypass and Appointment Status Manipulation via /payment-success REST Endpoint5.3 Medium
- saskaita123 invoice123Invoice123 <= 1.7.0 - Missing Authorization to Authenticated (Subscriber+) Setting Modification via s123_submit_api_key & s123_submit_invoice_settings AJAX actions4.3 Medium
- carazo import and export users and customersImport and export users and customers <= 2.4.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via email_template_selected AJAX Action4.3 Medium
- easyappointments easy appointmentsEasy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Author+) Bulk Appointment Manipulation4.3 Medium
- wplegalpages cookie banner for gdpr / ccpa – wplp cookie consentCookie Banner for GDPR / CCPA <= 4.3.6 - Missing Authorization to Authenticated (Subscriber+) Scan Schedule Modification via gcc_save_schedule_scan AJAX Action4.3 Medium
- nandhiniwp gw ai website builderGW AI Website Builder <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Deletion4.3 Medium
- zhayujie cowagentzhayujie CowAgent Message Endpoint channel.py authorization5.3 Medium
- joeyoungblood wp business intelligence liteWP Business Intelligence Lite <= 3.2.0 - Authenticated (Subscriber+) Missing Authorization to Privilege Escalation via Arbitrary SQL Modification8.0 High
- themeatelier chathelp – click to chat button, woocommerce chat to order & floating chat formChat Help – Click to Chat Button & Form <= 3.1.3 - Missing Authorization to Unauthenticated Sensitive Information Exposure7.5 High
- arraytics wpcafe – restaurant menu, online food ordering & table booking systemWPCafe <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API5.4 Medium
- sipeed picoclawSipeed PicoClaw pico.go rt.ReloadConfig authorization5.3 Medium
- openstack ironicOpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project...5.5 Medium
- siyuan-note siyuanSiYuan: Publish-mode Reader can exfiltrate private saved-search Criteria via /api/storage/getCriteria (missing publish-access filter)6.5 Medium
- discourseDiscourse: Regular users can route multipart uploads into the admin backup store6.5 Medium
- juniper junos, juniper networks junos os +1 moreJunos OS: EX Series: Unauthorized users can execute service-impacting CLI command6.8 Medium
- yeswikiYesWiki: Unauthenticated arbitrary page deletion via `{{erasespamedcomments}}` action9.1 Critical
- avo-hq avoAvo: Direct attachment upload endpoint lacks upload authorization and bypasses field-level upload policy6.5 Medium
- forgekeep nebula-meshnebula-mesh - Host revocation is not durable: blocked/offboarded hosts can regain a valid certificate6.9 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Arena task endpoints can bypass underlying model access controls5.4 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Upload `metadata.knowledge_id` bypasses the knowledge-base write-access check (read-only users can add files to KB)4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Cross-user code-interpreter and tool execution via unvalidated Socket.IO event-caller session_id7.7 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Scheduled automations continue after pending-user deactivation and stored model ACL revocation3.1 Low
- openwebui open webui, open-webui +1 moreOpen WebUI: POST /api/v1/images/edit bypasses the global image-edit switch and the per-user image-generation permission4.3 Medium
- qt axivionPrivilege escalation via forged API token creation in Axivion Dashboard OIDC/OAuth2/SSO subsystem8.7 High
- matrixaddons easy invoice – invoice generator, pdf quotes & paymentsEasy Invoice <= 2.1.19 - Unauthenticated Arbitrary Quote Accept/Decline and Invoice Creation via easy_invoice_accept_quote / easy_invoice_decline_quote AJAX Actions5.3 Medium
- gamaup blocks for acf fields — display custom fields in the block editorBlocks for ACF Fields <= 1.6.2 - Missing Authorization to Authenticated (Author+) Arbitrary ACF Field Value Disclosure via 'id' Parameter6.5 Medium
- crewhrm employee, leave and recruitment management system – crew hrmEmployee, Leave and Recruitment Management System <= 1.2.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Job Deletion via crewhrm_singleJobAction AJAX Action4.3 Medium
- dhlparcel dhl ecommerce (benelux) for woocommerceDHL eCommerce (Benelux) for WooCommerce <= 2.2.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Shipping Label Creation and Deletion via dhlpwc_label_create and dhlpwc_label_delete A…4.3 Medium
- mlfactory dsgvo all in one for wpDSGVO All in one for WP <= 4.9 - Missing Authorization to Authenticated (Subscriber+) Settings Reset4.3 Medium
- corvusinfo corvuspay woocommerce payment gateway, corvuspay woocommerce payment gateway +1 moreCorvusPay WooCommerce Payment Gateway <= 2.7.4 - Missing Authorization to Unauthenticated Arbitrary Order Cancellation via 'order_number' Parameter5.3 Medium
- iscpcolissimo colissimo shipping methods for woocommerceColissimo Officiel : Méthodes de livraison pour WooCommerce <= 2.9.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Order Shipment Modification via lpc_order_affect AJAX action4.3 Medium
- danieliser popup maker – boost sales, conversions, optins, subscribers with the ultimate wp popup builderPopup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder <= 1.22.0 - Missing Authorization to Authenticated (Editor+) Arbitrary Plugin Installation7.2 High
- Show moreLoading…