CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: uma scope merge across resource owners via resource name collision3.5 Low
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: cross-realm client read/write via request-level cache missing realm ownership check5.5 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: authorization services policy evaluation endpoint leaks user identity4.9 Medium
- frappe erpnextFrappe ERPNext before 15.121.0 and 16.34.0 Missing Authorization in Timesheet Endpoints7.1 High
- tiktokbusinessplugin tiktokTikTok 1.2.0 - 1.4.1 - Unauthenticated OAuth Code Redemption3.7 Low
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: admin credential delete bypasses denied reset-password permission6.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: delegated admin with manage-users can escalate to realm-admin via group membership6.6 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: token refresh continues issuing tokens for disabled audience clients4.2 Medium
- wpexpertshub partial shipment for woocommercePartial Shipment for Woocommerce <= 3.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Settings Modification via wxp_order_shipment, wxp_order_item_shipment, and wxp_order_set_shippe…4.3 Medium
- datalogics ecommerce delivery – datalogicsDatalogics Ecommerce Delivery <= 2.6.65 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via Multiple AJAX Actions (datalogics_create_shipping / datalogics_cancel_shipping…4.3 Medium
- empik for woocommerceEmpik for Woocommerce <= 1.5.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Product Meta Update via empik_csv_process_emp_log_classes AJAX Action4.3 Medium
- tiktokbusinessplugin tiktokTikTok <= 1.4.1 - Missing Authorization to Unauthenticated TikTok Integration Takeover via 'auth_code' Parameter5.3 Medium
- vowelweb ibtana – ecommerce product addonsIbtana – Ecommerce Product Addons <= 0.4.7.7 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Meta Modification via 'iepa_use_gt_editor' AJAX Action5.3 Medium
- easyappointments easy appointmentsEasy Appointments <= 3.12.27 - Missing Authorization to Authenticated (Contributor+) Sensitive Customer Information Exposure via ea_get_customers_ajax AJAX Action6.5 Medium
- shahrukhlinkgraph search atlas seo – otto ai seo automation for wordpressSearch Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Whitelabel Password Modification via handle_whitelabel_password_early Function4.3 Medium
- radius314 breadBread <= 2.9.12 - Missing Authorization to Unauthenticated Information Exposure5.3 Medium
- vowelweb vw writer blogVW Writer Blog <= 1.3.8 - Missing Authorization to Authenticated (Subscriber+) Theme Settings Reset4.3 Medium
- shahrukhlinkgraph search atlas seo – otto ai seo automation for wordpressSearch Atlas SEO <= 2.6.23 - Missing Authorization to Authenticated (Subscriber+) Site-Wide Option Modification via 'metasync_post_types' Parameter4.3 Medium
- edgarrojas pdf builder for woocommerce. create invoices,packing slips and morePDF Builder for WooCommerce. Create invoices,packing slips and more <= 2.0.11 - Missing Authorization to Authenticated (Subscriber+) Sensitive Invoice Data Disclosure via GetInvoiceDetail AJAX Handler4.3 Medium
- flextheme flex importFlex Import <= 3.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via 'license_activate_fleximp' and 'license_deactivate_fleximp' AJAX Actions4.3 Medium
- unknown mailchimp for woocommerceMailchimp for WooCommerce < 6.1.1 - Unauthenticated Broken Access Control in REST API5.3 Medium
- linknacional rede itaú for woocommerce — payment pix, credit card and debitRede Itaú for WooCommerce < 5.4.7 - Unauthenticated Order Status Manipulation via PIX Webhook5.3 Medium
- unknown botiga proBotiga Pro < 1.6.5 - Unauthenticated Arbitrary Blog Options Update via Templates Builder REST Route9.8 Critical
- unbounce landing pages, unknown unbounce landing pages +1 moreUnbounce Landing Pages 1.1.1 - 1.1.4 - Subscriber+ Reverse-Proxy Target Hijack via set_unbounce_domains8.0 High
- wordplus better messages – chat rooms, group chat, private messages & ai chat botsBetter Messages <= 2.15.33 - Missing Authorization to Authenticated (Custom+) Chat-Room Transcript Disclosure via '/thread/<id>' REST Endpoint6.5 Medium
- themeum tutor lms – elearning and online course solutionTutor LMS <= 4.0.8 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion via 'lesson_id' Parameter4.3 Medium
- divi essential essentialsDivi Essentials <= 5.8.1 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via dnxte_get_database_data AJAX Action6.5 Medium
- cleverplugins seo boosterSEO Booster <= 7.4.7 - Authenticated (Subscriber+) Missing Authorization to Arbitrary Options Modification via handle_oauth_callback()4.3 Medium
- siyuan-note siyuanSiYuan through 3.8.4 Access Control Bypass via Dynamic Icon Endpoint5.3 Medium
- acode-foundation acodeAcode: Exported TerminalService (bundled terminal plugin) lets any installed app execute arbitrary shell commands as Acode8.6 High
- 1panel-dev cordyscrmCordysCRM: Unauthenticated arbitrary file disclosure via `/attachment/preview/{id}` and `/pic/preview/{id}`5.0 Medium
- pgpartman pg partmanpg_partman authorization bypass to move child tables between schemas during retention8.5 High
- ibm guardium data protectionIBM Guardium Data Protection is affected by multiple vulnerabilities.8.8 High
- ibm websphere application serverIBM WebSphere Application Server is affected by a privilege escalation3.7 Low
- openstack blazarIn OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases...7.1 High
- obot-platform obotObot before v0.23.0 Authentication Bypass via Registry API6.9 Medium
- moquette-io moquetteMoquette: Missing Authorization in io.moquette:moquette-broker7.5 High
- icinga icinga2Icinga 2: Improper access control for JSON-RPC update certificate messages9.8 Critical
- zoriya kyooKyoo: Transcoder serves uncataloged files from the media directory4.3 Medium
- semantic-mediawiki semantic mediawiki, semanticmediawiki +1 moreSemantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API6.9 Medium
- azkabanAzkaban through 4.0.0 Authorization Bypass via ScheduleServlet7.1 High
- gedelumbung hospitalmanagementgedelumbung HospitalManagement cross-site request forgery5.3 Medium
- arcadedata arcadedbArcadeDB before 26.9.1 Authorization Bypass via Batch Edge Connect5.3 Medium
- arcadedata arcadedbArcadeDB before 26.9.1 ACL Bypass via query_database Tool7.1 High
- pixarlabs master addons for elementor – elementor addons, widgets, mega menu builder, popup builder, widget builder & template kitsMaster Addons for Elementor <= 3.2.2 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification/Deletion via 'popup_id' Parameter8.1 High
- saadiqbal wp easy pay – payment and donation form builder for squareWP Easy Pay <= 4.5.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Deletion4.3 Medium
- wpblockart magazine blocks – blog designer, magazine & newspaper website builder, page builder with posts blocks, post gridMagazine Blocks <= 1.8.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Modification / Site-Wide Template Takeover via Builder Templates REST Endpoint4.3 Medium
- elegant themes diviDivi <= 5.11.1 - Missing Authorization to Unauthenticated Arbitrary Registered Shortcode Execution via 'content' Parameter via Shortcode Module REST Endpoint5.3 Medium
- farazfrank filter galleryFilter Gallery <= 1.1.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Modification via 'image_id' Parameter via ufg_save_gallery AJAX Action4.3 Medium
- foxtheme foxtool all-in-one: contact chat button, custom login, media optimize imagesFoxtool All-in-One: Contact chat button, Custom login, Media optimize images <= 2.5.3 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Plugin Settings Modification via 'option_key' Par…4.3 Medium
- Show moreLoading…