CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- sheikh heera agentimus – ai seo, llms.txt & mcp for ai agentsWordPress Agentimus – AI SEO, llms.txt & MCP for AI Agents plugin <= 1.51.0 - Broken Access Control vulnerability8.1 High
- strategy11 team business directoryWordPress Business Directory plugin <= 6.4.26 - Broken Access Control vulnerability6.5 Medium
- aresit wp compressWordPress WP Compress plugin <= 7.21.28 - Settings Change vulnerability8.2 High
- unknown mail mintWordPress Mail Mint plugin <= 1.31.0 - Broken Access Control vulnerability6.5 Medium
- wpfunnelsWordPress WPFunnels plugin <= 3.12.13 - Broken Access Control vulnerability6.5 Medium
- yith request a quote for woocommerce premiumWordPress YITH Request a Quote for WooCommerce Premium plugin < 4.46.0 - Broken Access Control vulnerability9.8 Critical
- arraytics timeticsWordPress Timetics plugin <= 1.0.61 - Broken Access Control vulnerability6.5 Medium
- 1hive gardens-v2Gardens v2: StreamingEscrow buffer drains to the proposal beneficiary on cancel via the permissionless claim()7.7 High
- ntop ntopngntopng's Missing Authorization in REST API Allows Non-Admin Users to Delete and Rename Arbitrary Tags7.1 High
- mispMISP OnDemand Correlation Engine Missing Access Control Allows Disclosure of Restricted Correlations5.3 Medium
- killbillKill Bill through 0.24.21 Missing Authorization on AdminResource Endpoints7.2 High
- crmebCRMEB through 6.0.0 Missing Authorization via Inert verifyAuth Role Check8.7 High
- oppiaOppia through 3.5.2 Missing Authorization on AdminRoleHandler GET5.3 Medium
- j2commerce.com j2store extension for joomlaJoomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.69.5 Critical
- openedx openedx-platformOpen edX Platform: Insufficient Permission on set_course_mode_price()7.6 High
- drupal webform submissions deleteWebform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-1335.3 Medium
- drupal islandoraIslandora - Moderately critical - Access bypass - SA-CONTRIB-2026-1263.7 Low
- drupal calculate working daysCalculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-1225.3 Medium
- drupal ai translateAI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-1214.6 Medium
- drupal ai (artificial intelligence)AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-1204.6 Medium
- drupal advanced searchAdvanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-1184.2 Medium
- jenkins project xebialabs xl deploy pluginMissing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow...5.4 Medium
- jenkins project pipeline: build step pluginA missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and...5.4 Medium
- jenkins project pipeline: build step pluginA missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and...5.4 Medium
- jenkins script security, jenkins project script security plugin +1 moreJenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission...4.3 Medium
- jenkinsIn Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the...4.2 Medium
- jenkinsA missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers...4.3 Medium
- jenkinsJenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does...3.5 Low
- motorola smart connect applicationThe mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired...7.3 High
- elastic kibanaMissing Authorization in Kibana Leading to Unauthorized Elasticsearch Index Data Exposure5.5 Medium
- unknown auto x lineAuto x LINE <= 1.0.0 – Unauthenticated REST API Endpoints Call8.2 High
- unknown user frontendWP User Frontend < 4.3.11 - Unauthenticated Post Creation via Subscription-Gated Form5.3 Medium
- mamunur rashid classified listingWordPress Classified Listing plugin <= 6.1.3 - Broken Access Control vulnerability5.4 Medium
- dimafreund rentsystWordPress Rentsyst plugin <= 2.1.5 - Broken Access Control vulnerability5.3 Medium
- wp swings ultimate gift cards for woocommerceWordPress Ultimate Gift Cards For WooCommerce plugin <= 3.2.9 - Broken Access Control vulnerability5.3 Medium
- arraytics wp event solutionWordPress WP Event SOlution plugin <= 4.1.22 - Broken Access Control vulnerability6.5 Medium
- kimaiKimai 2.61.0 before 2.63.0 Authentication Bypass via API5.3 Medium
- craftcms cmsCraft CMS 5.7.0 before 5.10.12 Information Disclosure via AssetsController5.3 Medium
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.11 Authentication Bypass via administrateUsers8.7 High
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.11 File Overwrite via assets/replace-file7.1 High
- craftcms cmsCraft CMS before 5.10.11 Authorization Bypass via actionDeleteForSite7.1 High
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.11 Authorization Bypass via actionDuplicate5.3 Medium
- craftcms cmsCraft CMS 5.0.0 through 5.10.10 Authorization Bypass via assets/move-asset7.1 High
- craftcms cmsCraft CMS before 5.10.11 Broken Access Control via element-indexes5.3 Medium
- unknown wc vendorsWC Vendors < 2.7.2.1 - Vendor+ Cross-Vendor Order Shipment Status Change4.3 Medium
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.277 - Author+ Term Metadata Update and Cross-Object Post Title Overwrite via updateMetaBulk2.7 Low
- multivendorxMultiVendorX 5.0.13 - 5.0.14 - Unauthenticated Vendor PII and Payout Data Disclosure via stores REST Endpoint5.3 Medium
- unknown booking for appointments and events calendarAmelia < 2.4.9 - Unauthenticated Post-Booking Action Trigger6.5 Medium
- dplugins devkit proDevKit Pro <= 2.3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Theme Installation / Remote Code Execution via 'qqfile' Parameter8.8 High
- mythicalltd featherpanelFeatherPanel before 1.3.7.10 Privilege Escalation via Subuser Permission Update8.7 High
- Show moreLoading…