CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- metagauss profilegridProfileGrid < 6.0.0.0 - Subscriber+ Group Join Request Disclosure via pm_get_all_requests_from_group4.3 Medium
- unknown simple membershipSimple Membership < 4.7.8 - Unauthenticated Administrator Account Takeover via Registration Username Collision9.4 Critical
- radiustheme classified listingClassified Listing < 5.4.4 - Contributor+ Store Revenue Total Disclosure via rtcl_revenue_order_search2.7 Low
- radiustheme classified listingClassified Listing < 5.4.4 - Contributor+ Unpublished Post Content Disclosure via rtcl_block_css_get_posts2.7 Low
- unknown contest galleryContest Gallery < 30.0.7 - Author+ Arbitrary Post Deletion via post_cg_youtube_delete_from_library6.5 Medium
- mediatek mt7902 firmware, mt7920 firmware, mt7921 firmware +4 more +6 moreIn Bluetooth driver, there is a possible permission bypass due to a missing permission check....7.8 High
- mediatek mt6739 firmware, mt6761 firmware, mt6765 firmware +33 more +35 moreIn Telephony, there is a possible escalation of privilege due to a missing permission check. This...7.7 High
- unknown webtoffee-cookie-consentWebToffee Cookie Consent < 3.5.3 - Consent Log Disclosure/Deletion, Page Creation & License Deactivation via Unprotected REST Routes6.5 Medium
- thedotstore product attachment for woocommerceWooCommerce Product Attachment < 2.3.3 - Unauthenticated Arbitrary Media Download7.5 High
- lws optimize, unknown lws optimize +1 moreLWS Optimize < 3.4 - Subscriber+ Cache Deletion4.3 Medium
- metabox meta boxMeta Box < 5.13.1 - Contributor+ Arbitrary Attachment Deletion via IDOR5.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: client access-type policy condition bypass during client update6.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: fgap v2 group assignment bypass during user creation6.6 Medium
- redhat build of keycloak, red hat build of keycloak 26.6, build of keycloak 26.6.7 +3 more +5 moreKeycloak-services: keycloak-services: full-scope-disabled client policy validation bypass via omitted fullscopeallowed5.4 Medium
- arcadedata arcadedbArcadeDB before 26.7.2 Authentication Bypass via ALTER TYPE8.5 High
- wplakeorg advanced views – display custom fields (acf, pods, metabox), posts, cpt and woo products anywhere in gutenberg, elementor, divi, beaver…Advanced Views <= 3.9.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'view-refresh' and 'card-refresh' REST Endpoints6.5 Medium
- saadiqbal gutena forms – contact form, survey form, feedback form, booking form, and custom form builderGutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder <= 1.9.0 - Missing Authorization to Unauthenticated Arbitrary Form Entry Modification/Trash via process_b…5.3 Medium
- inspirythemes realhomes membershipsRealHomes Memberships <= 3.0.9 - Missing Authorization to Authenticated (Subscriber+) Membership Payment Bypass via 'ims_add_paypal_recurring_membership' AJAX Action4.3 Medium
- wpwax formgent – next-gen ai form builder for wordpress with multi-step, quizzes, payments & moreFormGent <= 1.9.2- Missing Authorization to Unauthenticated Arbitrary File Deletion via 'file_token' Parameter9.1 Critical
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers5.3 Medium
- checkmk gmbh checkmkMissing Authorization Allows Editing of Foreign Reports5.3 Medium
- mailerpress – newsletter, email marketing & ai automationMailPress <= 1.5.0 - Missing Authorization to Unauthenticated Contact Updates5.3 Medium
- mailerpress – newsletter, email marketing & ai automationMailerPress <= 1.5.0 - Missing Authorization to Unauthenticated Arbitrary Modification via REST API Endpoint5.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: google external access-token exchange bypasses hosted-domain restriction6.8 Medium
- red hat build of keycloak, build of keycloak 26.6, build of keycloak 26.6.8 +3 more +5 moreKeycloak-services: keycloak-services: inactive out-of-audience token introspection leaks signed jwt claim6.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: missing per-role authorization on rolecontainerresource composite endpoints4.9 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: client not-before revocation ignored when realm not-before is older but nonzero4.2 Medium
- palscode support genixSupport Genix Lite < 1.4.48 - Unauthenticated Ticket Attachment Download via Missing Authorization3.7 Low
- joomsky js help deskJS Help Desk < 3.1.4 - Unauthenticated Arbitrary Ticket File Attachment Upload7.5 High
- stellarwp givewpGiveWP < 4.16.3 - Unauthenticated Payment Gateway Restriction Bypass5.3 Medium
- persesPerses: Missing authorization in datasource proxy allows cross-scope secret disclosure8.3 High
- opf openprojectOpenProject: Private work package subject/identity disclosure through the global Time Entries and Cost Entries APIs (linked work package rendered without visibility check)4.3 Medium
- opf openprojectOpenProject: Improper Access Control through /api/v3/work_packages/<X.id> via PATCH parameter "fileLinks"7.6 High
- wp swings subscriptions for woocommerceSubscriptions for WooCommerce <= 2.0.0 - Missing Authorization to Authenticated (Shop Manager+) Arbitrary Plugin Installation via wps_sfw_install_plugin_configuration AJAX Action7.2 High
- unknown wp travel engine, wp travel engine travel engine +1 moreWP Travel Engine < 6.8.2 - Unauthenticated Trip Difficulty Level Option Update7.5 High
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps < 3.29.7 - Subscriber+ Taxonomy Term Creation/Modification/Deletion via Missing Authorization6.5 Medium
- search atlas seo, unknown search atlas seo +1 moreSearch Atlas SEO < 2.6.12 - Subscriber+ Google Indexing API Access5.4 Medium
- unknown bit formBit Form < 3.1.2 - Unauthenticated Inactive Form Submission3.7 Low
- fleekdash v2FleekDash V2 <= 2.6.2.2 - Missing Authorization to Authenticated (Subscriber+) Administrator Account Takeover via /users/{id} REST Endpoint8.8 High
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabMissing Authorization in GitLab4.9 Medium
- dynatrace-oss dynatrace-mcpDynatrace MCP Server: create_dynatrace_notebook missing the human-approval gate3.7 Low
- No product listedKong Operator cluster-wide ingress configuration DoS via embedded KIC CA-certificate ID collision7.1 High
- No product listedKong Kubernetes Ingress Controller cluster-wide ingress configuration DoS via CA-certificate ID collision7.1 High
- cert.pl mwdb coreMissing authentication requirement in Remote Instances proxy API in MWDB Core7.0 High
- cert.pl mwdb corePermission Bypass Via Undocumented HTTP Methods In MWDB Core5.3 Medium
- meta box aioMeta Box AIO <= 3.8.0 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'rwmb_frontend_field_object_id' Parameter9.1 Critical
- klubraum membership requestKlubraum Membership Request <= 1.1.0 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Update5.3 Medium
- apache atlasApache Atlas: Missing Authorization on Admin Endpoints8.8 High
- red hat build of keycloak 26.6, build of keycloak 26.6.7, data grid 8 +3 more +5 moreKeycloak-services: keycloak-services: generic identity-provider creation can bind brokers to organizations without manage-organizations5.5 Medium
- Show moreLoading…