CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- ibm langflow oss, langflow +1 moreLangflow is vulnerable to arbitrary code execution due to multiple incomplete code security controls and missing execution guards8.8 High
- openstack horizonOpenNMS missing authorization on /api/v2 PATCH endpoints allows unauthenticated configuration changes8.2 High
- anchorcms anchor cmsAnchor CMS through 0.12.7 Privilege Escalation via Missing Authorization on Admin User-Management Endpoints8.7 High
- ni systemlink, systemlink server +1 moreImproper Access Controls in NI SystemLink8.6 High
- appflowy-io appflowy-cloudAppFlowy-Cloud 0.7.2 through 0.9.64 Missing Workspace Authorization on Bulk Publish Endpoint7.1 High
- epsiloncool wp fast total searchWordPress WP Fast Total Search plugin <= 1.82.284 - Broken Access Control vulnerability7.5 High
- udx usability dynamics wp-statelessWordPress WP-Stateless plugin <= 4.4.1 - Settings Change vulnerability8.1 High
- wp swings return refund and exchange for woocommerceWordPress Return Refund and Exchange For WooCommerce plugin <= 4.6.4 - Broken Access Control vulnerability7.5 High
- mlfactory shirt product designer for woocommerceWordPress Shirt Product Designer for WooCommerce plugin 1.0.4 - Broken Access Control vulnerability7.5 High
- dimitri grassi salon booking systemWordPress Salon booking system plugin <= 10.31.9 - Broken Access Control vulnerability6.5 Medium
- idx broker impress for idx brokerWordPress IMPress for IDX Broker plugin <= 3.3.0 - Broken Access Control vulnerability6.3 Medium
- villatheme thank you page customizer for woocommerceWordPress Thank You Page Customizer for WooCommerce plugin <= 1.2.2 - Broken Access Control vulnerability7.5 High
- themekraft buddyformsWordPress BuddyForms plugin <= 2.9.0 - Broken Access Control vulnerability6.5 Medium
- robokassa payment gateway for woocommerceWordPress Robokassa payment gateway for Woocommerce plugin <= 1.8.9 - Broken Access Control vulnerability6.5 Medium
- mispMISP Event Template Instantiation Bypasses Sharing Group and Tagging Authorization7.1 High
- geovision inc. gv-lpc2011/lpc2211GV-LPC2011/LPC2211 - SSVR Guest Configuration Overwrite and Administrative Credential Takeover8.8 High
- geovision inc. gv-lpc2011/lpc2211GV-LPC2011/LPC2211 - SSVR Guest Firmware-Mode Pre-Validation Service Teardown Denial of Service6.5 Medium
- geovision inc. gv-lpc2011/lpc2211GV-LPC2011/LPC2211 - SSVR Guest Configuration and Credential Disclosure6.5 Medium
- unknown zipmoney(zip co) payments plugin for woocommercezipMoney(Zip Co) Payments Plugin for WooCommerce < 2.4.0 - Unauthenticated Arbitrary Option Deletion9.1 Critical
- unknown miniorange 2faminiOrange 2FA (Free & Pro) - Unauthenticated Arbitrary Option Deletion via Out-of-Band Email Link Validator10.0 Critical
- rubenw bulk password resetBulk Password Reset <= 1.3.3 - Authenticated (Subscriber+) Arbitrary Password Reset8.0 High
- vsourz1td advanced contact form 7 dbAdvanced Contact form 7 DB <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id'4.3 Medium
- builderall for wordpress, unknown builderall for wordpress +1 moreBuilderall for WordPress <= 3.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'ba_cheetah_data[post_id]' Parameter4.3 Medium
- identrailidentrail: Cross-tenant GitHub installation binding without ownership verification8.5 High
- openwebui open webui, open-webui +1 moreOpen WebUI: Any authenticated user can inject chats into another user's folder via chat completions4.3 Medium
- openwebui open webui, open-webui +1 moreOpen WebUI: Channel members can overwrite another member's message via the chat completions endpoint4.3 Medium
- drupal ultimate table fieldUltimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-1534.3 Medium
- drupal taxonomy term glossaryTaxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-1524.3 Medium
- drupal saml sso - service providerSAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-1416.5 Medium
- sage ar automationCash Collect contains an improper authorization vulnerability in the Sage AR Automation API....9.0 Critical
- grokability snipe-itSnipe-IT 8.6.3 Authorization Bypass via Asset Update Endpoint7.1 High
- grokability snipe-itSnipe-IT 8.6.4 before 8.7.0 Permission Bypass via assigned components7.1 High
- grokability snipe-itSnipe-IT before 8.7.0 Authentication Bypass via API Middleware8.6 High
- grokability snipe-itSnipe-IT before 8.7.0 Missing Authorization via asset-history CSV importer7.1 High
- grokability snipe-itSnipe-IT before 8.7.0 Information Disclosure via Custom Fields7.1 High
- apache nutchApache Nutch: Unauthenticated reflection-based job execution in Nutch Server (Nutch REST API)9.8 Critical
- apache nutchApache Nutch: Unauthenticated forced shutdown and job interruption in Nutch Server (Nutch REST API)9.1 Critical
- apache nutchApache Nutch: Unauthenticated remote code execution (RCE) via JEXL injection in Nutch Server (Nutch REST API)8.8 High
- alchemycms alchemy cmsAlchemyCMS before 7.4.16 and 8.x before 8.3.6 Missing Authorization on GET /api/nodes6.9 Medium
- stylemix checkout custom fields builder for woocommerceCheckout Custom Fields Builder for WooCommerce <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Installation via 'plugin' Parameter4.3 Medium
- unknown wplp cookie consentWPLP Cookie Consent < 4.4.2 - Subscriber+ Missing Authorization via Multiple Settings AJAX Actions5.4 Medium
- unknown wplp cookie consentWPLP Cookie Consent 4.0.2 - 4.4.1 - Subscriber+ Cookie Scan Schedule Disclosure via gcc_get_schedule_scan4.3 Medium
- unknown masteriyo lmsMasteriyo LMS 1.3.1 - 2.3.3 - Unauthenticated Course Enrollment Disclosure5.3 Medium
- unknown wplp cookie consentWPLP Cookie Consent < 4.4.2 - Subscriber+ Banner Settings Overwrite and A/B Test Data Reset4.3 Medium
- unknown wplp cookie consentWPLP Cookie Consent < 4.4.2 - Unauthenticated IAB TCF Consent Option Update5.3 Medium
- unknown ultimate gift cards for woocommerceUltimate Gift Cards for WooCommerce < 3.2.10 - Subscriber+ Gift Card Theft and Destruction via Unauthorized Redemption6.5 Medium
- unknown wp travel, wp travel travel +1 moreWP Travel < 12.0.2 - Unauthenticated Arbitrary Booking Cancellation5.3 Medium
- ghera74 ilghera reviso exporter for woocommerceilGhera Reviso Exporter for WooCommerce <= 1.2.3 - Missing Authorization to Authenticated (Subscriber+) Agreement Grant Token Deletion via disconnect_callback Function4.3 Medium
- brechtvds wp recipe makerWP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode4.3 Medium
- getwpfunnels wpfunnels – funnel builder for woocommerce with checkout & one click upsellWPFunnels <= 3.12.13 - Missing Authorization to Unauthenticated Arbitrary Product Price Manipulation via 'wpfnl_load_payment' AJAX Action5.3 Medium
- Show moreLoading…