CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- moghtech komodoKomodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check5.3 Medium
- hatchet-dev hatchetHatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe6.4 Medium
- ido kobelkowsky simple paymentWordPress Simple Payment plugin <= 2.5.2 - Broken Access Control vulnerability7.5 High
- magepeople inc. wpeventlyWordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability4.3 Medium
- magepeople inc. wpeventlyWordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability5.4 Medium
- acf extended extendedWordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability4.3 Medium
- budibase serverBudibase before 3.41.3 Missing Authorization License Management7.2 High
- budibase serverBudibase before 3.41.3 Cross-Application Resource Injection via Missing Authorization8.3 High
- budibase serverBudibase before 3.41.3 Privilege Escalation via User Update API8.6 High
- budibase serverBudibase before 3.41.3 Authorization Bypass via datasources/query8.6 High
- unknown wcfm marketplaceWCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders5.3 Medium
- unknown shared files, shared-files-pro +1 moreShared Files < 1.7.70 - Unauthenticated Limited File Upload5.3 Medium
- ebyte ne2-d11 firmwareEbyte NE2-D11 Missing Authorization8.7 High
- payrange apiMissing Authorization in PayRange API8.7 High
- labring fastgptFastGPT: Unauthenticated WeChat channel hijack and denial of service via shareId-only authorization9.3 Critical
- limesurveyLimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint5.1 Medium
- baserowBaserow before 2.3.1 Unauthenticated Data Disclosure via Discarded Permission Check on Builder Data Sources8.7 High
- flowintelFlowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments5.3 Medium
- wp chill kali formsWordPress Kali Forms plugin <= 2.4.23 - Broken Access Control vulnerability5.3 Medium
- metaphorcreations dittyWordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability5.3 Medium
- wp manage ninja fluentplayer proWordPress FluentPlayer Pro plugin <= 1.3.2 - Broken Access Control vulnerability4.9 Medium
- brainstorm force surefeedback client siteWordPress SureFeedback Client Site plugin <= 1.2.12 - Sensitive Data Exposure vulnerability7.5 High
- weptile mobile app for woocommerceWordPress Mobile App for WooCommerce plugin <= 0.4.62 - Broken Access Control vulnerability8.6 High
- murali push notification for post and buddypressWordPress Push Notification for Post and BuddyPress plugin <= 3.20 - Broken Access Control vulnerability5.4 Medium
- unknown storegrowthStoreGrowth: Smart Sales Booster for WooCommerce < 2.1.2 - Unauthenticated Arbitrary Price Manipulation via BOGO Add-to-Cart7.5 High
- unknown cmpCMP - Coming Soon & Maintenance < 4.1.18 - Unauthenticated Maintenance Mode Disable via cmp_disable_comingsoon_ajax4.8 Medium
- No product listedThe storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any...8.8 High
- weblateorg weblateWeblate: Object-scoped RSS feeds disclose private change history to unauthorized users5.3 Medium
- drupal entity pdf, entity pdf project pdf +1 moreEntity PDF - Moderately critical - Access bypass - SA-CONTRIB-2026-1145.4 Medium
- drupal digital signage frameworkDigital Signage Framework - Moderately critical - Access bypass - SA-CONTRIB-2026-1095.3 Medium
- data field project field, drupal data field +1 moreData field - Moderately critical - Information disclosure - SA-CONTRIB-2026-1085.3 Medium
- midday-ai middayMidday Missing Owner Check on Team Deletion7.2 High
- songquanpeng one-apione-api through 0.6.10 Missing Authorization on URL-Parameter Channel Pinning8.4 High
- senaite senaite.coreSENAITE.CORE: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') and Missing Authorization in senaite.core9.8 Critical
openwisp-ipamPyPIOpenWISP IPAM has broken object-level authorization: ExportSubnetView lets a member of one organization export another organization's subnet and all its IP addresses5.3 Medium- kyvernoKyverno: NamespacedGeneratingPolicy generator.apply() namespace argument unvalidated -- background controller creates RoleBindings in any namespace including kube-system9.6 Critical
- tarscloud tarswebTarsWeb through 3.0.16 Missing Authorization on Patch Deploy, Download and Delete Endpoints8.7 High
- starrocksStarRocks through 4.0.13 Missing Authorization on DROP MATERIALIZED VIEW for Legacy Synchronous Materialized Views7.1 High
- grafana enterprise, oss +1 moreBroken access control in dashboard snapshots6.3 Medium
- themefusion avada (fusion) builder, avada | website builder for wordpress & woocommerce +1 moreAvada <= 7.16 and Fusion Builder <= 3.16 - Unauthenticated Remote Code Execution via Arbitrary File Write9.8 Critical
- arraytics eventinEventin < 4.1.19 - Unauthenticated Order Completion Without Payment via order_token5.3 Medium
- jordy meow ai engineAI Engine 3.4.0 - 3.7.1 - Unauthenticated Arbitrary AI Query Execution via Editor Assistant5.3 Medium
- unknown project managerWP Project Manager 2.1.0 - 4.0.6 - Unauthenticated Subscriber Account Creation via Trello Import Routes7.5 High
- arraytics wpcafeWPCafe < 3.0.18 - Unauthenticated Reservation Approval Bypass via Missing Authorization5.3 Medium
- unknown royal addons for elementorRoyal Elementor Addons < 1.7.1066 - Unauthenticated Taxonomy Term Disclosure5.3 Medium
- arraytics eventinEventin < 4.1.22 - Unauthenticated Unpublished Content Disclosure5.3 Medium
- kimaiKimai before 2.62.0 Authorization Bypass via QuickEntry8.7 High
- growi, inc. growiGROWI before 8.0.2 Missing Authorization on Attachment Retrieval for Unauthenticated Requests8.7 High
- baptistearno typebot.ioTypeBot: Cross-tenant custom-domain removal via unbound `name` in handleDeleteCustomDomain6.4 Medium
- google chromeMissing authorization in InterestGroups in Google Chrome prior to 152.0.7977.65 allowed a remote...6.5 Medium
- Show moreLoading…