CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- wger-project wgerwger Incomplete Authorization Fix Cross-Tenant Account Deletion6.1 Medium
- diem-project diemdiem-project diem dmConsole actions.class.php executeCommand cross-site request forgery5.3 Medium
- unknown b2bking — ultimate woocommerce b2b and wholesale plugin — wholesale prices, bulk order form & moreB2BKing < 5.2.40 - Unauthenticated B2B Group Assignment and Approval Bypass via Registration Role Selection5.3 Medium
- unknown real estate papiReal Estate Papi <= 1.0.5 - Subscriber+ Plugin Installation4.3 Medium
- getgrav grav-plugin-formGrav Form Plugin before 9.1.22 Cross-Page Form Execution6.9 Medium
- saturday drive ninja forms - save progressNinja Forms - Save Progress <= 3.0.30 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Data Deletion via admin-ajax.php with admin_init Hook4.3 Medium
- scriptsbundle nokri – job board wordpress themeNokri – Job Board WordPress Theme <= 1.6.4 - Missing Authorization to Authenticated (Subscriber +) Privilege Escalation via Account Takeover8.8 High
- stellarwp learndash lmsLearnDash LMS 4.25.0 - 5.1.6 - Unauthenticated Arbitrary Course Enrollment via REST Endpoint5.4 Medium
- pixelfedPixelfed through 0.12.9 Unauthorized Story Access via API5.3 Medium
- convoypanel panelPterodactyl Panel before 1.14.1 Privilege Escalation via Schedule Tasks8.7 High
- sentriz gonicgonic before 0.22.0 Missing Administrator Check on the Subsonic startScan Endpoint5.3 Medium
- metabaseMetabase before 0.63.1 Missing Function-Level Authorization on the Glossary Management API7.1 High
- getarcaneapp arcaneArcane before 2.0.0 Missing Administrator Authorization on the Compose Template Mutation Endpoints7.1 High
- outlawgt custom contact formsCustom Contact Forms <= 7.16 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Deletion and Post Meta Modification via Nested 'fields[].ID' / 'choices[].ID' Parameters4.3 Medium
- unknown embedpressEmbedPress 4.6.0 - 4.6.3 - Contributor+ Google Reviews Modification2.7 Low
- arraytics eventinEventin < 4.1.22 - Contributor+ Site Homepage Hijack and Event Taxonomy Manipulation via Missing Authorization4.9 Medium
- search atlas seo, unknown search atlas seo +1 moreSearch Atlas SEO < 2.6.24 - Subscriber+ Google Service Account Credential Overwrite/Deletion5.4 Medium
- jeff farthing theme my loginTheme My Login <= 7.1.15 - Authenticated (Subscriber+) Missing Authorization to Unauthorized Multisite Subsite Creation via 'gimmeanotherblog' Signup Stage4.3 Medium
- ntop ntopngntopng before 6.7.260717 Missing Authorization on the Host Pool Bulk Delete Handler7.1 High
- ntop ntopngntopng before 6.7.260717 Missing Authorization on the Notification Endpoint and Recipient Delete Handlers7.1 High
- tycon systems tpdin-monitor-web3Tycon Systems TPDIN-Monitor-WEB3 Missing Authorization8.6 High
- sonicwall network security manager (nsm)A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem...9.1 Critical
- potpie-ai potpiepotpie through 2.0.0 Missing Ownership Check via code-changes sync7.1 High
- triggerdotdev trigger.devTrigger.dev before 4.5.2 Unauthorized Environment Access via Run Replay8.4 High
- andrii-kryvoviaz slinkSlink before 1.12.3 Missing Authorization on Image Comment Endpoints6.9 Medium
- gastromenum ticket and qr menu systemMissing Authorization Allows Unauthorized Access to Critical POS Functions in Gastromenum's Gastromenum Ticket and QR Menu System4.3 Medium
- menulux software inc. portalAuthorization Bypass Critical POS Management Functions in Menulux Software's Menulux Portal4.3 Medium
- thorsten phpmyfaqphpMyFAQ before 4.2.0-alpha.2 Missing Authorization via Dashboard API5.3 Medium
- siyuan-note siyuanSiYuan through 3.8.1 Authorization Bypass via getFile7.1 High
- crocoblock jetpopupWordPress JetPopup plugin <= 2.0.20.2 - Broken Access Control vulnerability5.3 Medium
- sourcecodester class and exam timetabling systemSourceCodester Class and Exam Timetabling System session.php authorization6.9 Medium
- unknown ai website builder (github build)AI Website Builder (GitHub build) 1.0.0 - Unauthenticated RCE via Unprotected REST Routes9.8 Critical
- mispMISP Sharing Group Authorization Bypass via Omitted Distribution Parameter7.6 High
- kings plugins marketkingWordPress MarketKing plugin <= 2.1.60 - Broken Access Control vulnerability5.3 Medium
- wc lovers wcfm membershipWordPress WCFM Membership plugin <= 2.11.11 - Broken Access Control vulnerability5.3 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist < 8.9 - Subscriber+ Arbitrary Post Meta Write via atbdp_post_attachment_upload3.1 Low
- unknown wpfunnelsWPFunnels < 3.13.0 - Unauthenticated Arbitrary Recipient Email Sending via wpfnl_shortcode_optin_submission5.3 Medium
- No product listedJeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the...6.5 Medium
- webpros whmcsMissing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS...8.2 High
- microsoft fabricMicrosoft Fabric Elevation of Privilege Vulnerability8.5 High
- themoos essential-moosMOOS essential-moos through 10.0.1 pShare Unauthorized Runtime Route Reconfiguration9.3 Critical
- unopimUnoPim before 2.1.3 Missing Authorization on Integration Management Routes7.1 High
- bluewave-labs checkmateCheckmate through 3.11.0 Missing Authorization on Maintenance Window, Notification, and Check Deletion Routes7.1 High
- elastic kibanaMissing Authorization in Kibana Leading to Unauthorized Cross-Space Write Operations4.3 Medium
- elastic kibanaMissing Authorization in Kibana Fleet Plugin Leading to Cross-Space Agent Data Disclosure4.3 Medium
- geonetwork core-geonetworkUnauthenticated file upload via missing authorization on formatter upload endpoint8.6 High
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.17 - Broken Access Control vulnerability5.3 Medium
- supsystic ultimate maps by supsysticWordPress Ultimate Maps by Supsystic plugin <= 1.5.3 - Broken Access Control vulnerability5.3 Medium
- cascadia web services mountdev ai mcp connector for wordpressWordPress MountDev AI MCP Connector for WordPress plugin <= 1.6.5 - Broken Access Control vulnerability6.5 Medium
- brightvesseldev quick event managerWordPress Quick Event Manager plugin <= 9.17 - Broken Access Control vulnerability7.5 High
- Show moreLoading…