CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- tp-link systems inc. ex141(br) v1.0/1.9, ex141(eu1) v1.0, ex141(us1) v1.0 +53 more +55 moreAuthentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices8.7 High
- rocket.chatRocket.Chat: Broken Access Control in channels.convertToTeam Allows Unauthorized Conversion of Public Channels into Teams4.3 Medium
- rocket.chatRocket.Chat: Insecure implementation of websocket notifications5.4 Medium
- frappe erpnextERPNext: Unauthorised modification of master data due to missing validation7.1 High
- frappe erpnextERPNext: Unauthorised triggering of automated emails due to missing validation4.3 Medium
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.3 +1 more +3 moreFeast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materialization8.5 High
- dokployDokploy: WebSocket Terminal Missing Service-Level Access Control8.8 High
- dokployDokploy: Cross-organization IDOR leads to root RCE on another tenant's server via swarm.*9.9 Critical
- hashicorp vault enterpriseVault Enterprise vulnerable to cross-namespace entity deletion8.2 High
- dokployDokploy: Member-role RCE as host root via destination.testConnection rclone shell injection9.9 Critical
- dokployWebSocket Terminal Auth Bypass8.8 High
- dokployDokploy Broken Access Control on docker-container-terminal WebSocket (Member -> Root in Arbitrary Containers)9.9 Critical
- dokployDokploy: Missing authorization in WebSocket handlers allows a low-privilege member to gain root on the Docker host9.9 Critical
- flowiseai flowiseFlowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download8.7 High
- metabaseMetabase information exposure7.1 High
- dokployDokploy: Cross-organization IDOR in Dokploy backup destinations exposes another tenant's S3 credentials and backups9.6 Critical
- discourseDiscourse: Templates endpoint exposes hidden tag names4.3 Medium
- discourseDiscourse: Anonymous sidebar serialization exposes descriptions of category-restricted tags5.3 Medium
- discourseDiscourse: Duplicate lookup reveals restricted topic titles through canonicalized URLs4.3 Medium
- nceas metacatunauthenticated path traversal in Metacat 2.x9.3 Critical
- misp cti-transmutecti-transmute Conversion History Authorization Bypass Leads to Sensitive Data Disclosure After Conversion Deletion6.9 Medium
- bitwarden serverBitwarden Server < 2026.7.2 Audit Log Injection via POST /collect6.9 Medium
- linuxnet: qrtr: restrict socket creation to the initial network namespace8.8 High
- opensignlabs opensignserverOpenSignLabs opensignserver - Missing Authorization7.5 High
- linuxgeneve: require CAP_NET_ADMIN in the device netns for changelink8.8 High
- red hat directory server 11, directory server 12, directory server 13 +5 more +7 more389-ds-base: 389-ds-base: missing authorization allows anonymous clients to start or abort cleanallruv replication maintenance6.5 Medium
- dimitri grassi salon booking systemSalon Booking System – Free Version < 10.30.34 - Unauthenticated Arbitrary Booking Total Tampering5.3 Medium
- jetmonsters motopress hotel bookingHotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint5.3 Medium
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce < 5.116.0 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions5.4 Medium
- bricksforgeBricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms8.1 High
- systemd systemd-machinedsystemd-machined: unprivileged users can terminate arbitrary processes4.7 Medium
- aureus erpDolibarr ERP TakePOS invoice.php fail authorization5.3 Medium
- code-projects task management systemcode-projects Task Management System UpdateTaskStatus.php authorization6.9 Medium
- unknown piweb cancel order / refund request for woocommerceCancel Order & Request Woocommerce < 1.3.4.34 - Unauthenticated Order Content Disclosure via Reorder AJAX Actions6.5 Medium
- catch themes createCreate by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication6.5 Medium
- catch themes createCreate by Mediavine < 2.5.4 - Unauthenticated Unpublished Content Disclosure and Publication6.5 Medium
- solacewp solace extraSolace Extra < 1.6.1 - Subscriber+ Post Meta Update via solace_update_sitebuilder_status4.3 Medium
- unknown download monitorDownload Monitor < 5.2.6 - Unauthenticated Download Log Injection5.3 Medium
- ghostfolioGhostfolio has a Stripe subscription bypass6.5 Medium
- kata-containersKata Containers: Unauthorized mem-agent ttRPC methods let an untrusted host tamper with confidential-guest memory5.7 Medium
- home-assistant coreHome Assistant: iOS Companion app forwards NFC/QR tag scans without confirmation, enabling silent automation execution7.1 High
- home-assistant coreHome Assistant: Unconfirmed NFC/QR tag scans allow silent automation execution by untrusted callers7.1 High
- hashicorp consul, consul enterprise +1 moreConsul vulnerable to partial arbitrary file read via Vault Connect CA provider6.8 Medium
- elated-themes frappeFrappe: Unrestricted access to a Document Follow API5.3 Medium
- sonatype nexus repository 3, nexus repository manager +1 moreNexus Repository 3 - Wildcard Privilege Update Self-Escalation to Administrator8.9 High
- tobit laboratories ag teamdavidTeamDavid: Missing Authorization6.9 Medium
- mstore api, unknown mstore api +1 moreMStore API < 4.21.0 - Unauthenticated Product Review Creation7.5 High
- mstore api, unknown mstore api +1 moreMStore API < 4.21.0 - Unauthenticated Payment Bypass via Multiple Payment Gateways9.1 Critical
- unknown templatelyTemplately < 3.7.1 - Unauthenticated Administrator Templately Cloud Connection Overwrite6.5 Medium
- xwp stream – activity log & audit trailStream <= 4.2.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via Heartbeat API6.5 Medium
- Show moreLoading…