CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- themeum kirkiKirki < 6.0.12 - Unauthenticated Arbitrary Comment Modification and Moderation Bypass via Component Library5.3 Medium
- unknown wp travel, wp travel travel +1 moreWP Travel < 11.7.1 - Unauthenticated Arbitrary Booking Cancellation5.3 Medium
- linux, linux kernel +1 morevfio/pci: Check BAR resources before exporting a DMABUF8.8 High
- linux, linux kernel +1 moreKVM: arm64: Correctly cap ZCR_EL2 provided by a guest hypervisor8.8 High
- linux, linux kernel +1 moreip6: vti: Use ip6_tnl.net in vti6_siocdevprivate().8.8 High
- linux, linux kernel +1 morexfrm: route MIGRATE notifications to caller's netns7.3 High
- linux, linux kernel +1 morentfs3: reject direct userspace writes to reserved $LX* xattrs7.1 High
- linux, linux kernel +1 morenet: ip_gre: require CAP_NET_ADMIN in the device netns for changelink8.8 High
- geex-arts django-jetgeex-arts django-jet OAuth cross-site request forgery5.3 Medium
- geex-arts django-jetgeex-arts django-jet OAuth Credential Revoke authorization6.9 Medium
- sipeed picoclawSipeed PicoClaw Group Message feishu_64.go handleMessageReceive authorization5.3 Medium
- nextlevelbuilder goclawnextlevelbuilder GoClaw Invoke Endpoint tools_invoke.go ToolsInvokeHandler.ServeHTTP authorization5.3 Medium
- sipeed picoclawSipeed PicoClaw auth.go cross-site request forgery5.3 Medium
verbb/formiePackagistFormie: Missing authorization in administrative settings allows low-privileged CP users to modify plugin configuration6.3 Medium- vimesoft inc. enterprise video platformMissing Authorization in Vimesoft's Enterprise Video Platform9.1 Critical
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: incorrect authorization in admin role-composite deletion allows delegated admin to remove privileged child roles4.9 Medium
- maybe-finance maybeMaybe 0.6.0 Missing Authorization via HostingsController show/update7.1 High
- github enterprise serverMissing Authorization vulnerability was identified in GitHub Enterprise Server that allowed reading private repository metadata via delegated bypass rule suites5.3 Medium
- google cloud firebase studioMissing Authorization in Firebase Studio allows Cross-Tenant Source Code Theft8.5 High
- mosaxiv clawletmosaxiv clawlet cron Chat Tool tool_cron.go remove authorization5.3 Medium
- phonepe payment solutions, unknown phonepe payment solutions +1 morePhonePe Payment Solutions < 3.1.0 - Unauthenticated Payment Bypass via Forged Callback7.5 High
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.1 - Missing Authorization to Unauthenticated Sensitive Information Exposure via /lp/v1/users/check-answer and /start-quiz REST Endpoints7.5 High
- wedevs erp: complete hr, accounting & crm suite built for woocommerceERP: Complete HR, Accounting & CRM Suite Built for WooCommerce <= 1.17.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Company Location Creation via wp_ajax_erp-company-location AJA…4.3 Medium
- devozon fense proxy & vpn blockerFense Proxy & VPN Blocker <= 3.0.1 - Missing Authorization to Unauthenticated Plugin Option/Transient Deletion via fense_bpvt_save_settings AJAX Action5.3 Medium
- getgrav grav-plugin-flex-objectsFail-open authorization in grav-plugin-flex-objects admin-next API: api.access user gets full CRUD on permission-less directories (requireFlexPermission missing else-deny)6.3 Medium
- getgrav gravGrav Flex-Objects < 1.4.3 Authorization Bypass via API2.3 Low
- getgrav grav-plugin-apiGrav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super8.8 High
- getgrav gravgrav-plugin-api < 1.0.6 Privilege Escalation via createApiKey8.7 High
- getgrav grav, grav-plugin-login +1 moreGrav Login Plugin: 2FA Bypass via 'login.regenerate2FASecret' - Secret Rotation During Pending Challenge7.4 High
- getgrav gravGrav < 2.0.4 2FA Bypass via Secret Regeneration9.1 Critical
- getgrav grav-plugin-apiGrav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL8.1 High
- getgrav gravGrav < 1.0.6 API Key Scope Bypass via ApiKeyAuthenticator8.6 High
- openclawOpenClaw 2026.1.20 < 2026.5.27 Authorization Bypass via device.pair.approve8.7 High
- openclawOpenClaw < 2026.6.5 Authentication Bypass via Admin Tools7.7 High
- openclawOpenClaw < 2026.6.9 Authentication Bypass via Moderation Actions6.0 Medium
- openclawOpenClaw 2026.4.12-beta.1 < 2026.6.6 Authorization Bypass via message actions6.0 Medium
- arcadedata arcadedb, com.arcadedb arcadedb-engine +1 moreArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)8.1 High
- bunkerity bunkerwebbunkerweb: Read-only Web UI users can delete job cache files due to missing authorization on /cache/ routes5.4 Medium
- envoyproxy gatewayEnvoy Gateway custom backendRef cross-namespace ReferenceGrant bypass6.4 Medium
- mwtcmi frogmanFrogman: Multiple read-tier tools expose admin-grade data and arbitrary GraphQL execution9.3 Critical
- spaceapplications yamcsYamcs: Insecure Direct Object Reference (IDOR) in PacketsApi allows unprivileged users to dump all telemetry packets4.3 Medium
- microsoft ufoMicrosoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service6.5 Medium
- ultimate fosters perfect support ticketing & document management systemPerfect Support Ticketing System 1.7 Broken Access Control via Agent Assignment5.3 Medium
- microsoft ufoMicrosoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info4.3 Medium
- microsoft simplechatSimpleChat plugin validation endpoints missing authentication and authorization8.6 High
- microsoft simplechatSimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpoints4.3 Medium
- quantumcloud wpbot – ai chatbot for live support, lead generation, ai servicesWPBot <= 8.5.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary RAG Document Re-Sync via ajax_rag_manual_sync() Function4.3 Medium
- quantumcloud wpbot – ai chatbot for live support, lead generation, ai servicesWPBot <= 8.5.6 - Missing Authorization to Unauthenticated Arbitrary Chat Session Deletion via 'userid' Parameter5.3 Medium
- themifyme themify builderThemify Builder <= 7.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Stylesheet Write/Delete via tb_generate_on_fly AJAX Action4.3 Medium
- kevp75 the cache purgerThe Cache Purger <= 2.3.20 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Log Deletion via 'the_log_purge' Parameter4.3 Medium
- Show moreLoading…