CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- awesomesupport awesome support – wordpress helpdesk & support pluginAwesome Support <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary User Denial via 'user_id' Parameter4.3 Medium
- arraytics eventin – event calendar, tickets, registration, booking & woocommerceEventin <= 4.1.17 - Missing Authorization to Authenticated (Subscriber+) Notification Flow Management via notification-flow REST API Endpoint5.4 Medium
- arraytics eventin – event calendar, tickets, registration, booking & woocommerceEventin <= 4.1.22 - Missing Authorization to Unauthenticated Arbitrary Order Creation and Status Manipulation via 'status' Parameter5.3 Medium
- tanium complyTanium addressed an improper access controls vulnerability in Comply.8.1 High
- tanium complyTanium addressed an improper access controls vulnerability in Comply.6.5 Medium
- tanium complyTanium addressed an improper access controls vulnerability in Comply.5.4 Medium
- tanium complyTanium addressed an improper access controls vulnerability in Comply.7.1 High
- tanium complyTanium addressed an improper access controls vulnerability in Comply.5.4 Medium
- google chromeMissing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to...6.5 Medium
- google chromeMissing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote...5.3 Medium
- google chromeMissing authorization in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...4.3 Medium
- google chromeMissing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a...6.5 Medium
- google chromeMissing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote...4.3 Medium
- google chromeMissing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote...6.5 Medium
- google chromeMissing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote...6.5 Medium
- google chromeMissing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote...7.5 High
- google chromeMissing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...4.3 Medium
- google chromeMissing authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote...6.5 Medium
- google chromeMissing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote...4.3 Medium
- google chromeMissing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a...9.8 Critical
- google chromeMissing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote...4.3 Medium
- google chromeMissing authorization in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote...6.5 Medium
- google chromeMissing authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote...6.5 Medium
- google chromeMissing authorization in Actor in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...6.5 Medium
- google chromeMissing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote...6.5 Medium
- google chromeMissing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote...8.1 High
- google chromeMissing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010.36 allowed a...4.3 Medium
- google chromeMissing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote...8.1 High
- google chromeMissing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote...3.1 Low
- google chromeMissing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote...8.3 High
- google chromeMissing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...3.1 Low
- google chromeMissing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010...5.5 Medium
- google chromeMissing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...3.1 Low
- google chromeMissing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a remote attacker...8.8 High
- mageplaza gdprMissing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza...7.5 High
- concrete cms cmsConcrete CMS before 9.5.3 is vulnerable to Missing Authorization in Stack/Container Sub-Block Asset Registration6.3 Medium
- n8nn8n: Anonymous Approval-Gate Bypass via Reused resumeToken over the Chat WebSocket6.3 Medium
- n8nn8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints5.1 Medium
- n8nn8n: Log Streaming Event Destinations Decrypt Generic-Auth Credentials Without Ownership Check5.9 Medium
- n8nn8n: Cross-User Active Workflow ID and Lifecycle Event Disclosure via Missing userId Filter5.3 Medium
- n8nn8n: Agent Workflow Tool Bypasses Sub-Workflow Caller Policy5.3 Medium
- waves audio ltd. centralWaves Central local privilege escalation via Improper XPC Client Authentication in macOS8.4 High
- connectwise screenconnectScreenConnect Client: Guest-to-Host File Execution via File-Transfer Actions9.9 Critical
- google androidIn multiple functions of NfcService.java, there is a possible silent payment session hijacking...7.8 High
- aveva pipeline integrity monitorAVEVA Pipeline Integrity Monitor Missing Authorization6.9 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreData Sharing Service Client Elevation of Privilege Vulnerability7.8 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Remote Code Execution Vulnerability8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +23 more +25 moreWindows Remote Access Connection Manager Tampering Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +24 more +26 moreMicrosoft Windows Search Component Tampering Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +20 more +22 moreWindows SMB Server Information Disclosure Vulnerability5.5 Medium
- Show moreLoading…