CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- themetechmount truebooker – appointment booking and scheduler systemTrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary Password Reset via 'truebooker_wp_user_id'9.8 Critical
- microsoft teamsMicrosoft Teams Elevation of Privilege Vulnerability10.0 Critical
- microsoft azure sre agentAzure SRE Agent Elevation of Privilege Vulnerability9.9 Critical
- open-reception appointment-booking-softwareOpenReception vulnerable to unauthenticated staff crypto poisoning that breaks E2E recipient directory9.4 Critical
- flowiseai flowiseFlowise 3.1.4 Authentication Bypass via OAuth2 Credential Refresh Endpoint8.7 High
- flowiseai flowiseFlowise 3.1.4 Missing Authorization on Document Store Mutation Endpoints7.2 High
- open-reception appointment-booking-softwareOpenReception has unauthenticated GLOBAL_ADMIN account creation post-bootstrap9.8 Critical
- elated-themes frappeFrappe: Lack of Permissions in restore/bulk_restore7.1 High
- open-reception appointment-booking-softwareOpenReception: GET appointment by ID returns full appointment record without authorization5.3 Medium
- open-reception appointment-booking-softwareOpenReception's unauthenticated add-to-tunnel endpoint accepts arbitrary appointment injections6.5 Medium
- statamic cmsStatamic: Missing authorization on navigation endpoint allows disclosure of restricted entries6.5 Medium
- statamic cmsStatamic: Missing authorization on Control Panel endpoint allows disclosure of user existence4.3 Medium
- payment plugins for paypal woocommerce, unknown payment plugins for paypal woocommerce +1 morePayment Plugins for PayPal WooCommerce < 2.0.20 - Unauthenticated Payment Bypass via Reuse of a Completed PayPal Order7.5 High
- escriptoriumMissing Authorization in eScriptorium7.1 High
- escriptoriumMissing Authorization in eScriptorium4.3 Medium
- boldgrid total upkeepWordPress Total Upkeep plugin <= 1.17.2 - Broken Access Control vulnerability8.2 High
- cozmoslabs profile builderWordPress Profile Builder plugin <= 3.16.5 - Broken Access Control vulnerability5.3 Medium
- dokan, inc. dokanWordPress Dokan plugin <= 5.0.10 - Broken Access Control vulnerability5.3 Medium
- justin kruit advanced custom fields: font awesome fieldWordPress Advanced Custom Fields: Font Awesome Field plugin <= 6.1.1 - Broken Access Control vulnerability4.3 Medium
- shabti frontend admin by dynamiappsWordPress Frontend Admin by DynamiApps plugin <= 3.29.10 - Broken Access Control vulnerability7.1 High
- it-recht kanzlei legal text connector of the it-recht kanzleiWordPress Legal Text Connector of the IT-Recht Kanzlei plugin <= 1.0.13 - Broken Access Control vulnerability6.5 Medium
- lattepress anspress – question and answerWordPress AnsPress – Question and answer plugin 4.4.4 - Broken Access Control vulnerability7.1 High
- solutioned staff trainingWordPress Staff Training plugin <= 1.0.7 - Broken Access Control vulnerability7.3 High
- ivanbebek box now delivery croatiaWordPress BOX NOW Delivery Croatia plugin <= 3.3.0 - Broken Access Control vulnerability7.5 High
- surecartWordPress SureCart plugin <= 4.6.2 - Broken Access Control vulnerability5.3 Medium
- jetmonsters jetformbuilderWordPress JetFormBuilder plugin <= 3.6.4.1 - Broken Access Control vulnerability7.5 High
- nexcess kadence woocommerce email designerWordPress Kadence WooCommerce Email Designer plugin <= 1.5.19 - Privilege Escalation vulnerability9.8 Critical
- bdthemes ultimate store kit elementor addonsWordPress Ultimate Store Kit Elementor Addons plugin <= 3.0.5 - Broken Access Control vulnerability6.5 Medium
- wp.insider simple membershipWordPress Simple Membership plugin <= 4.7.8 - Broken Access Control vulnerability7.5 High
- inspirythemes realhomes membershipsRealHomes Memberships < 3.1.0 - Subscriber+ Membership Payment Bypass4.3 Medium
- breakdanceWordPress Breakdance plugin < 2.7 - Broken Access Control vulnerability7.5 High
- hugging face accelerateAccelerate <= 1.5.3 - Missing Authorization to Authenticated (Subscriber+) ThemeGrill Demo Importer Plugin Installation4.3 Medium
- spacetime ad inserter – ad manager & adsense adsAd Inserter <= 2.8.16 - Missing Authorization to Block Visibility Bypass via ai_ajax5.3 Medium
- No product listedTinyAGI Message API Endpoint index.ts processMessage authorization6.9 Medium
- unknown stripe payment forms by wp full payStripe Payment Forms by WP Full Pay < 8.5.2 - Unauthenticated Payment Intent Amount Manipulation7.5 High
- metagauss profilegridProfileGrid < 6.0.0.0 - Unauthenticated Group Member List Disclosure via pm_get_all_users_from_group5.3 Medium
- bitpressadmin file managerFile Manager 6.0 - 6.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Read and Deletion via 'cmd' Query Parameter8.8 High
- @clerk nuxtNuxt runtime payload cache discloses another user's SSR data across users and to unauthenticated clients7.5 High
- spacebar server serverSpacebar Server Missing Authorization via member-ids Endpoint5.3 Medium
- spacebar server serverSpacebar Server Missing Authorization via Group DM Recipient Endpoint8.6 High
- mervinpraison praisonaiPraisonAI: GitHub Actions Claude workflow command injection via unquoted PR branch name10.0 Critical
- jenkins project aws codebuild pluginMissing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with...4.3 Medium
- jenkins project codesonar pluginMissing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with...4.3 Medium
- jenkins project sauce ondemand pluginMissing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with...4.3 Medium
- jenkins project xml job to job dsl pluginJenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing...6.5 Medium
- jenkins project parameterized remote trigger pluginA missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier...4.3 Medium
- jenkins project external workspace manager pluginJenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check ...4.3 Medium
- jenkins project scm-manager pluginA missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with...4.2 Medium
- jenkins project hcl appscan pluginMissing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with...4.3 Medium
- penpotCVE-2026-176137.5 High
- Show moreLoading…