CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- metaphorcreations dittyWordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability5.3 Medium
- wp go maps (formerly wp google maps) go maps, wpgmaps wp go maps +1 moreWordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability5.3 Medium
- digitalme eroomWordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability5.4 Medium
- mediavine control panelWordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability4.3 Medium
- cascadiawebservices mountdev ai mcp connector for wordpressMountDev AI MCP Connector for WordPress <= 1.6.1 - Unauthenticated Privilege Escalation via OAuth Authorization Endpoint9.8 Critical
- ataurr gutenkit – page builder blocks, patterns, and templates for gutenberg block editorGutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints5.3 Medium
- selinuxproject selinuxProcess Kill Attack Vector in killall() in seunshare6.8 Medium
- unknown praison ai seoPraison AI SEO < 5.0.7 - Unauthenticated Multiple Missing Authorization (Post Permalink Modification, Plugin Settings Disclosure)7.5 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreLocal File Disclosure in MongoDB Server via MozJS Scripting Engine Module Loader6.3 Medium
- drupal photoswipe - responsive javascript modal image galleryPhotoSwipe - Responsive JavaScript Modal Image Gallery - Moderately critical - Access bypass - SA-CONTRIB-2026-0889.1 Critical
- caliptra core runtime firmwareUnverified AXI Address in Subsystem Mode Commands Enables Denial of Service6.8 Medium
- graylog2 graylog2-serverGraylog2 Server Missing Permission Check on Event Definition Duplicate5.3 Medium
- red hat ansible automation platform 2Awx: websocket eventconsumer missing authorization for inventory_update_events, project_update_events, and system_job_events allows cross-organization stdout disclosure6.5 Medium
- elastic kibanaMissing Authorization in Kibana Leading to Information Disclosure4.3 Medium
- elastic kibanaMissing Authorization in Kibana Leading to Unauthorized Information Disclosure4.3 Medium
- oracle corporation hcm configuration workbench, oracle human capital management configuration workbench +1 moreVulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite ...7.3 High
- oracle telecommunications billing integratorVulnerability in the Oracle Telecommunications Billing Integrator product of Oracle E-Business...8.1 High
- oracle siebel crm, oracle corporation siebel crm cloud applications +1 moreVulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component:...6.5 Medium
- elastic kibanaMissing Authorization in Kibana Leading to Unauthorized Access to Cloud Connect Management Functions6.3 Medium
- medienbaecker kirby-moduleskirby-modules License Key Disclosure via modules/activate Dialog5.3 Medium
- taiga taiga-backTaiga taiga-back Private Project Member Roster Disclosure via Unauthenticated filters_data Endpoints6.9 Medium
- gitea open source git serverPrivate Repository Metadata Remains Accessible After Access Revocation7.5 High
- fogprojectFOGProject has unauthenticated clearAES and clearPMTasks that allow remote destruction of host encryption keys and power schedules8.2 High
- gitea open source git serverRSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)4.3 Medium
- gitea open source git serverCross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access7.5 High
- gitea open source git serverCross-repository issue/comment attachment re-linking can expose private attachment content5.9 Medium
- gitea open source git serverMissing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in c…5.9 Medium
- vitest-dev vitestVitest: Browser Mode provider commands bypass the file-access permission gate9.4 Critical
- humhubHumHub Missing Authorization on Remove All Space Members Action7.1 High
- eclipse hawkbit, eclipse foundation eclipse-hawkbit/hawkbit +1 morePrivilege Escalation in Eclipse hawkBit DDI allows Tenant-Isolated Firmware Exfiltration4.3 Medium
- solarwinds serv-uSolarWinds Serv-U Privilege Escalation Vulnerability9.1 Critical
- solarwinds serv-uSolarWinds Serv-U Broken Access Control Vulnerability9.1 Critical
- saturday drive ninja formsNinja Forms Missing Authorization in submissions-table Gutenberg Block Discloses Form Submissions to Unauthenticated Visitors7.1 High
- zenml-io zenml-io/zenmlMissing Authorization in get_deployed_stack Endpoint in zenml-io/zenml5.0 Medium
- universal software inc. flexcityImproper Authorization in Universal Sotware's FlexCity6.5 Medium
- getgrav grav-plugin-apiGrav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account8.7 High
- getgrav gravGrav before 1.0.8 Missing Authorization on API Key Generation8.7 High
- themeum tutor lms elementor addonsTutor LMS Elementor Addons <= 4.0.0 - Missing Authorization to Authenticated (Subscriber+) Tutor LMS and Elementor Plugin Activation4.3 Medium
- checkmk gmbh checkmkFix Business Intelligence API Pack permission5.3 Medium
- unknown wpbotWPBot AI ChatBot < 8.2.0 - Subscriber+ RAG Settings Update4.3 Medium
- unknown bit formBit Form < 3.1.0 - Unauthenticated Workflow Trigger via Authentication Bypass6.5 Medium
- withastro astroAstro: Unauthenticated path override in the @astrojs/vercel ISR function6.5 Medium
- pdovhomilja nextcrm-appNextCRM has RBAC Bypass in MCP Product Tools that Allows Low-Privileged Users to Modify the CRM Product Catalog7.1 High
- pdovhomilja nextcrm-appNextCRM has BOLA/IDOR in MCP Campaign Tools that Allows Cross-User Campaign Disclosure and Tampering7.6 High
- pdovhomilja nextcrm-appNextCRM has Broken Access Control in Server Actions that allows any authenticated user to deactivate/activate arbitrary accounts8.1 High
- freescout-help-desk freescoutFreeScout Vulnerable to Unauthenticated Thread Read-Status Manipulation and Conversation Enumeration via Open Tracking Endpoint6.5 Medium
- jovancoding network-aiNetwork-AI 5.12.2 through 5.13.3 Missing Authorization via ApprovalInbox9.3 Critical
- surrealdbSurrealDB before 3.2.0 Authentication Bypass via Custom API8.6 High
- codexpert inc thumbpressThumbPress < 6.2.2 - Subscriber+ Plugin Deactivation5.4 Medium
- unknown payplus payment gatewayPayPlus Payment Gateway < 8.2.2 - Unauthenticated Order Key Disclosure and Order Status Modification6.5 Medium
- Show moreLoading…