CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- signozSigNoz 0.88.0 through 0.141.0 - Missing Authentication on Trace Funnel Analytics Endpoints8.8 High
- concrete cms cms, concretecms concrete cms +1 moreMissing Authorization in legacy Express entries search endpoint allows disclosure of Express entry data6.3 Medium
- changeweder crmChangeWeDer crm top.upstudy.crm.controller.UserController UserController.java index authorization5.3 Medium
- concrete cms cms, concretecms concrete cms +1 moreMissing authorization in the REST API user creation endpoint in Concrete CMS 9.2.0 through 9.5.3 allows arbitrary account creation2.1 Low
- concrete cms cms, concretecms concrete cms +1 moreCross-Board IDOR in the Board Custom Slot Preview in Concrete CMS 9.0.0 through 9.5.3 Discloses Restricted Page Summary Fields5.3 Medium
- stylefeng gunsGuns through 8.3.5 Improper Access Control via SysNoticeController7.1 High
- stylefeng gunsGuns through 8.3.5 Information Disclosure via Missing Permission Check7.1 High
- red hat build of keycloak 26.4, build of keycloak 26.4.16, build of keycloak 26.6 +4 more +6 moreKeycloak-services: keycloak-services: privilege escalation via impersonation role allows takeover of realm administrator accounts7.2 High
- djust-org djustdjust: Multi-tenant isolation fails open on the WebSocket/SSE path, disclosing other tenants' data7.7 High
- No product listedPbootCMS User Management UserController.php mod cross-site request forgery5.3 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.16, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: incomplete fix for cve-2026-15573 allows policy enforcer bypass via percent-encoded uri segments8.1 High
- renginereNgine through 2.2.0 Unauthorized Configuration File Read7.1 High
- gen digital avast free antivirus, avast one, avast premium security, avast ultimate, avast business security, avg antivirus free, avg internet security, avg ultimate, norton antivirus plus, norton 360 standard, norton 360 deluxe, norton 360 advanced +2 moreAvast sandbox privilege escalation via unpreserved DACLs on virtualized files in aswSnx.sys8.8 High
- adenion blog2socialBlog2Social WordPress Plugin < 9.1.0 User Email Disclosure via b2s_search_user5.3 Medium
- zlt2000 microservices-platformmicroservices-platform through 6.0.0 Missing Authorization via Disabled URL Permission Checking8.7 High
- guchengwuyue yshop-crmyshop-crm through 2.1.3 Missing Authorization via Disabled Annotation on System User Listing7.1 High
- guchengwuyue yshop-crmyshop-crm through 2.1.3 Missing Authorization via CrmFlowController deleteFlowStep7.1 High
- guchengwuyue yshop-crmyshop-crm through 2.1.3 Missing Authorization via CRM Approval-Chain Endpoint5.3 Medium
- guchengwuyue yshop-crmyshop-crm through 2.1.3 Missing Authorization via CRM Operation-Log Listing7.1 High
- guchengwuyue yshop-crmyshop-crm through 2.1.3 Missing Authorization via CRM Lead-Claim Endpoint7.1 High
- guchengwuyue yshop-crmyshop-crm through 2.1.3 Missing Authorization via StoreProductController onSale5.3 Medium
- guchengwuyue yshop-crmyshop-crm through 2.1.3 Missing Authorization via CrmInvoiceController issueInvoice7.1 High
- guchengwuyue yshop-crmyshop-crm through 2.1.3 Missing Authorization via CRM Customer Rule-Configuration Endpoints7.1 High
- guchengwuyue yshop-crmyshop-crm through 2.1.3 Missing Authorization via CRM Customer Messaging Endpoints5.3 Medium
- apache zookeeperApache ZooKeeper: Missing ACL check on deleteContainer opcode allows unauthorized deletion of any empty persistent/container znode7.5 High
- apache zookeeperApache ZooKeeper: Information disclosure via SetWatches reconnect replay7.5 High
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabMissing Authorization in GitLab4.3 Medium
- gitlabMissing Authorization in GitLab4.3 Medium
- unknown subscriptions for woocommerceSubscriptions for WooCommerce < 2.0.3 - Subscription Cancellation via CSRF4.3 Medium
- arraytics eventinEventin < 4.1.24 - Unauthenticated Order and Attendee Status Reset via Payment REST Endpoint3.7 Low
- arraytics eventinEventin < 4.1.24 - Contributor+ User Creation via Speaker Creation2.7 Low
- arraytics eventinEventin < 4.1.24 - Unauthenticated Ticket Price Rewrite via order_token5.3 Medium
- multivendorxMultiVendorX 5.0.0 - 5.0.15 - Subscriber+ Arbitrary Store Data and Ownership Overwrite via stores REST Endpoint7.1 High
- spacetime ad inserter – ad manager & adsense adsAd Inserter <= 2.8.16 - Missing Authorization to Unauthenticated Header/Footer Code Disclosure via 'ai-debug-code' Parameter5.3 Medium
- themetechmount truebooker – appointment booking and scheduler systemTrueBooker <= 1.2.3 - Missing Authorization to Unauthenticated Arbitrary User Email Modification via 'admin_addcustomer' AJAX Action9.8 Critical
- jitsi @jitsi/electron-sdk@jitsi/electron-sdk before 10.0.5 Unauthorized Screen Capture7.1 High
- myscada technologies mypromySCADA myPRO Manager Missing Authorization5.3 Medium
- myscada technologies mypromySCADA myPRO Manager Missing Authorization9.3 Critical
- google chromeMissing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a...4.2 Medium
- google chromeMissing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote...4.2 Medium
- google chromeMissing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote...8.1 High
- google chromeMissing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a...5.1 Medium
- digital watchdog va1g4 recorder, vg4 recorder, vmax a1 g4 dvr +2 more +4 moreMissing Authorization in Digital Watchdog VMAX DVR and NVR Product Lineups9.4 Critical
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS 9.0.0 to 9.5.2 Express Form block missing authorization allows an authenticated editor to modify Express Forms they cannot edit2.0 Low
- concrete cms cms, concretecms concrete cms +1 moreIDOR in Concrete CMS 9.0.0 through 9.5.2 dashboard sitemap reorder (SitemapUpdate::updateDisplayOrder) allows an authenticated sitemap user to reorder arbitrary pages2.1 Low
- concrete cms cms, concretecms concrete cms +1 moreConcrete CMS below 9.5.3 Multilingual Page Assign Action Lacks Destination Authorization and CSRF Token Validation2.1 Low
- concrete cms cmsConcrete CMS 9.0.0-9.5.2 Boards data source dashboard is missing an authorization check, allowing a low-privileged board editor to modify or delete configured data sources on boards they do not contro…2.1 Low
- concrete cms cmsConcrete CMS 9.0.0 through 9.5.2 us missing authorization in the Express entries advanced-search dashboard action allowing a low-privileged user to read other entities' Express entries2.1 Low
- concrete cms cmsConcrete CMS 9.0.0 through 9.5.2 is Missing Authorization on Board Instance Actions Allowed a Board Editor to Access and Delete Other Boards' Instances2.1 Low
- Show moreLoading…