CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- wp user manager user managerWordPress WP User Manager plugin <= 2.9.19 - Broken Access Control vulnerability5.3 Medium
- payplus tech team payment gateway, unknown payplus payment gateway +1 moreWordPress PayPlus Payment Gateway plugin <= 8.2.5 - Broken Access Control vulnerability6.5 Medium
- bilal naseer wsp mcp – ai agents connectorWordPress WSP MCP - AI Agents Connector plugin <= 2.7.0 - Broken Access Control vulnerability6.5 Medium
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: jobjobeventschildrensummary rbac bypass exposes cross-tenant job event tree structure5.0 Medium
- gocdGoCD is vulnerable to authorization bypass via fetch artifact autosuggestion API5.3 Medium
- cinnamon kotaemonCinnamon's kotaemon contains improper authorization checks in multi‑user chat handlers6.5 Medium
- drupal smart contentSmart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-1906.5 Medium
- drupal css usage analyzerCSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-1896.5 Medium
- drupal webform restWebform REST - Less critical - Access bypass - SA-CONTRIB-2026-1864.3 Medium
- moquetteMoquette fails open when configured authentication or authorization classes cannot load9.3 Critical
- moquetteMoquette client IDs can cause cross-session H2 durable-queue corruption8.8 High
- moquetteMoquette publishes Last-Will messages without enforcing write authorization8.7 High
- moquetteMoquette unbounded per-session message queues allow memory exhaustion8.7 High
- moquetteMoquette deeply nested MQTT topics can cause stack exhaustion8.7 High
- moquetteMoquette malformed shared subscriptions can crash command processing8.7 High
- moquetteMoquette uncaught MQTT command exceptions can terminate shared session event loops8.7 High
- moquetteMoquette pattern ACL wildcard injection allows cross-tenant authorization bypass9.6 Critical
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities6.5 Medium
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities7.1 High
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: par single-use bypass via prompt=none silent authentication path4.2 Medium
- unknown mpcx lightboxMPCX Lightbox 1.2.2 - 1.2.5 - Unauthenticated Non-Public Post Content Disclosure3.7 Low
- tw93 pakePake grants unrestricted IPC access to every HTTPS origin loaded in generated applications8.2 High
- vsourz1td advanced contact form 7 dbAdvanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' Shortcode6.5 Medium
- unknown points and rewards for woocommercePoints and Rewards for WooCommerce < 2.10.4 - Subscriber+ Arbitrary Points and Wallet Balance Manipulation via assign_claim_points4.3 Medium
- unknown wc fields factoryWC Fields Factory < 4.1.11 - Subscriber+ Arbitrary Post Meta Manipulation via AJAX8.1 High
- unknown wc fields factoryWC Fields Factory < 4.1.11 - Contributor+ Arbitrary Post Cloning and Private Content Disclosure3.3 Low
- paymob for woocommerce, unknown paymob for woocommerce +1 morePaymob for WooCommerce < 4.1.14 - Contributor+ Payment Gateway Configuration Deletion and Modification via Multiple AJAX Actions4.7 Medium
- paymob for woocommerce, unknown paymob for woocommerce +1 morePaymob for WooCommerce < 4.1.14 - Unauthenticated Saved Card Token Write to Any User via Webhook5.3 Medium
- unknown forminator formsForminator Forms < 1.57.2.1 - Unauthenticated Arbitrary Recipient Email Sending with Attacker-Controlled Link3.7 Low
- unknown forminator formsForminator Forms < 1.57.2.1 - Subscriber+ Form Stripe Field Migration via migrate_stripe3.1 Low
- unknown real3d flipbookReal3D Flipbook Lite < 5.4 - Author+ Content Deletion and Stored XSS via Global Settings Overwrite6.8 Medium
- unknown directorist: ai-powered business directory, listings & classified adsDirectorist 8.9.1 - 8.9.4 - Subscriber+ Paid Order and Payment Record Forgery via REST Orders Endpoint4.3 Medium
- icegram email subscribers & newslettersEmail Subscribers by Icegram Express < 5.9.35 - Unauthenticated Subscription Status Change via Missing Token Verification5.3 Medium
- unknown zportalsZportals < 6.4.2 - Subscriber+ Arbitrary Plugin Settings Update4.3 Medium
- unknown social commerce for woocommerceSocial Commerce for WooCommerce <= 2.5.4 - Unauthenticated Plugin Option and Product Sync Status Update5.3 Medium
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities6.5 Medium
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities6.5 Medium
- ibm financial transaction manager, financial transaction manager (ftm) for redhat openshift +1 moreIBM Financial Transaction Manager (FTM) is Impacted by Multiple Vulnerabilities7.3 High
- unleashUnleash: Missing await on permission check + cross-project IDOR in admin API7.1 High
- usekaneo kaneoKaneo 2.3.12 < 2.12.2 Missing Authorization via Bulk Task Endpoint7.2 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 moreMCP Atlassian: ENABLED_TOOLS / Toolset authorization bypass8.8 High
- softaculous virtualizorSoftaculous Virtualizor Authorization Bypass via Billing Module Handler8.7 High
- mcp-atlassian mcp atlassian, sooperset mcp-atlassian +1 more[mcp-atlassian] Authentication bypass in HTTP transport: AtlassianOpaqueTokenVerifier accepts any non-empty token10.0 Critical
- amazon amazon-connect-salesforce-lambdaMissing Authorization in sfExecuteAWSService Lambda Dispatcher in Amazon Connect Salesforce Lambda6.4 Medium
- dokployDokploy: Git Provider Credential Exposure via Unprotected .one Endpoints and application.one9.6 Critical
- blakeblackshear frigateFrigate: WebSocket Missing Authorization — Viewer Can Execute Admin-Only Operations8.1 High
- cloudreveCloudreve: Privilege Scope Bypass: State-Mutating Admin Operations Accessible via Read-Only OAuth Scope3.8 Low
- mispMISP: Insufficient Authorization Allows Sharing Group Editors to Overwrite Organization Metadata5.3 Medium
- mispMISP Missing Authorization on replaceSuggestionInReport Event Report Action5.3 Medium
- mispMISP Overmind Event View Discloses Report Content Bypassing Report-Level ACL5.3 Medium
- Show moreLoading…