CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- afonso matos arvow ai seo writerWordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerability7.5 High
- wedevs storegrowth: smart sales booster for woocommerce | bogo, upsells, direct checkout, quick view, side cartWordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability7.5 High
- toast plugins internal link optimiserWordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerability6.5 Medium
- smepay smepay: upi gateway for woocommerceWordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability7.5 High
- space codes ai for seoWordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability6.5 Medium
- rockiger reactpressWordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability6.0 Medium
- maruti mohanty wp social avatarWordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability6.5 Medium
- multivendorxWordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability7.5 High
- woompaloompa bitcoin lightning payment gateway for woocommerce (via clink)WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability7.5 High
- amauri wpmobile.appWordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability7.5 High
- webhosting4ugr secure card gateway for epay paycenter (piraeus bank)WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerability6.5 Medium
- themefic hydra bookingWordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability7.3 High
- themefic travelfic toolkitWordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability8.1 High
- acymailing newsletter team smtp newsletterWordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability6.5 Medium
- arraytics wp event solutionWordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability7.1 High
- aonetheme service finder bookingWordPress Service Finder Booking plugin <= 6.2 - Broken Access Control vulnerability6.5 Medium
- themefic tourficWordPress Tourfic plugin <= 2.23.1 - Broken Access Control vulnerability6.5 Medium
- solacewp solace extraWordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability7.1 High
- magepeople inc. taxi booking manager for woocommerceWordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability7.5 High
- postgresqlPostgreSQL logical decoding can dlopen arbitrary file7.2 High
- postgresqlPostgreSQL fails to check type USAGE privilege4.3 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getBookmarkLabels6.9 Medium
- siyuan-note siyuanSiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getOutlineStorage6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Path Traversal via getUniqueFilename6.9 Medium
- ecwid by lightspeed ecommerce shopping cart, unknown ecwid by lightspeed ecommerce shopping cart +1 moreEcwid by Lightspeed Ecommerce Shopping Cart < 7.0.9 - Subscriber+ Store Disconnection via 'ec_disconnect' Action5.4 Medium
- seriousm4x upsnapUpSnap - Unauthenticated Initial-Superuser Takeover Chains to Root RCE via wake_cmd9.8 Critical
- owen2345 camaleoncmsCamaleonCMS Missing Authorization via Plugin Administration Endpoints7.2 High
- scada-lts scadalts, scada-lts +1 moreScadaLTS Authenticated Remote Code Execution9.9 Critical
- canonical lxdCross-project instance move bypasses all project restrictions allowing host command execution9.9 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getFileAnnotation6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Authentication Bypass via Attribute View6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via Block Endpoints6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Authentication Bypass via Graph Endpoints9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getBlockAttrs6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via Unfiltered API6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via Path Resolution6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via renderAttributeView9.2 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getEncryptedNotebookStatus6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Access Control Bypass via Static Routes6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via Embed Block9.2 Critical
- siyuan-note siyuanSiYuan v3.7.4-alpha.1 Information Disclosure via getAttributeViewFieldViews6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getNotebookInfo6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks9.2 Critical
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabMissing Authorization in GitLab7.1 High
- gitlabMissing Authorization in GitLab4.3 Medium
- microsoft ufoMicrosoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure9.4 Critical
- jfrog artifactoryPotential unauthorized artifact access in JFrog Artifactory5.9 Medium
- Show moreLoading…