CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeMissing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote...9.1 Critical
- google chromeMissing authorization in Browser in Google Chrome on on Mac prior to 152.0.7977.65 allowed a...4.3 Medium
- google chromeMissing authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...6.5 Medium
- google chromeMissing authorization in BrowserTag in Google Chrome prior to 152.0.7977.65 allowed a remote...6.5 Medium
- google chromeMissing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote...4.3 Medium
- google chromeMissing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote...4.3 Medium
- google chromeMissing authorization in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote...6.5 Medium
- google chromeMissing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote...6.5 Medium
- google chromeMissing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote...3.1 Low
- google chromeMissing authorization in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote...6.5 Medium
- google chromeMissing authorization in Lighthouse in Google Chrome prior to 152.0.7977.65 allowed a remote...3.1 Low
- google chromeMissing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...5.9 Medium
- google chromeMissing authorization in Payments in Google Chrome on on Android prior to 152.0.7977.65 allowed a...4.3 Medium
- google chromeMissing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote...4.3 Medium
- google chromeMissing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed...5.1 Medium
- google chromeMissing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote...4.3 Medium
- google chromeMissing authorization in Viz in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...4.3 Medium
- google chromeMissing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed...7.4 High
- google chromeMissing authorization in Sensor in Google Chrome prior to 152.0.7977.65 allowed a remote attacker...5.3 Medium
- google chromeMissing authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65...5.3 Medium
- google chromeMissing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote...4.3 Medium
- jfrog artifactoryPotential unauthorized access to private Composer repository metadata in JFrog Artifactory6.5 Medium
- jfrog artifactoryPotential unauthorized repository migration in JFrog Artifactory7.6 High
- mervinpraison praisonaiPraisonAI: `--api-key` flag on `praisonai serve` is not properly enforced8.8 High
- mervinpraison praisonai, praisonaiagents +1 morePraisonAI: ast_grep_rewrite rewrites arbitrary files without the @require_approval gate enforced on every sibling mutation tool6.1 Medium
- mervinpraison praisonai, praisonaiagents +1 morepraisonaiagents: AgentServer declares auth_token but never enforces it on any route (CWE-862)8.2 High
- lin-snow ech0Ech0 before 4.5.1 Authorization Bypass via Session Tokens8.7 High
- formulaagile my agile privacy® – cmp, cookie consent & privacy toolsMy Agile Privacy® <= 3.3.6 - Missing Authorization to Unauthenticated Plugin Settings Modification via map_missing_cookie_shield / map_check_consent_mode_status AJAX Actions5.3 Medium
- contrid newslettersNewsletters <= 4.17 - Missing Authorization to Authenticated (Author+) Arbitrary Modification via 'newsletters_mailinglistsroles' POST Parameter4.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.7, single sign-on 7 +2 moreKeycloak-services: keycloak-services: jwt bearer authorization grant does not enforce consentrequired5.9 Medium
- typo3 extension "apache solr for typo3 - enterprise search"Broken Access Control in extension "Apache Solr for TYPO3 - Enterprise Search" (solr)7.6 High
- typo3 extension "event management and registration"Broken Access Control in extension "Event management and registration" (sf_event_mgt)6.3 Medium
- typo3 extension "femanager"Broken Access Control in extension "femanager" (femanager)6.0 Medium
- typo3 extension "telephone directory"Broken Access Control in extension "Telephone Directory" (telephonedirectory)8.7 High
- typo3 extension "industry directory"Broken Access Control in extension "Industry Directory" (yellowpages2)8.8 High
- typo3 extension "club directory"Broken Access Control in extension "Club Directory" (clubdirectory)8.8 High
- typo3 extension "forum"Broken Access Control in extension "Forum" (pforum)8.8 High
- typo3 extension "femanager"Broken Access Control in extension "femanager" (femanager)8.3 High
- checkmk gmbh checkmkMissing authorization for viewing background jobs5.3 Medium
- sky co., ltd. skymec it manager, skysea client view +1 moreA missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this...8.5 High
- roxnor fundengine – donation and crowdfunding platformFundEngine <= 1.8.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'campaign_post' Parameter4.3 Medium
- infused addons infusedwoo proInfusedWoo Pro <= 5.1.18 - Authenticated (Subscriber+) Privilege Escalation via Password Reset Link Disclosure8.8 High
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.4 - Missing Authorization to Authenticated (Editor+) Limited Option Update via 'field_name' Parameter4.4 Medium
- netweblogic events manager – calendar, bookings, tickets, and more!Events Manager <= 7.4.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'status', 'private', and 'private_only' Parameters5.3 Medium
- getgrav gravGrav Flex Objects 1.4.0 through 1.4.7 Authorization Bypass via Shortcode8.3 High
- wpdevteam betterlinks – link shortener, link cloaking, redirects, affiliate link manager & mcpBetterLinks <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Short URL Creation via create_fbs_link AJAX Action4.3 Medium
- ruben garcia automatorwpWordPress AutomatorWP plugin <= 5.8.3 - Broken Access Control vulnerability6.5 Medium
- analogwp style kitsWordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability6.5 Medium
- dolibarrDolibarr < 24.0.0 Expense Report REST API Improper Authorization via Update Endpoint7.1 High
- dolibarrDolibarr < 24.0.0 REST API Improper Authorization via User Update Endpoint7.1 High
- Show moreLoading…