CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- apache airflowApache Airflow: Cross-team authorization bypass in the asset materialization and dag-run result endpoints6.5 Medium
- progress whatsup goldWhatsUp Gold versions prior to 26.0.2 contain an improper authorization vulnerability in the Scheduled Reports API.4.3 Medium
- jfrog artifactoryPotential unauthorized metadata exposure in JFrog Artifactory4.3 Medium
- jfrog artifactoryPrivate Release Bundle versions may be disclosed under specific configurations3.1 Low
- jfrog artifactoryAuthenticated users may access restricted Artifactory support information6.5 Medium
- jfrog artifactoryLow-privilege users may remove protected Artifactory metadata8.1 High
- jfrog artifactoryAuthenticated users may view private Puppet module metadata4.3 Medium
- jfrog artifactoryAuthenticated users may access private NuGet metadata4.3 Medium
- jfrog artifactoryAnonymous users may access restricted Artifactory repository information5.3 Medium
- jfrog artifactoryAuthenticated users may access private OCI referrer metadata4.3 Medium
- jfrog artifactoryPublishers without delete permission can overwrite docker layer information6.5 Medium
- jfrog artifactoryAnonymous users may access restricted Artifactory content under specific configurations5.3 Medium
- rustfsRustFS: FTPS MKD bypasses IAM CreateBucket authorization5.4 Medium
- rustfsRustFS: Version-specific object reads authorize the non-version action6.5 Medium
- circl vulnerability-lookupAuthorization Bypass in SSE Pub/Sub Allows Unconfirmed Accounts to Access Stream Events in vulnerability-lookup5.3 Medium
- freebsd, netbsd netbsdNetBSD hdaudio(4) Driver Privilege Bypass Use-After-Free via HDAUDIO_FGRP_SETCONFIG ioctl7.3 High
- rapid7 velociraptorVelociraptor STACK Type Download Path Bypasses Denied Prefix Check6.5 Medium
- prosolution wp client, unknown prosolution wp client +1 moreProSolution WP Client < 2.0.9 - Subscriber+ proSol_ajaxTablesync and proSol_ajaxClearlog Calls4.3 Medium
- unknown ezoicEzoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes7.5 High
- unknown user access managerUser Access Manager < 2.3.15 - Unauthenticated Restricted Content Disclosure via REST API5.3 Medium
- rapid7 velociraptorVelociraptor collect_client() Permissions Bypass8.2 High
- kovidgoyal calibrecalibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification7.5 High
- baptistearno typebot.ioTypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath8.2 High
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token8.8 High
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreMissing Authorization in MongoDB Sharded Transaction Commit/Abort Handling Leads to Cross-Shard Data Inconsistency5.9 Medium
- mongodb, mongodb server, mongodb, inc. mongodb server +2 moreImproper Authorization in MongoDB Aggregation Framework Allows Read-Only User to Perform Unauthorized Write Operations7.1 High
- openimsdk openim server (open-im-server)OpenIM Server v3.8.3 Missing Authorization on User and Group Enumeration Endpoints7.1 High
- capCap v0.3.1 Broken Access Control via video comment endpoint5.3 Medium
- microsoft azure cyclecloud, azure cyclecloud 8.9.2 +1 moreAzure CycleCloud Information Disclosure Vulnerability6.5 Medium
- microsoft azure cyclecloud, azure cyclecloud 8.9.1 +1 moreAzure CycleCloud Elevation of Privilege Vulnerability8.1 High
- microsoft visual studio code copilot chat extension, github copilot chat +1 moreCoPilot Chat Security Feature Bypass Vulnerability7.1 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Security Feature Bypass Vulnerability6.5 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 moreWindows Defender Firewall Service Security Feature Bypass Vulnerability5.5 Medium
- microsoft visual studio codeVisual Studio Code Remote Code Execution Vulnerability8.8 High
- microsoft dynamics 365 business central 2024, dynamics 365 business central 2025, dynamics 365 business central 2026 +5 more +7 moreMicrosoft Dynamics Business Central Information Disclosure Vulnerability6.5 Medium
- baptistearno typebot.ioTypeBot Google Sheets OAuth callback can create credentials in unauthorized workspaces and modify arbitrary typebots7.1 High
- baptistearno typebot.ioTypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Access7.1 High
- owen2345 camaleoncmsCamaleonCMS 2.9.2 and earlier Missing Authorization via profile Action5.3 Medium
- roskus prospero flow crmIDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion8.6 High
- misp cti-transmutecti-transmute Missing Authorization Allows Reactions to Private Comments5.3 Medium
- misp cti-transmutecti-transmute Evaluation Report Exports Expose Private Comments and Author Information5.3 Medium
- jbhovik ray enterprise translationRay Enterprise Translation <= 1.7.3 - Subscriber+ Language Addition and Deletion4.3 Medium
- jbhovik ray enterprise translationRay Enterprise Translation <= 1.7.3 - Subscriber+ Arbitrary API Token Update6.5 Medium
- sap se businessobjects business intelligence platform (admin tools)Missing Authorization Check in SAP BusinessObjects Business Intelligence Platform (Admin Tools)4.3 Medium
- sap se manufacturing integration and intelligenceMissing Authorization Check in SAP Manufacturing Integration and Intelligence (MII)4.3 Medium
- sap se abap developer toolsPrivilege Escalation vulnerability in SAP ABAP Developer Tools8.8 High
- sap se netweaver and abap platform (change and transport system - customer transport integration wizardMissing Authorization Check in SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard)4.2 Medium
- sap approuter, sap se business ai platform (approuter) +1 moreMultiple vulnerabilities in SAP Business AI Platform (Approuter)5.9 Medium
- sap se manufacturing integration and intelligenceMissing Authorization Check in SAP Manufacturing Integration and Intelligence7.3 High
- sap se manufacturing integration and intelligenceMissing Authorization Check in SAP Manufacturing Integration and Intelligence7.3 High
- Show moreLoading…