CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.5.3 is missing authorization in the SEO Bulk Update Meta Tags editor2.1 Low
- concrete cms cms, concretecms concrete cms +1 more"In Concrete CMS below 9.5.3, there is Missing authorization in the sitemap page reorder allowing low-privilege users to reorder arbitrary pages "2.1 Low
- concrete cms cms, concretecms concrete cms +1 moreIn Concrete CMS 8.5.3 to 9,5,2, OAuth 2.0 Refresh-Token Grant Bypasses Account Status2.3 Low
- concrete cms cmsMissing Authorization in Concrete CMS versions below 9.5.3 Conversation File Upload Allows File Import Without the Add Message Attachments Permission2.3 Low
- concrete cms cmsIn Concrete CMS 9.2.0 to 9.5.2, Missing Authorization in REST API Users update() and change_password Enables Account Takeover.7.4 High
- ibm business automation workflow containers and traditionalMultiple secuirty vulnerabilies addressed with IBM Business Automation Workflow August 20265.4 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.0.0 through 9.5.2 is vulnerable to missing authorization in the user selector autocomplete endpoint (/ccm/system/user/autocomplete), allowing an unauthenticated attacker to retrieve the…8.7 High
- developers italia design-scuole-wordpress-themeMultiple authorization bypass in WordPress theme design-scuole-wordpress-theme8.7 High
- go-vikunja vikunjaVikunja before 2.6.0 Privilege Escalation via Link Share Hash8.7 High
- flowiseai flowiseFlowise before 3.1.4 Cross-Tenant Authorization Bypass7.6 High
- semaphoreui semaphoreSemaphore UI through 2.19.12 Missing Authorization on GET and HEAD Requests7.1 High
- sosedoff pgwebpgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint8.4 High
- mispMISP Collection Element Add Missing Authorization on Referenced Object UUID7.1 High
- mispMISP: Missing Authorization Check for Event Sharing Group When Distribution Field Is Omitted During Edit7.1 High
- yaoapp yaoYao through v1.0.0-rc22 Missing Authorization via OpenAPI team endpoint5.3 Medium
- No product listedSmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability...4.3 Medium
- No product listed1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job...8.1 High
- arista networks eosAll of the CVEs covered in this advisory apply to affected platforms running Arista EOS with 802.1X authentication and authorization enabled and Access Control Lists (ACLs) configured for per-supplica…2.1 Low
- ibm cloud pak for business automationMultiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for August 2026.5.4 Medium
- apple macosThis issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden...5.5 Medium
- apple macosThe issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS...8.4 High
- apple macosAn access issue was addressed with additional sandbox restrictions on the system pasteboards....5.5 Medium
- apple macosAn authorization issue was addressed with improved entitlement checks. This issue is fixed in...5.3 Medium
- apple macosAn access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS...7.5 High
- apple macosA permissions issue was addressed with improved validation. This issue is fixed in macOS Golden...7.5 High
- apple macosA validation issue existed in the entitlement verification. This issue was addressed with...10.0 Critical
- apple ipados, macos, visionos +3 more +5 moreA logic issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27...4.4 Medium
- apple ipados, macos, safari +3 more +5 moreThis issue was addressed with additional entitlement checks. This issue is fixed in Safari 27,...5.5 Medium
- apple ipados, tvos, visionos +3 more +5 moreThis issue was addressed with additional entitlement checks. This issue is fixed in iOS 27 and...7.5 High
- apple ipados, macos, visionos +2 more +4 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7...7.8 High
- a2aproject a2a-javaa2aproject a2a-java AuthorizationRequestHandlerDecorator.java AuthorizationRequestHandlerDecorator.onListTasks authorization5.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.2.0 to 9.5.2 is vulnerable to stored XSS due to missing authorization in the `PUT /pages/{cID}` endpoint7.2 High
- ibm websphere application serverIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities6.4 Medium
- ibm websphere application serverIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities6.5 Medium
- ibm websphere application serverIBM WebSphere Application Server prior to 9.0.5.29 and 8.5.5.31 are affected by multiple vulnerabilities3.1 Low
- reallysimpleplugins really simple securityReally Simple Security < 9.8.2 Authorization Bypass via profile-page update handler2.3 Low
- themeatelier domain for saleThemeAtelier Domain For Sale < 3.5.2 Missing Authorization via REST API8.8 High
- djangocrm django-crmDjangoCRM django-crm Bulk Case Update bulk_views.py BulkUpdateCasesView authorization5.3 Medium
- apache software foundation storm nimbus, storm ui +1 moreApache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI6.5 Medium
- apache software foundation storm logviewerApache Storm Logviewer: Log Access Controls Not Enforced by Logviewer4.3 Medium
- 201206030 novel-plusnovel-plus through 5.3.3 Missing Authorization on the Admin Book Download Endpoint5.3 Medium
- 201206030 novel-plusnovel-plus through 5.3.3 Missing Authorization on the Admin /sys/user/list Endpoint7.1 High
- apache software foundation syncopeApache Syncope: Incomplete authorization checks for Group members deprovisioning9.8 Critical
- laradashboardlaradashboard through 1.2.2 Missing Authorization via License API7.1 High
- mattermost, mattermost server +1 morePlaybooks run owner channel membership permission bypass7.1 High
- mattermost, mattermost server +1 moreInconsistent authorization checks in Mattermost Boards endpoints4.3 Medium
- mattermost, mattermost server +1 moreBoard archive import bypasses team board creation permissions4.3 Medium
- mispMISP Interactive CLI Shell: Authorization Bypass, Credential Exposure, and Terminal Injection8.4 High
- rabindralamsal inventory-management-systemRizwan17 inventory-management-system process.php cross-site request forgery5.3 Medium
- wxiaoqi spring-cloud-platformwxiaoqi Spring-Cloud-Platform OnlineController.java OnlineController.getOnlineInfo authorization5.3 Medium
- Show moreLoading…