CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- wxiaoqi spring-cloud-platformwxiaoqi Spring-Cloud-Platform Permission Service PermissionService.java PermissionService.checkUserPermission authorization5.3 Medium
- mdjm event management, unknown mdjm event management, mobile events manager +2 moreMDJM Event Management and Mobile Events Manager - Unauthenticated Arbitrary Post Deletion7.5 High
- unknown cryptopayment gatewayCryptoPayment Gateway 1.2.1 - 1.2.2 - Unauthenticated Arbitrary File Deletion and Settings Update via Unguarded AJAX Router10.0 Critical
- unknown geniewordsGenieWords 1.5.27 - 1.5.34 - Unauthenticated Stored XSS and Configuration Overwrite8.8 High
- kevoreilly capev2CAPEv2 through commit 471ee4b REST API Task Endpoints Missing Ownership Check8.6 High
- chengdu qilu technology ludashiChengdu Qilu Technology Ludashi Message Dispatch ProtectFilter64.sys MessageNotifyCallback authorization4.6 Medium
- wwbn avideoWWBN AVideo Missing Authorization via video_from_program API6.9 Medium
- wwbn avideoWWBN AVideo Missing Authorization via getBookmarks.json.php6.9 Medium
- wwbn avideoWWBN AVideo Missing Authorization via like.json.php5.3 Medium
- wwbn avideoWWBN AVideo Missing Authorization via commentAddNew.json.php5.3 Medium
- wwbn avideoWWBN AVideo Missing Authorization via videoAddViewCount.json.php5.3 Medium
- wwbn avideoWWBN AVideo Missing Authorization via playListAddVideo.json.php5.3 Medium
- wwbn avideoWWBN AVideo Scheduler sendEmail Missing Authorization via Token8.8 High
- flowiseai flowiseFlowise before 3.1.4 Denial of Service via text-to-speech/abort6.3 Medium
- flowiseai flowiseFlowise before 3.1.4 Broken Access Control via organizationuser6.0 Medium
- designthemes dt lms – elearning, wordpress lms pluginDT LMS <= 1.1 - Missing Authorization to Unauthenticated Arbitrary Plugin Settings Modification via Multiple AJAX Actions5.3 Medium
- unknown product xml feed manager for woocommerceProduct XML Feed Manager for WooCommerce < 3.1.1 - Contributor+ Arbitrary Product Deletion via Shortcode4.9 Medium
- unknown sprout invoicesClient Invoicing by Sprout Invoices < 20.8.16 - Subscriber+ Private Note Overwrite via si_edit_private_note4.3 Medium
- cisa malcolmMissing authorization in Malcolm5.3 Medium
- cisa malcolmMissing Authorization in Malcolm7.1 High
- shopperdotcom shopperShopper: Missing authorization on product removal actions in CollectionProducts component8.1 High
- shopperdotcom shopperShopper: Incomplete fix for GHSA-h4mp-g9c6-xwph: Media sub-form store() still lacks authorization6.5 Medium
- shopperdotcom shopperShopper: Unauthorized inventory stock manipulation via unlocked variant property in VariantStock component8.1 High
- shopperdotcom shopperShopper: read-only team permissions allow administrator creation and permission escalation8.8 High
- shopperdotcom shopperShopper: Missing function-level authorization on Settings tax/zone/shipping Livewire components allows a low-privileged user to delete commerce configuration5.4 Medium
- shopperdotcom shopperShopper: Authorization bypass in Filament bulk actions allows browse-only staff to mass-delete attributes/tags and mass-toggle visibility of brands/categories/suppliers8.1 High
- t-mart mouseholeMousehole: Unauthenticated HTTP/WebSocket boundary exposes and mutates MAM cookie state6.9 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.2.0 to 9.5.2 is vulnerable to Missing authorization in the Concrete CMS Area REST API block-create path letting an editor reference files outside their file-manager permissions5.1 Medium
- concrete cms cms, concretecms concrete cms +1 moreIncorrect Authorization in the Concrete CMS Express Entries Dashboard below version 9.5.3 Allows Entry Creation in an Unauthorized Object5.1 Medium
- concrete cms cms, concretecms concrete cms +1 moreIn Concrete CMS below 9.5.3, Page Type update omits object-level authorization5.1 Medium
- liton arefin master addons for elementorWordPress Master Addons for Elementor plugin <= 3.2.2 - Broken Access Control vulnerability7.1 High
- john james jacoby bbpressWordPress bbPress plugin <= 2.6.14 - Sensitive Data Exposure vulnerability5.3 Medium
- wpdesk flexible quantity – measurement price calculator for woocommerceWordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.21 - Broken Access Control vulnerability5.3 Medium
- arraytics bookticsWordPress Booktics plugin <= 1.0.24 - Broken Access Control vulnerability5.3 Medium
- masteriyo - lmsWordPress Masteriyo - LMS plugin <= 3.4.0 - Broken Access Control vulnerability5.3 Medium
- wp chill passsterWordPress Passster plugin <= 4.3.13 - Broken Access Control vulnerability5.3 Medium
- magepeopleteam deposits and partial payments for woocommerceWordPress Deposits and Partial Payments for WooCommerce plugin <= 3.1.0 - Broken Access Control vulnerability5.3 Medium
- concrete cms cmsConcrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the orphaned-block alias route, allowing an authenticated editor to disclose and force-delete arbitrary blocks5.9 Medium
- concrete cms cmsConcrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization6.0 Medium
- concrete cms cmsMissing Authorization in Concrete CMS 9.2.0 to 9.5.2 REST API Groups List Endpoint Allows Authenticated Users to Enumerate All Groups6.0 Medium
- spipSPIP < 4.4.18 Missing Authorization via ecrire/action/9.3 Critical
- tubitak bilgem software technologies research institute pardus aboutInformation Disclosure in TUBITAK BILGEM's Pardus About5.5 Medium
- moxi624 mogublogMoguBlog through 6.2 Missing Authorization on the Admin getPictureSortByUid Endpoint5.3 Medium
- st engineering idirect 3315-series terminals, 9-series terminals, evolution iq‑series terminals +2 moreST Engineering iDirect iQ-Series Terminals Missing Authorization9.4 Critical
- buddypressBuddyPress <= 14.3.3 - Insecure Direct Object Reference to Notifications Deletion4.3 Medium
- unknown backwpupBackWPup 5.2.2 - 5.7.4 - BackWPup Jobs Checker+ Database Backup Exfiltration via Missing Authorization on Job REST Routes5.5 Medium
- themeisle visualizerVisualizer < 4.0.6 - Contributor+ Arbitrary Chart Deletion via deleteChart2.7 Low
- arraytics booktics – appointment booking calendar for service businessesBooktics – Booking Calendar for Appointments and Service Businesses <= 1.0.23 - Missing Authorization5.3 Medium
- edgarrojas pdf builder for woocommerce. create invoices,packing slips and moreWoo PDF Invoice Builder <= 2.0.8 - Authenticated (Subscriber+) Insecure Direct Object Reference to Sensitive Order Information Disclosure6.5 Medium
- concrete cms cmsConcrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) in the Calendar block's frontend event dialog (/ccm/calendar/view_event/{bID}/{occurrence_id}).6.3 Medium
- Show moreLoading…