CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- payuplugin payu commercepro pluginPayU CommercePro < 3.9.0 - Unauthenticated Order Tampering5.3 Medium
- bplugins survey form block – collect answers and insights from your audienceSurvey Form Block <= 1.0.1 - Missing Authorization to Authenticated (Subscriber+) Survey Submission Data Export4.3 Medium
- magepeopleteam event booking manager for woocommerce – sell tickets, event registration, rsvp & event calendarEvent Booking Manager for WooCommerce <= 5.3.7 - Missing Authorization to Authenticated (Contributor+) Site-Wide Payment Settings Modification via mep_save_payment_settings_modal AJAX Action4.3 Medium
- goshs-labs goshsgoshs: File-based .goshs ACL authorization bypass via the ?bulk zip-download route (unauthenticated read; residual of CVE-2026-40189)7.5 High
- ibm websphere application serverIBM WebSphere Application Server is affected by an authentication bypass7.0 High
- sdelements lets-chatLet's Chat 0.3.0 - 0.4.8 Improper Authorization via DELETE /rooms/:room5.3 Medium
- sdelements lets-chatLet's Chat 0.3.0 - 0.4.8 Broken Access Control File Disclosure via GET /files route5.3 Medium
- wedevs storegrowth – upsell, bogo, quick view, direct checkout & side cart for woocommerceStoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via…5.3 Medium
- wedevs storegrowth – upsell, bogo, quick view, direct checkout & side cart for woocommerceStoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.0 - Missing Authorization to Unauthenticated Options Update via create_popup AJAX Action5.3 Medium
- quantumcloud wpbot – ai chatbot for live support, lead generation, ai servicesWPBot <= 8.5.9 - Missing Authorization to Unauthenticated Email Relay via wpcs_send_email AJAX Action5.3 Medium
- uncannyowl uncanny automator – easy automation, integration, webhooks & workflow builder pluginUncanny Automator <= 7.3.2 - Missing Authorization to Authenticated (Subscriber+) Sensitive Integration Metadata Disclosure via Multiple AJAX Endpoints7.5 High
- ads-tec industrial it dvg-irf1401, dvg-irf1421, dvg-irf3401 +3 more +5 moreads-tec Industrial IT: Vertical privilege escalation via configuration table write8.8 High
- unknown tablesome tableTablesome < 1.1.31 - Unauthenticated Post Creation and Modification7.5 High
- unknown quiz and survey master (qsm)Quiz And Survey Master < 11.1.5 - Contributor+ Arbitrary Template Deletion2.7 Low
- nasirahmed advanced form integration — connect forms to 200+ appsAdvanced Form Integration <= 2.6.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary MailUp OAuth Token Overwrite via auth_redirect() Function4.3 Medium
- wpeverest pdfdraft – drag & drop pdf builder, pdf viewer, embed & download pdf, certificate & invoice designerPDFDraft <= 1.1.0 - Missing Authorization to Unauthenticated Sensitive PDF Disclosure via 'slug' Parameter5.3 Medium
- isaumya ad invalid click protector (aicp)WordPress Ad Invalid Click Protector (AICP) plugin <= 1.3.0 - Broken Access Control vulnerability6.5 Medium
- tpixendit xendit payment, xendit payment +1 moreWordPress Xendit Payment plugin <= 7.1.0 - Broken Access Control vulnerability7.5 High
- apple macosThis issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia...5.5 Medium
- apple ipados, macos, visionos +3 more +5 moreAn authorization issue was addressed with improved validation. This issue is fixed in iOS 26.6...9.8 Critical
- jfrog artifactoryPotential unauthorized modification of Artifactory internal metadata7.1 High
- shufflehound gillionWordPress Gillion theme <= 4.13 - Broken Access Control vulnerability5.3 Medium
- yaycommerce yaypricingWordPress YayPricing plugin <= 3.5.6 - Broken Access Control vulnerability5.4 Medium
- visual composer website builderWordPress Visual Composer Website Builder plugin <= 45.15.0 - Broken Access Control vulnerability5.0 Medium
- nexcess event ticketsWordPress Event Tickets plugin <= 5.29.0.1 - Broken Access Control vulnerability5.3 Medium
- thrive themes coupon leads versionWordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability6.5 Medium
- themewant rt mega menu – mega menu builder for elementor & gutenbergWordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Broken Access Control vulnerability6.5 Medium
- roxnor fundengineWordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerability6.5 Medium
- franky events made easyWordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability6.5 Medium
- cocart headless – headless ecommerceWordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability7.5 High
- thrive themes coupon product managerWordPress Thrive Product Manager plugin <= 10.9.2 - Broken Access Control vulnerability7.3 High
- aurovrata venet post my cf7 formWordPress Post My CF7 Form plugin <= 6.2.0 - Broken Access Control vulnerability7.5 High
- payment plugins stripe for woocommerce, stripe for woocommerce for woocommerce +1 moreWordPress Stripe For WooCommerce plugin <= 4.0.7 - Broken Access Control vulnerability7.5 High
- motov.net ebook storeWordPress Ebook Store plugin <= 6.19 - Sensitive Data Exposure vulnerability7.5 High
- progress ecs connection manager, loadmaster, progress software moveit waf +5 more +7 moreProgress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API8.0 High
- stellarwp the events calendarThe Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation5.3 Medium
- siyuan-note siyuanSiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP10.0 Critical
- linux, linux kernel +1 moreNFSv4: include MAY_WRITE in open permission mask for O_TRUNC7.1 High
- omnifacesOmniFaces: Forged combined-resource IDs and related output/push boundaries8.2 High
poweradmin/poweradminPackagistPoweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account8.8 High- budibaseBudibase: Missing RBAC on GET /api/global/groups allows BASIC users to enumerate all tenant groups and role mappings4.3 Medium
- budibaseBudibase: Privilege escalation via public role assignment API missing app-level authorization8.8 High
- open-webuiOpen WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)7.1 High
- better-auth scimbetter-auth SCIM 1.4.0-beta.27 through 1.6.21 Account Takeover via Provider-ID Collision9.4 Critical
- kortix-ai sunaSuna < 0.9.102 Broken Access Control via Message Queue API8.7 High
- apache hbaseApache HBase: Missing scanner instance owner check in thrift delegation service6.5 Medium
- devolutions powershell universalImproper access control in the automation tests and workflows features in Devolutions PowerShell...5.0 Medium
- eventon action userEventON Action User <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX Action7.3 High
- paymentplugins payment plugins for stripe woocommercePayment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret5.3 Medium
- metagauss profilegridProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization3.8 Low
- Show moreLoading…