CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- mycred new user approveWordPress New User Approve plugin <= 3.2.8 - Broken Access Control vulnerability5.3 Medium
- anders norén kojiWordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability7.5 High
- paulepro2019 eprolo dropshippingWordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability7.1 High
- radiustheme homlistiWordPress Homlisti theme <= 3.1.2 - Broken Access Control vulnerability6.5 Medium
- passionate programmer peter wp data accessWordPress WP Data Access plugin <= 5.5.80 - Broken Access Control vulnerability5.9 Medium
- themegoods altairWordPress Altair theme <= 5.2.2 - Broken Access Control vulnerability6.5 Medium
- anders norén chaplinWordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability7.5 High
- siteground ai agent by sitegroundAI Agent by SiteGround <= 1.2.7 - Missing Authorization to Authenticated (Contributor+) Arbitrary Media Upload via /generate-content REST Endpoint5.3 Medium
- splunk ai toolkitImproper Access Control during Experiment History Deletion through the REST API in Splunk AI Toolkit4.3 Medium
- splunk ai toolkitMissing Authorization in Container and Connection Management through the REST API in Splunk AI Toolkit8.3 High
- splunk soarMissing Authorization through Playbooks in Splunk SOAR2.7 Low
- splunk soarInformation Disclosure through Missing Authorization in the Health REST API in Splunk SOAR4.3 Medium
- splunk, splunk enterprise +1 moreMissing Authorization in Search Head Cluster Member Controls in Splunk Enterprise3.8 Low
- splunk, splunk enterprise +1 moreMissing Authorization for Reloading Token-Signing Keys through the REST API in Splunk Enterprise5.3 Medium
- splunk, splunk enterprise +1 moreImproper Access Control through the REST API in Splunk Enterprise7.1 High
- splunk, splunk enterprise +1 moreSPL Injection through Dashboard Studio Search Query Options in Splunk Enterprise6.7 Medium
- splunk, splunk enterprise +1 moreRemote Code Execution (RCE) through Federated Search in Splunk Enterprise8.8 High
- splunk, splunk enterprise, secure gateway +2 moreMissing Authorization through REST API Endpoints in Splunk Secure Gateway6.5 Medium
- splunk, splunk enterprise +1 moreRisky Command Safeguards Bypass through Splunk Web in Splunk Enterprise6.4 Medium
- splunk, splunk enterprise +1 moreMissing Authorization through REST API Endpoints in the Splunk App for Splunk Observability Cloud7.1 High
- tinacms next-tinacms-azure, next-tinacms-cloudinary, next-tinacms-dos +2 more +4 moreTina: Broken Access Control: arbitrary bucket-key write/delete in `next-tinacms-s3` (and sibling production media adapters)5.4 Medium
- termix-ssh termixTermix: Missing authorization in SSH host credential resolution exposes stored credentials9.6 Critical
- termix-ssh termixTermix: Account Takeover via Global Settings Disclosure8.8 High
- ibm portierisPortieris is vulnerable to Image Policy Bypass via Unvalidated ownerReference8.1 High
- lemmynet lemmyLemmy: Lower-ranked federated moderator can remove higher-ranked moderators6.5 Medium
- lemmynet lemmyLemmy: Blocked users can edit private messages sent before the block5.3 Medium
- leantime json-rpc apiLeantime JSON-RPC API contains a missing authorization vulnerability8.8 High
- xwiki xwiki-platformXWiki Platform: Privilege escalation from edit to script right through Live Data editing7.1 High
- ibm power systems firmware, power system e1080 \(9080-hex\) firmware, power system e1180 \(9080-heu\) firmware +7 more +9 morePower System Missing Authorization6.9 Medium
- ibm power systems firmware, power system e1050 \(9043-mrx\) firmware, power system e1080 \(9080-hex\) firmware +17 more +19 morePower System Missing Authorization8.2 High
- grokability snipe-itSnipe-IT: Maintenance Record Disclosure via Missing Authorization on GET4.3 Medium
- dell command update, command update (dcu) +1 moreDell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability...8.8 High
- dell command update, command update (dcu) +1 moreDell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability...7.3 High
- poxenstudio talebookMyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint8.7 High
- arcadedata arcadedbArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION7.1 High
- phpmyfaqphpMyFAQ before 4.1.7 Missing Authorization via child resources6.9 Medium
- phpmyfaqphpMyFAQ before 4.1.7 Information Disclosure via Admin API5.3 Medium
- phpmyfaqphpMyFAQ before v4.1.6 Registration Bypass via API5.3 Medium
- outanking team outranking plugin optionsWordPress Outranking plugin Options plugin <= 1.1.3 - Broken Access Control vulnerability7.5 High
- magepeople inc. taxi booking manager for woocommerceWordPress Taxi Booking Manager for WooCommerce plugin < 2.0.8 - Broken Access Control vulnerability6.5 Medium
- stitchexpress stitch expressWordPress Stitch Express plugin <= 1.9.0 - Broken Access Control vulnerability7.5 High
- themetechmount truebookerTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Appointment and Payment Record Deletion via update_appointment_booked5.3 Medium
- themetechmount truebookerTrueBooker Appointment Booking < 1.2.7 - Unauthenticated Arbitrary Appointment Status Change via update_appointment_status5.3 Medium
- arraytics eventinEventin < 4.1.21 - Contributor+ User Role and Meta Modification via Speaker Creation2.7 Low
- kings plugins b2bkingWordPress B2BKing plugin <= 5.2.30 - Broken Access Control vulnerability5.4 Medium
- zephyrproject zephyrBroken access-control denial in k_thread_join/k_thread_abort syscall validation in Zephyr kernel6.5 Medium
- ha-china blueprint-studioBlueprint Studio API authorization bypass for non-admin Home Assistant users8.7 High
- frangoteam fuxaFUXA: Unauthenticated guest JWT bypasses Node-RED secure-mode authorization gate (Remote Script Execution)9.2 Critical
- frangoteam fuxaFUXA: Unauthenticated Socket.IO read events6.9 Medium
- pydio cellsPydio Cells 5.0.0 to 5.0.2 - Missing Authorization on the Share Link REST Handler5.3 Medium
- Show moreLoading…