CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeMissing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote...5.3 Medium
- google chromeMissing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote...3.1 Low
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization…6.4 Medium
- elastic kibanaMissing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation4.3 Medium
- elastic kibanaMissing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata4.3 Medium
- elastic elasticsearchMissing Authorization in Elasticsearch Leading to Information Disclosure5.4 Medium
- elastic kibanaMissing Authorization in Kibana Leading to Information Disclosure6.5 Medium
- growi, inc. growiGROWI through 8.0.2 Missing Authorization on apiv3 Attachment Retrieval7.1 High
- iqonic design kivicareKiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure5.3 Medium
- cozythemes cozy blocks – page builder for gutenberg editor & fse with 700+ patterns, 58 blocks & templatesCozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter5.3 Medium
- ash-project ashAsh.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records5.9 Medium
- google androidIn multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing...3.1 Low
- google androidIn writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the...3.3 Low
- google androidIn getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location...3.3 Low
- google androidIn onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to...3.3 Low
- google androidIn Bootloader, there is a possible escalation of privilege due to a missing permission check....6.7 Medium
- google androidIn isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet...3.3 Low
- suluSulu: Fix authorization bypass when creating preview links5.3 Medium
- devtron-labs devtronDevtron through 2.2.0 Missing Authorization via webhook API token endpoint8.7 High
- getkirby kirbyKirby: File upload permissions are not checked during processing of chunk data7.1 High
- saad iqbal post smtpWordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability5.4 Medium
- easycorp easyadminbundleEasyAdmin custom-action dispatcher bypasses access_control on other routes8.1 High
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability6.5 Medium
- ownerrez apiWordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability6.3 Medium
- techjewel fluent forms pro add on packWordPress Fluent Forms Pro Add On Pack plugin <= 6.2.12 - Broken Access Control vulnerability7.5 High
- xibosignage xibo-cmsXibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence4.3 Medium
- mcphubMCPHub: Missing Authorization on `PUT /api/system-config` Lets Any Non-Admin Rewrite Global Security Configuration8.8 High
- mcphubMCPHub: Missing Authorization on Built-in Prompt & Resource CRUD (Unauthorized Tampering of Globally-Served Templates/Resources)7.1 High
- mcphubMCPHub: Authenticated non-admin user achieves RCE via POST /api/servers (missing authorization on stdio command/args)9.9 Critical
- ebyte na111-m firmwareEbyte NA111-M Missing Authorization8.7 High
- tbc technology inc. kitlogisticInformation Disclosure in TBC Technology's KitLogistic7.5 High
- john james jacoby bbpressWordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability5.3 Medium
- dataeaseDataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints5.3 Medium
- tooljetToolJet before v3.16.208 Cross-Organization Data Read via Database Routes8.2 High
- unknown 爱采集数据采集和发布插件Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch5.3 Medium
- siyuan-note siyuanSiYuan before v3.8.1 Missing Authorization via /history and /repo/diff6.9 Medium
- wger-project wgerwger-project wger Password Reset gym.py reset_user_password cross-site request forgery5.3 Medium
- dolibarrDolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint5.3 Medium
- iflytek astron-agentiFlytek astron-agent through 1.1.1 Workflow Hijacking via Missing Ownership Check8.6 High
- shabti frontend admin by dynamiappsFrontend Admin by DynamiApps < 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion4.3 Medium
- unknown catfolders document gallery proCatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all5.3 Medium
- mstore api, unknown mstore api +1 moreMStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet6.5 Medium
- mstore api, unknown mstore api +1 moreMStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion6.5 Medium
- chillzhuang springbladeSpringBlade 2.7.3 < 5.0.0 Privilege Escalation via Exposed Feign Endpoint8.6 High
- yamcsYamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration4.3 Medium
- yamcsYamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce6.5 Medium
- yamcsYamcs : Multiple Missing Function Level Access Control vulnerabilities in Yamcs Core API8.8 High
- go-vikunja vikunjaVikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=04.3 Medium
- hyperdxio hyperdxHyperDX Team Management Operations Missing Role-Based Access Control7.2 High
- mastra-ai mastraMastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset7.1 High
- Show moreLoading…