CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- wisemattic wisecampaign – woocommerce conversions made easywiseCampaign <= 1.1.16 - Missing Authorization to Unauthenticated Plugin Configuration Modification via REST API7.5 High
- webocoders udimi toolsUdimi Tools <= 3.2 - Missing Authorization to Authenticated (Subscriber+) Plugin Configuration Reset via 'disconnect' AJAX Action6.5 Medium
- aircoookie wledWLED Unauthenticated Configuration Disclosure via /json/cfg and Global Settings-PIN Lock State8.2 High
- raghav993 toner-managementtoner-management - Unauthenticated State-Changing Admin Actions8.2 High
- mailmunch forms for mailchimpMailChimp Forms by MailMunch <= 3.2.7 - Missing Authorization to Authenticated (Subscriber+) MailMunch Integration Takeover via 'sign_in' AJAX Action8.1 High
- themeruby easy post submission – frontend posting, guest publishing & submit content for wordpressEasy Post Submission <= 2.3.0 - Missing Authorization9.1 Critical
- leantimeLeantime - Missing Authorization on TwoFA JSON-RPC Methods Allows Cross-Account 2FA Secret Disclosure and Bypass8.1 High
- xpro addons — 140+ widgets for elementorXpro Addons <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Creation via get_menu_content_editor() Function4.3 Medium
- cyberlord92 page and post restrictionPage and Post Restriction <= 1.4.1 - Unauthenticated Missing Authorization to Sensitive Information Exposure via REST API7.5 High
- saadiqbal wpformify – stripe payments with form and checkoutWPFormify <= 1.1.1 - Missing Authorization8.2 High
- ho3einie material dashboardMaterial Dashboard <= 1.4.10 - Missing Authorization to Unauthenticated Task Enumeration, Execution, and Deletion7.3 High
- techeshta layouts for wpbakeryLayouts for WPBakery <= 1.1.3 - Missing Authorization to Unauthenticated Template Cache Manipulation via 'handle_sync' AJAX Action6.5 Medium
- wupsales ai copilot – content generatorAI Chatbot & Workflow Automation by AIWU <= 1.4.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure7.5 High
- sh1zen multi uploader for gravity formsMulti Uploader for Gravity Forms <= 1.1.8 - Missing Authorization to Unauthenticated Arbitrary Media Deletion9.1 Critical
- multivendorxMultiVendorX < 5.0.11 - Store Owner+ Cross-Vendor Store Takeover and Deletion via Missing Authorization7.2 High
- sunshinephotocart sunshine photo cartSunshine Photo Cart < 3.6.12 - Unauthenticated Private Gallery Comment Disclosure7.5 High
- stylemix cost calculator builderCost Calculator Builder <= 3.6.17 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure6.5 Medium
- dokaninc dokan: ai powered woocommerce multivendor marketplace solution – build your own amazon, ebay, etsyDokan <= 5.0.2 - Missing Authorization to Authenticated (Vendor+) Privilege Escalation8.8 High
- No product listedRackTables cross-site request forgery5.3 Medium
- odysseus-dev odysseusOdysseus Missing Admin Authorization via Embedding Endpoint Routes8.7 High
- openwebui open webui, open-webui +1 moreOpen WebUI: A folder write-collaborator can permanently delete the owner's chats by deleting a shared subfolder8.1 High
- frappe erpnextERPNext v16.25.0 - Improper authorization in Prospect opportunities API7.1 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Cross-user file content disclosure via request-scoped direct model knowledge metadata5.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Users denied the image-generation permission can still generate images via chat completions4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Any authenticated user can cancel another user's chat generation via the chat delete endpoint3.1 Low
- openwebui open webui, open-webui +1 moreOpen WebUI: Any member with write access to a standard channel can edit or delete other members' messages5.4 Medium
- flowiseai flowiseFlowise before 3.1.4 Credential Abuse via Text-to-Speech6.3 Medium
- flowiseai flowiseFlowise: Missing Authorization on Execution Update Endpoint7.1 High
- zammadZammad: Missing authorization on ticket attachment download7.1 High
- zammadZammad 7.0.1 - Improper authorization in ticket article attachment cloning7.1 High
- flowiseai flowiseFlowise: Information Disclosure in GET /api/v1/upsert-history returns the entire server-wide upsert history8.3 High
- flowiseai flowiseFlowise: Missing authorization on `/api/v1/files` allows low-privileged API keys to list and delete files across workspaces within the same organization7.2 High
- havelsan liman mysMissing Authorization Leading to Root Code Execution in HAVELSAN's Liman MYS8.8 High
- havelsan liman mysVault Credential Confusion via Authorization Bypass in HAVELSAN's Liman MYS8.8 High
- eclipse miloIn Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce...6.9 Medium
- eclipse miloIn Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a...8.8 High
- unknown wired impact volunteer management, wired impact volunteer management +1 moreWired Impact Volunteer Management < 2.8.2 - Subscriber+ Arbitrary RSVP Removal via wivm_remove_rsvp4.3 Medium
- unknown contest galleryContest Gallery < 30.0.7 - Subscriber+ OpenAI Prompt History Disclosure via post_cg_get_openai_prompts4.3 Medium
- unknown miniorange 2faminiOrange 2FA < 6.2.7 - Subscriber+ Arbitrary-Recipient OTP Send4.3 Medium
- unknown easy integration for dropboxEasy Dropbox Integration < 2.2.0 - Unauthenticated Arbitrary Connected Dropbox File Access and Upload via nopriv AJAX9.3 Critical
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Remote Code Execution Vulnerability6.5 Medium
- microsoft edge (chromium-based), edge chromium +1 moreMicrosoft Edge (Chromium-based) Tampering Vulnerability6.2 Medium
- owen2345 camaleon-cmsCamaleon CMS 2.9.2 Missing Authorization via /admin/post_type drafts endpoint5.3 Medium
- apache nifiApache NiFi: Missing Authorization for Components Referenced by Parameter Context Updates5.9 Medium
- admidioAdmidio before 5.0.11 Cross-Organization Role Modification6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.3 Information Disclosure via getHeading*Transaction9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.3 Content Disclosure via getBacklinkDoc9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.3 Metadata Disclosure via getBlockInfo6.9 Medium
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.15 - Broken Access Control vulnerability5.4 Medium
- unknown chamawpChama < 1.0.13 - Unauthenticated Arbitrary User Password Reset9.8 Critical
- Show moreLoading…