CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- farazfrank filter galleryFilter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Gallery Deletion via 'ufg_gallery_id' Parameter8.1 High
- stellarwp bookit — booking & appointment calendarBookit < 2.6.0.5 - Bookit Staff+ Arbitrary Appointment Deletion via Missing Authorization2.7 Low
- kingaddons.com king addons for elementorKing Addons for Elementor 51.1.56 - 51.1.80 - Author+ Missing Authorization via Image Optimizer3.8 Low
- batiste django-page-cmsdjango-page-cms through 2.0.13 Unauthorized Content Access via Staff Account7.1 High
- cubecart v6CubeCart: Missing Authorization Check for Order Note Deletion in orders.index.inc.php5.4 Medium
- cubecart v6CubeCart: Missing Authorization Check in customers.gdpr.inc.php Leads to Unauthorized Customer Data Deletion6.5 Medium
- vmdeshpande ai-agent-automationAI Agent Automation: Missing ownership checks in memory APIs allow cross-user memory read and deletion8.8 High
- labredescefetrj wegiaWeGIA: Authorization Bypass via Empty Resource Array in InternoControle8.8 High
- mythicalltd mythicaldashMythicalDash: Unauthenticated payment bypass in Stripe success-redirect endpoint allows arbitrary free credit top-up7.1 High
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar - Amelia <= 2.4.5 - Missing Authorization to Unauthenticated Payment Bypass5.3 Medium
- ameliabooking booking for appointments and events calendar – ameliaBooking for Appointments and Events Calendar – Amelia (Premium) <= 2.4.4 - Authenticated (Custom+) Missing Authorization to Limited Account Takeover5.4 Medium
- stylemix motors – car dealership & classified listings pluginMotors – Car Dealership & Classified Listings <= 1.4.120 - Missing Authorization to Unauthenticated Private/Draft/Password-Protected Listings Exposure5.3 Medium
- google chromeMissing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote...3.1 Low
- wavelogWavelog: Unauthenticated Remote Code Execution9.3 Critical
- dromara mayfly-goDromara mayfly-go AI Assistant ai.go authorization5.3 Medium
- erudika scooldScoold: GET /api/posts/{id}/answers leaks private-space replies when personal API tokens are enabled6.5 Medium
- erudika scooldScoold: Authenticated user can post replies and comments to private-space questions without space membership6.5 Medium
- umbraco umbraco-cmsUmbraco: Delivery API leaks protected (Public Access) content through Content Picker / Multi-Node Tree Picker expansion8.7 High
- berqwpWordPress BerqWP plugin <= 4.1.15 - Broken Access Control vulnerability5.3 Medium
- wpeverest user registrationWordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability5.3 Medium
- wpdevelop booking calendarWordPress Booking Calendar plugin <= 11.7 - Broken Access Control vulnerability5.3 Medium
- wp.insider simple membershipWordPress Simple Membership plugin <= 4.8.2 - Broken Access Control vulnerability5.3 Medium
- matrixaddons easy invoiceWordPress Easy Invoice plugin <= 2.3.8 - Broken Access Control vulnerability5.3 Medium
- quadlayers checkout field manager (checkout manager) for woocommerceCheckout Field Manager < 7.9.7 - Subscriber+ Arbitrary Attachment Deletion via Customer Address Custom Field4.3 Medium
- liton arefin master addons for elementorMaster Addons for Elementor < 3.1.9 - Unauthenticated Popup Deactivation via jltma_popup_disable_expired5.3 Medium
- matthiasnordwig invisible anti-spam & captcha — recaptcha alternative for all formsInvisible Anti-Spam & CAPTCHA < 5.1.1 - Subscriber+ Arbitrary Form Submission Deletion4.3 Medium
- unknown active woot products tables for woocommerce. 100% freeActive Products Tables for WooCommerce < 2.1.3 - Subscriber+ Arbitrary Post Title Modification via woot_update_attachment4.3 Medium
- djust-org djustdjust has broken object-level access control (IDOR)7.1 High
- djust-org djustdjust has an authorization bypass on the WebSocket/SSE mount path9.1 Critical
- djust-org djustdjust: SSE sessions are not bound to the authenticated user; the client-chosen session_id is the sole authorization capability (session hijack)7.4 High
- craftcms cmsCraft CMS 5.0.0 before 5.10.13 Broken Access Control via nested-elements/reorder5.3 Medium
- wwbn avideoAVideo through 29.0 Missing Authorization via comment API endpoint5.3 Medium
- wwbn avideoAVideo through 29.0 Missing Authorization Check via API Like Endpoint5.3 Medium
- libretranslateLibreTranslate through 1.9.6 Missing Access Check on the download_file Route6.9 Medium
- kanbn kankan through 0.6.0 Authorization Bypass via GitHub Project Import5.3 Medium
- opensignlabs opensignOpenSign through 2.41.3 Information Disclosure via getDocument8.7 High
- yeti-platform yetiYeti through 2.11.0 Missing Authorization on RBAC Relationship Deletion7.2 High
- didi knowstreamingKnowStreaming through 3.4.1 Missing Authorization on the REST API8.7 High
- leantimeLeantime before 3.9.6 Unauthorized Plugin Installation via HTMX7.1 High
- rundeckRundeck through 6.2.1 Authorization Bypass via Project Import8.6 High
- convoypanel panelPelican Panel before 1.0.0-beta35 Authorization Bypass via Startup8.7 High
- retspen webvirtcloudWebVirtCloud Missing Authorization on Instance Control Actions8.7 High
- patrowl patrowlmanagerPatrowlManager through 1.8.4 Improper Access Control via users API5.3 Medium
- patrowl patrowlmanagerPatrowlManager through 1.8.4 Authorization Bypass via Events API7.1 High
- harnessHarness through 3.3.0 Missing Access Control via infraproviders endpoint7.1 High
- cisco secure firewall management center (fmc)Cisco Secure Firewall Management Center sftunnel Root Arbitrary Code Exectution Vulnerability9.9 Critical
- tanium threat responseTanium addressed an improper access controls vulnerability in Threat Response.3.8 Low
- apache nifiApache NiFi: Missing Authorization for Assets and Secrets Referenced by Connector Configuration0.5 Low
- apache nifiApache NiFi: Missing Authorization for Components Referenced in Flow Update Methods5.9 Medium
- apache nifiApache NiFi: Missing Process Group Authorization for Connector Migration2.3 Low
- Show moreLoading…