CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- dolibarrDolibarr < 24.0.0 Members REST API Improper Authorization via Password Reset8.6 High
- draytek corporation vigorswitch fx2120, vigorswitch g1280, vigorswitch g1282 +25 more +27 moreDrayTek VigorSwitch Multiple Models Missing Authorization in Syslog Functions8.8 High
- tim solutions flowTIM Flow < 26.0.6 Unauthorized SQL Query Execution via Dashboard Export Endpoint7.1 High
- ransomlookRansomLook Missing Authorization in Web Configuration Editor Allows Application Configuration Modification9.4 Critical
- ransomlookPrivate Group and Market Posts Disclosed Through Public Notification Channels in RansomLook8.7 High
- nektos actact 0.2.81 through 0.2.89 Missing Authorization in the Artifacts V4 Backend8.7 High
- ransomlookRansomLook Missing Authorization Allows Disclosure of Private Group and Ransom Note Data9.2 Critical
- ransomlookRansomLook Unauthenticated Database Export Exposes Private Data9.2 Critical
- roskus prospero flow crmIDOR and missing authorization in Prospero Flow CRM supplier API allows cross-tenant read and modification9.3 Critical
- themebing prolancer elementWordPress ProLancer Element plugin <= 1.4.8 - Broken Access Control vulnerability7.1 High
- notification master – real-time wordpress notifications with email, sms, webhooks & moreWordPress Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More plugin <= 1.7.1 - Broken Access Control vulnerability7.5 High
- wp manageninja llc fluent support proWordPress Fluent Support Pro plugin <= 2.3.1 - Broken Access Control vulnerability5.4 Medium
- magepeople inc. booking and rental managerWordPress Booking and Rental Manager plugin <= 2.7.5 - Broken Access Control vulnerability5.3 Medium
- ateeq rafeeq repairbuddyWordPress RepairBuddy plugin <= 4.1223 - Broken Access Control vulnerability5.3 Medium
- rapid7 velociraptorVelociraptor Analyst overwrites live built-in artifacts through verify()8.9 High
- bruno cavalcante ghostwriterGhostwriter through 7.2.6 Missing Authorization on Report Template Lint Endpoints5.3 Medium
- unknown woocommerce bookings, woocommerce bookings +1 moreWooCommerce Bookings < 3.9.0 - Subscriber+ Draft Bookable Product Creation via Missing Authorization4.3 Medium
- No product listedPunk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them9.1 Critical
- wpsoul greenshift – animation and page builder blocksGreenshift <= 12.8.9 - Authenticated (Contributor+) Theme Settings Modification via 'gspb_update_global_wp_settings'4.3 Medium
- metaphor creations post duplicatorPost Duplicator <= 3.0.11 - Missing Authorization to Authenticated (Contributor+) Post Duplication with Arbitrary Author Attribution4.3 Medium
- google cloud application integrationMissing Authorization in Application Integration QueryEngineTask9.3 Critical
- rubengc automatorwp – automator plugin for no-code automations, webhooks & custom integrations in wordpressAutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_campaign_monitor_get_lists AJAX Action4.3 Medium
- rubengc automatorwp – automator plugin for no-code automations, webhooks & custom integrations in wordpressAutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via automatorwp_convertkit_get_forms AJAX Action4.3 Medium
- themifyme themify builderThemify Builder <= 7.8.0 - Missing Authorization to Unauthenticated Arbitrary Builder Data Modification via 'tb_update_old_data' AJAX Action5.3 Medium
- combodo itopCombodo iTop: Improper access control in ajax.render.php and ajax.document.php6.5 Medium
- combodo itopCombodo iTop: Object can be locked by a user without write permissions4.3 Medium
- combodo itopCombodo iTop: Unauthorized access to object information via search operation8.8 High
- puemos craftplanCraftplan < 0.5.1 Broken Access Control Information Disclosure via Settings API8.2 High
- jet admin adminJet Admin tenant isolation failure9.2 Critical
- paperclipai paperclipPaperclip before 0.3.1 Remote Code Execution via DNS Rebinding9.4 Critical
- lxc incusIncus has a project restriction bypass via instance migration config override9.9 Critical
- reconmapReconmap Report Preview Endpoint Is Marked AllowAnonymous, Exposing Every Project and Client Organisation Without Authentication8.7 High
- apache cloudstackApache CloudStack: Improper access control in Userdata reference APIs7.5 High
- apache cloudstackApache CloudStack: Authorization issue with listHostTags for domain admins2.7 Low
- dev@tamara.co tamara checkoutTamara Checkout <= 1.9.9.20 - Unauthenticated Order Status Manipulation5.3 Medium
- sourcecodester dynamic input field generator using html, css, and phpSourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP cross-site request forgery5.3 Medium
- evershopcommerce evershopEverShop Missing Authorization on PATCH /api/customers/:id Allows Unauthenticated Account Takeover9.3 Critical
- mauriceboe trekTREK IDOR: any authenticated user can read another user's journey share token (full journey leak)6.5 Medium
- nosleepNoSleep 1.5.1 - Unauthorized disclosure of root-owned files through privileged XPC helper6.9 Medium
- wintercms winterWinter CMS: ImportExportController AJAX handlers bypass granular import/export permission gate8.3 High
- fleetdm fleetFleet before 4.87.0 Unauthenticated iOS App Download via Predictable URLs6.9 Medium
- laravel-backpack crudbackpack/crud: HasMany/MorphMany relation fields allow cross-tenant record re-parenting (IDOR) via attachManyRelation6.5 Medium
- tektoncd pipelines-as-codePipelines-as-Code: Unscoped GitHub App installation token allows unauthorized access to private repositories via remote task resolution6.5 Medium
- elated-themes frappeFrappe: Missing authorization in toggle_like and mark_as_seen5.3 Medium
- django cms association django-cmsdjango CMS: Broken access control in page *Duplicate* allows reading the content of any page (cross-site / restriction bypass)6.5 Medium
- django cms association django-cmsdjango CMS: Missing authorization in `render_object_structure` discloses non-PageContent placeholder structure to low-privileged staff4.3 Medium
- django cms association django-cmsdjango CMS: Structure endpoint bypasses page-view permission6.5 Medium
- opf openprojectOpenProject: Inplace-edit dialog exposes comments from hidden admin-only project custom fields5.3 Medium
- atutorMissing Authorization Check in ATutor5.3 Medium
- labredescefetrj wegiaWeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha8.6 High
- Show moreLoading…