CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- mattermost_GitLab Plugin allows cross-channel post injection and phishing via missing channel permission checks in issue API endpoints_3.9 Low
- mattermost, mattermost server +1 moreBoard channel linking without read channel permission validation4.3 Medium
- dolusoft software technologies sonloggerBroken Access Control in Dolusoft Software's Sonlogger7.5 High
- dolusoft software technologies fortiloggerBroken Access Control in Dolusoft Software's Fortilogger7.5 High
- stoatchatstoatchat before 0.15.0 Missing Authorization via Subscribe8.3 High
- themeum kirki – freeform page builder, website builder & customizerKirki <= 6.1.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via 'context' Parameter4.3 Medium
- wptravelengine wp travel engine – tour booking plugin – tour operator softwareWP Travel Engine <= 6.8.4 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'booking_id' Parameter7.5 High
- edgarrojas extra product options builder for woocommerceExtra Product Options Builder for WooCommerce < 1.2.176 - Unauthenticated Customer File Disclosure via getpublicfileupload7.5 High
- shortpixel adaptive images – webp, avif, cdn, image optimizationShortPixel Adaptive Images <= 3.11.5 - Missing Authorization to Authenticated (Subscriber+) Third-Party Plugin Option Modification via 'causer' Parameter4.3 Medium
- solacewp solace extraSolace Extra <= 1.6.0 - Missing Authorization to Unauthenticated Site Content Deletion and Unauthorized Demo Import via action-import-zip AJAX Action9.1 Critical
- extendthemes kubio ai page builderKubio AI Page Builder <= 2.8.5 - Missing Authorization to Authenticated (Contributor+) Front-Page/Menu/Template Configuration Reversion via kubio_restore_front_page AJAX Action4.3 Medium
- wpeverest everest forms – contact form, payment form, quiz, survey & custom form builder with aiEverest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI <= 3.5.2 - Missing Authorization to Authenticated (Delegated+) Arbitrary Plugin Activation via REST API and AJAX…4.3 Medium
- dell ecsECS < 4.3.13 - Contributor+ Arbitrary Post Binding and Global Preset Modification via Dynamic Repeater Handlers4.3 Medium
- linuxnet: sit: require CAP_NET_ADMIN in the device netns for changelink8.8 High
- linuxnet: ip6_vti: require CAP_NET_ADMIN in the device netns for changelink8.8 High
- linuxnet: ip_vti: require CAP_NET_ADMIN in the device netns for changelink8.8 High
- linuxnet: ipip: require CAP_NET_ADMIN in the device netns for changelink8.8 High
- linuxnet: ip6_gre: require CAP_NET_ADMIN in the device netns for changelink8.8 High
- linuxnet: ip6_tunnel: require CAP_NET_ADMIN in the device netns for changelink8.8 High
- linuxieee802154: admin-gate legacy LLSEC dump operations7.1 High
- linuxocteontx2-af: cn10k: restrict VF LMTLINE sharing to its own PF8.8 High
- wpdevart booking calendar, appointment booking systemBooking calendar, Appointment Booking System <= 3.2.36 - Missing Authorization to Unauthenticated Arbitrary Modification via wpdevart_payment AJAX Action5.3 Medium
- akauntingCVE-2026-167728.1 High
- siyuan-note siyuanSiYuan before v3.7.4 Information Disclosure via getRefIDsByFileAnnotationID6.9 Medium
- getgrav grav-plugin-apiGrav API Plugin before 1.0.13 API-key scope cap bypass via ReportsController7.2 High
- getgrav gravGrav before 1.0.13 API Key Scope Bypass via PagesController8.7 High
- getgrav gravGrav before 1.0.13 API-key scope cap bypass via DemoController5.3 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Missing Authorization via refreshBacklink6.9 Medium
- siyuan-note siyuanSiYuan before v3.7.4 Publish-Boundary Bypass via WebSocket9.2 Critical
- francoisjacquet rosariosisfrancoisjacquet RosarioSIS Modules.php cross-site request forgery5.3 Medium
- openchoreoOpenChoreo: Unauthenticated access to data-plane operations via OpenChoreo cluster-gateway management APIs9.6 Critical
- openchoreoOpenChoreo: cluster-gateway internal proxy performs no caller authentication and is not read-only — data-plane Secret disclosure and arbitrary Kubernetes mutation9.0 Critical
- freepbx ucp, sangoma freepbx +1 moreFreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection9.3 Critical
- triggerdotdev trigger.devTrigger.dev: Cross-tenant object store read and write via URL path traversal8.2 High
- triggerdotdev trigger.devTrigger.dev: Cross-project deployment worker registration can modify another project's deployment state9.9 Critical
- elastic kibanaMissing Authorization in Kibana Leading to Information Disclosure6.5 Medium
- elastic kibanaMissing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions8.1 High
- elastic kibanaMissing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions6.5 Medium
- elastic kibanaMissing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification7.1 High
- elastic kibanaMissing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments4.3 Medium
- elastic kibanaMissing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering7.6 High
- elastic kibanaMissing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure6.5 Medium
- gitea open source git serverTeam-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting9.1 Critical
- wpeverest user registrationWordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability5.3 Medium
- instawp connectWordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability5.3 Medium
- revolutbusiness revolut gateway for woocommerceWordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability5.3 Medium
- nexcess givewpWordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability5.3 Medium
- stylemix motorsWordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability6.5 Medium
- acymailing newsletter team anti spam and list cleaner – acycheckerWordPress Anti Spam and list cleaner – AcyChecker plugin <= 2.0.0 - Broken Access Control vulnerability6.3 Medium
- scott paterson contact form 7 – paypal & stripe add-onWordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability6.5 Medium
- Show moreLoading…