CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- netflix lemurLemur: Missing authorization check on POST /certificates/<id>/export for plugins with requires_key = False4.3 Medium
- netflix lemurLemur: Sub-CA creation never checks `AuthorityPermission` on the parent authority6.5 Medium
- netflix lemurLemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API7.7 High
- netflix lemurLemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates8.1 High
- linuxfoundation vitessVitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data5.3 Medium
- geolens-io geolensGeoLens: Cross-dataset authorization bypass discloses private dataset metadata, schema, sample values, table rows, and raster/vector tile data7.5 High
- dell powerstore 1000t, powerstore 1200t, powerstore 3000t +9 more +11 moreDell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a...8.1 High
- goauthentik authentikauthentik: Unauthenticated LDAP directory data disclosure5.3 Medium
- mybbMyBB: Mod CP report resolution missing authorization4.3 Medium
- hmbown codewhaleCodeWhale rlm_eval before 0.8.64 Remote Code Execution8.5 High
- hoppscotchHoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers7.6 High
- wp table builder table builderWordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability4.3 Medium
- wpmonks gravity booster – styles & layouts for gravity formsWordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.0 - Broken Access Control vulnerability5.4 Medium
- rometheme romethemeform for elementorWordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability4.3 Medium
- syed balkhi charitableWordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability7.5 High
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability6.5 Medium
- supsystic ultimate maps by supsysticWordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability7.5 High
- cloudways breezeWordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability8.2 High
- nexcess givewpWordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability6.5 Medium
- nexcess givewpWordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability6.5 Medium
- multivendorxWordPress MultiVendorX plugin <= 5.0.20 - Broken Access Control vulnerability6.5 Medium
- codexpert inc thumbpressWordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability7.5 High
- wbolt.com online contact widgetWordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability7.5 High
- wppool formychatWordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability7.5 High
- fahad mahmood wp sort orderWordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability7.5 High
- arcadedata arcadedbArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database8.7 High
- arcadedata arcadedbArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers2.3 Low
- arcadedata arcadedbArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION7.1 High
- getgrav gravGrav before 2.0.14 Privilege Escalation via Group Access Field9.3 Critical
- getgrav gravGrav API Plugin before 1.0.14 Missing Authorization8.7 High
- getgrav gravGrav API Plugin before 1.0.14 Missing Authorization9.3 Critical
- getgrav gravGrav API Plugin before 1.0.14 Authorization Bypass9.3 Critical
- siyuan-note siyuanSiYuan before v3.7.4 Missing Authorization via block API8.7 High
- greg winiarski wpadverts – classifieds pluginWPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint7.5 High
- sourcecodester onlne examination & learning management systemSourceCodester Onlne Examination & Learning Management System cross-site request forgery5.3 Medium
- mlflowMLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth6.5 Medium
- mlflowMLflow: CreateModelVersion source validation does not check READ permission on referenced run_id7.1 High
- determined-ai determinedDetermined Missing Authorization Check on Generic Task Endpoints7.1 High
- next-terminalNext Terminal Missing Per-Asset Authorization on Portal Endpoints5.3 Medium
- budibaseBudibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`7.1 High
- apostrophecms apostropheApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree6.5 Medium
- zephyrproject zephyrMissing device-pointer validation in flash_copy() syscall allows userspace privilege escalation8.8 High
- quantumnous new-apiNew API: Admin can reset passkeys for same-level or higher-privileged users5.1 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was...8.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read...6.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the...4.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation...8.1 High
- discourseDiscourse: Hidden first-post excerpt is emitted in Q&A schema JSON-LD5.3 Medium
- discourseDiscourse: Shared-draft titles and excerpts leak through group post serialization4.3 Medium
- discourseDiscourse: Review queue exposes flag-related private message excerpts to category group moderators4.3 Medium
- Show moreLoading…