CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 moreWindows Kernel Elevation of Privilege Vulnerability7.8 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Remote Code Execution Vulnerability8.8 High
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Elevation of Privilege Vulnerability9.1 Critical
- microsoft exchange server, exchange server subscription edition, exchange server 2016 cumulative update 23 +3 more +5 moreMicrosoft Exchange Server Elevation of Privilege Vulnerability8.1 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 moreWindows Hyper-V Elevation of Privilege Vulnerability7.1 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +16 more +18 moreWindows Modern Device Management (MDM) Elevation of Privilege Vulnerability7.8 High
- microsoft entra id, entra +1 moreEntra ID Elevation of Privilege Vulnerability9.9 Critical
- nvidia triton inference serverNVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse...7.5 High
- bitfrost.io bifrostBifrost Unauthorized Channel Commission Attribution Allows Commission Diversion9.1 Critical
- grokability snipe-itsnipe-it before 8.7.0 Missing Authorization via barcode endpoint5.3 Medium
- craftcms cmsCraft CMS 5.0.0-RC1 before 5.10.12 Permission Escalation via UsersController7.1 High
- ivanti neurons for itsmA Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote...9.9 Critical
- ivanti neurons for itsmA Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote...9.9 Critical
- ivanti neurons for itsmA Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote...9.9 Critical
- aircheng-org iwebshop-5aircheng-org iWebShop-5 update.php index authorization6.9 Medium
- ivanti endpoint manager mobileMissing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and...8.8 High
- commvault, commvault cloud +1 moreCvlaunchd Code Execution7.7 High
- ladela online scheduling and appointment booking system – booklyOnline Scheduling and Appointment Booking System – Bookly <= 27.2 - Missing Authorization to Authenticated (Subscriber+) Limited Arbitrary Plugin Update5.4 Medium
- stellarwp event tickets and registrationEvent Tickets and Registration <= 5.27.4 - Missing Authorization to Unauthenticated Stripe Credentials Update7.5 High
- pixelyoursite edd product catalog feed by pixelyoursiteEDD Product Catalog Feed by PixelYourSite <= 1.0.2 - Authenticated (Subscriber+) Arbitrary Options Deletion via Missing Authorization on 'delete' Parameter7.1 High
- typo3 cmsTYPO3 CMS - Information Disclosure via Backend Localization Wizard5.3 Medium
- typo3 cmsTYPO3 CMS - Missing Authorization in lowlevel commands7.5 High
- unbounce landing pagesWordPress Unbounce Landing Pages plugin <= 1.1.4 - Broken Access Control vulnerability7.1 High
- viszt péter csomagpontok és szállítási címkék woocommerce-hezWordPress Csomagpontok és szállítási címkék WooCommerce-hez plugin < 4.2.8 - Broken Access Control vulnerability7.5 High
- sap se netweaver and abap platformMissing Authorization Check in Application Server ABAP of SAP NetWeaver and ABAP Platform4.3 Medium
- sap se s/4hana (manage bank chains app)Missing Authorization check in SAP S/4HANA (Manage Bank Chains app)4.3 Medium
- laradashboardLara Dashboard before 1.3.2 Missing Authorization in Marketplace Module Install Action8.6 High
- laradashboardLara Dashboard before 1.3.2 Missing Authorization in Post-Builder Media Upload Endpoints5.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any...4.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters...4.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge...6.5 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to...7.7 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation...8.0 High
- light0011 cmslight0011 cms cross-site request forgery5.3 Medium
- mispMISP Event Graph Object Reference Lookup Exposes References from Unauthorized Objects5.3 Medium
- mispMISP Dashboard Organisation Widgets Bypass Organisation-Index Restrictions and Expose Hidden Organisation Data2.3 Low
- masteriyo lms – lms course builder, quizzes & certificatesMasteriyo LMS <= 2.2.0 - Missing Authorization to Unauthenticated Arbitrary Course Progress Deletion5.3 Medium
- rocklobsterinc flamingoFlamingo <= 2.6.2 - Authenticated (Contributor+) Missing Authorization to Unauthorized Tag Information Disclosure via wp.getTerms and ajax-tag-search5.4 Medium
- dell secure connect gateway 5.0 - appliance, secure connect gateway 5.0 - application, secure connect gateway +2 moreDell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior...9.4 Critical
- ilias-elearning e.v. iliasILIAS before 9.23, 10.11, and 11.4 Missing Authorization in Group Object Action Methods5.3 Medium
- mispMISP Dashboard Organisation Picker Exposes Hidden Organisation Metadata to Unauthorized Users2.3 Low
- mispMISP Dashboard Template REST API Exposes Template Owner Email Addresses to Unauthorized Users5.3 Medium
- mispMISP Missing Authorization in Cryptographic Key View Exposes Signing Keys from Protected Events7.1 High
- mispMISP Missing Authorization on Template File Upload Allows Authenticated Disk Exhaustion7.1 High
- mispMISP Freetext Feed Preview Improper Authorization Exposes Restricted Event and Feed Information5.3 Medium
- red hat openshift ai (rhoai), openshift ai 2.25, openshift ai 3.5 +2 moreOdh-dashboard: odh-dashboard: nim credential secret readable by any authenticated user6.5 Medium
- sourcecodester syllabus-aligned learning management & examination systemSourceCodester Syllabus-Aligned Learning Management & Examination System cross-site request forgery5.3 Medium
- projeto-siga sigaprojeto-siga Authentication Flow ExAutenticacaoController.java ExAutenticacaoController.autenticar authorization6.9 Medium
- fluentcmsFluentCMS PermissionManager.cs GetAccessible authorization5.1 Medium
- mispMISP UiBeta Collection View Bypasses Event ACL, Exposing Unauthorized Event Data7.1 High
- Show moreLoading…