CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- rometheme rtmkitRTMKit Addons for Elementor < 2.0.9 - Author+ Site-Wide Theme Builder Template Creation and Activation2.7 Low
- catch themes demo import themes demo import, catchplugins catch themes demo import +1 moreCatch Themes Demo Import <= 3.3 - Missing Authorization to Authenticated (Subscriber+) Single Plugin Installation via 'activate_plugin' Parameter4.3 Medium
- fernandobt list category postsList category posts <= 0.95.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'post_status' Shortcode Attribute4.3 Medium
- cyrusimap cyrus imapAn issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to...4.3 Medium
- wekanWekan: `cloneBoard` Meteor method has no authorization check — any user can clone (read) any private board by ID6.5 Medium
- wekanWekan: Missing authorization on OIDC Meteor methods allows privilege escalation to admin7.6 High
- wekanWekan: Authorization bypass in copyBoard DDP method allows any user to copy private boards7.1 High
- wekanWekan: Read-only board members can create/modify/delete Custom Fields (privilege escalation via read-level authz on write ops)6.5 Medium
- lfprojects mcp python sdk, modelcontextprotocol python-sdk +1 moreMCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks7.6 High
- drupal coreDrupal core - Moderately critical - Information disclosure - SA-CORE-2026-0104.2 Medium
- ciliumCilium: Namespaced HTTPRoutes can redirect traffic to other namespaces5.9 Medium
- taosdata tdengineTDengine: KILL SSMIGRATE missing authorization lets low-privilege users interrupt shared-storage migrations5.4 Medium
- specterops bloodhoundBloodHound Missing Authorization on Custom Node Management API7.1 High
mantisbt/mantisbtPackagistMantisBT: REST API unauthorized Issue status change5.3 Medium- icu scandinavia boomerangMissing Authorization in ICU Scandinavia Boomerang5.3 Medium
- mervinpraison praisonaiPraisonAI Platform before 0.1.9 Authorization Bypass via Label Endpoints7.1 High
- mervinpraison praisonaiPraisonAI before 4.6.78 Authentication Bypass via HTTP-stream6.9 Medium
- red hat openshift gitopsGitops-operator: gitops-operator: missing allowednamespace check in reconcilerhook for clusterrole/role cases enables potential privilege escalation and dos7.7 High
- zhinianboke xianyu-auto-replyzhinianboke xianyu-auto-reply Backend User Endpoint users authorization6.9 Medium
- woodpecker-ci woodpeckerWoodpecker: Privilege escalation via unrestricted serviceAccountName in the Kubernetes backend9.0 Critical
- forgekeep nebula-meshNebula-mesh allows non-admin operators to disable webhook SSRF protection via `allow_private`7.7 High
- julien040 anyqueryAnyquery: Local File Read (LFR) via Unrestricted SQLite Virtual Table Modules in Server Mode7.5 High
- julien040 anyqueryAnyquery: Server-Side Request Forgery (SSRF) via Unrestricted SQLite Virtual Table Modules in Server Mode8.6 High
- czlonkowski n8n-mcpn8n-MCP: Cross-tenant access to workflow version backups in multi-tenant HTTP deployments9.9 Critical
- julien040 anyqueryAnyquery: Arbitrary File Write (AFW) which could lead to Remote Code Execution (RCE) via Unrestricted ATTACH DATABASE in Server Mode9.1 Critical
- microsoft sharepoint enterprise server 2016, sharepoint server 2019, sharepoint server subscription edition +1 more +3 moreMicrosoft SharePoint Elevation of Privilege Vulnerability8.8 High
- microsoft azure cyclecloud, azure cyclecloud 8.9.1 +1 moreAzure CycleCloud Elevation of Privilege Vulnerability6.5 Medium
- sonatype nexus repository 3, nexus repository manager +1 moreNexus Repository 3 - Authorization Bypass in Component Upload API8.2 High
- hieventsdev hi.eventsHi.Events < 1.11.0 XSS via Event Title JSON.stringify Injection5.1 Medium
- hieventsdev hi.eventsHi.Events < 1.11.0 Hidden Ticket Enumeration via Order Creation Endpoint6.9 Medium
- alextselegidis easyappointmentsEasy!Appointments appointments/store and appointments/update allow cross-provider appointment injection — Authorization Bypass3.3 Low
- unknown wp 2faWP 2FA < 3.1.1.2 - Account Takeover via 2FA Setup Email Binding6.4 Medium
- themelooks foodbook lite – online food ordering systemFoodBook Lite <= 1.5.6 - Missing Authorization to Unauthenticated User Registration via 'registration_action' AJAX Action5.3 Medium
- kimaiKimai: ExportTemplate CRUD Missing Authorization Check Allows Unauthorized TEAMLEAD Access5.3 Medium
- sap se s/4hana (draft operation)Missing Authorization check in SAP S/4HANA (Draft operation)4.3 Medium
- sap se s/4 hana (create single payment)Missing Authorization check in SAP S/4 HANA (Create Single Payment)4.3 Medium
- kimaiKimai: Improper Authorization in Kimai Team Member and Team Activity Assignment APIs Allows Expansion of Team Scope Beyond Authorized Visibility5.3 Medium
- kimaiKimai: Improper Authorization in Kimai Timesheet Restart and Duplicate Allows New Timesheets After Project Access Revocation5.3 Medium
- kimaiKimai: Improper Authorization in Kimai Activity Creation with Preset Project Allows Creation Under Unauthorized Projects5.3 Medium
- openclawOpenClaw 2026.5.20 < 2026.6.9 Privilege Escalation via Plugin Install8.7 High
- openclawOpenClaw 2026.6.6 < 2026.6.9 Authorization Bypass via Message Mutations7.1 High
- openclawOpenClaw < 2026.6.8 Authorization Bypass via HTTP Model Override7.2 High
- churchcrm crmChurchCRM: Improper object-level authorization allows low-privileged users to read and modify other families’ records7.1 High
- churchcrm crmChurchCRM : Broken Access Control in `CSVCreateFile.php` Allows Low-Privileged Users to Export All Members' PII6.5 Medium
- decidimDecidim: CSV census record endpoints improper authorization6.0 Medium
- decidimDecidim: Verification admins can access supplied IDs from other organisations4.9 Medium
- decidimDecidim: Forms admin question editor lacks authorization5.4 Medium
- apolloconfig apolloApollo: Apollo Portal release endpoint allows cross-application configuration disclosure via releaseId6.5 Medium
- mattermost, mattermost server +1 moreMattermost schemes teams endpoint exposes private team invite IDs3.8 Low
- mattermost, mattermost server +1 moreRemote cluster metadata enumeration via /share-channel autocomplete4.3 Medium
- Show moreLoading…