CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- zammadZammad: Incorrect implementation of permission checks in the knowledge base module7.1 High
- kitty project kittyMissing ownership check on the shared memory object named by the kitty askpass escape code5.6 Medium
- kitty project kittyMissing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a drop6.0 Medium
- akiaBroken authorization in Akia keyless entry lets an authenticated guest unlock other rooms8.4 High
- wpchill modula image gallery – photo grid & video galleryModula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters7.5 High
- wpchill modula image gallery – photo grid & video galleryModula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter8.1 High
- pr-gateway blog2social: social media auto post & schedulerBlog2Social: Social Media Auto Post & Scheduler <= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers4.3 Medium
- ivole customer reviews for woocommerceCustomer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter9.1 Critical
- allterraindeveloper openstation: desktop windows, dock & virtual desktops for wp adminOpenStation <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint4.3 Medium
- cyber-iii student-management-systemningzichun student-management-system cross-site request forgery5.3 Medium
- servicenow ai platformUnauthenticated Sensitive Data Disclosure in ServiceNow AI Platform9.3 Critical
- servicenow ai platformAuthorization Bypass in ServiceNow AI Platform8.4 High
- docmostDocmost: Broken access control in transclusion lookup API leaks sync-block content across private spaces4.3 Medium
- mauriceboe trekTREK: Cross-user note-file deletion (IDOR / Broken Access Control)7.1 High
- mauriceboe trekTREK MCP trip summary bypasses delegated OAuth read scopes4.3 Medium
- ixofoundation ixo-blockchainixo Blockchain x/bonds DID-resolved payer drain + x/entity ICA authorization bypass9.3 Critical
- discourseDiscourse: Non-participant moderators can read, edit, and delete PM content through Discourse AI reviewables4.2 Medium
- rmyndharis openwaOpenWA: A read-only API key can receive a session pairing QR over the WebSocket event stream8.2 High
- termix-ssh termixTermix: Authenticated users can read other users' host status and clear global SSH connections5.4 Medium
- logto-io logtoLogto: Account API can disclose stored third-party provider tokens without the identities scope7.6 High
- genetec inc. security centerA flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow...6.5 Medium
- blackcandy-org black candyBlack Candy through 3.2.1 Information Disclosure via Playlist Search5.3 Medium
- rejetto hfs2HFS2 2.4.0 Unauthenticated Arbitrary File Read/Write via Template Engine10.0 Critical
- netlink ict pvt ltd ict hg323rw routerCommand Injection Vulnerability in Netlink ICT HG323RW Router8.6 High
- alexvtn custom thank you page for woocommerceCustom Thank You Page for WooCommerce <= 1.1.2 - Missing Authorization to Unauthenticated Settings Export and Settings Reset6.5 Medium
- mailerlite – signup forms (official)MailerLite – Signup forms (official) <= 1.7.21 - Missing Authorization to Authenticated (Contributor+) Form Creation and Deletion4.3 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: admin rest api role-groups endpoint discloses groups without authorization4.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS < 3.7.50 - Subscriber+ Lesson Completion Record Creation4.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS 2.3.0 - < 3.7.50 - Unauthenticated Account Creation with Registration Disabled5.3 Medium
- unknown masterstudy lms wordpress pluginMasterStudy LMS 2.3.0 - < 3.7.50 - Subscriber+ Course and Lesson Creation via Demo Import4.3 Medium
- unknown 10web booster10Web Booster < 2.34.0 - Unauthenticated Connection Secret Disclosure and Deletion6.5 Medium
- jtsternberg cmb2CMB2 < 2.13.0 - Subscriber+ Arbitrary Option Corruption via oEmbed Handler6.8 Medium
- red hat build of keycloak 26.6.8, single sign-on 7 +1 moreKeycloak-services: keycloak-services: generic user update bypasses denied reset-password permission6.6 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: essential acr requirement silently bypassed via cookie authenticator4.2 Medium
- gitlabMissing Authorization in GitLab7.7 High
- bytedance coze scraper extensionByteDance Coze Scraper Extension External Message index.js chrome.runtime.onMessageExternal.addListener authorization5.3 Medium
- abdurrab5 online-makeup-storeAbdurrab5 online-makeup-store Admin functions.php confirm_user authorization6.9 Medium
- sfturing hosp ordersfturing hosp_order CommonUserController.java cross-site request forgery5.3 Medium
- red hat ansible automation platform 2.4 for rhel 8, ansible automation platform 2.4 for rhel 9, ansible automation platform 2.5 for rhel 8 +4 more +6 moreAutomation-controller: automation-controller: workflowjobtemplate /copy/ deep-copy sanitizer omits instance_groups authorization (instancegroup use_role bypass to control-plane)9.9 Critical
- verbb formieFormie: Unauthenticated users can overwrite incomplete submissions via submit action8.2 High
- verbb formieFormie: Integration form-settings action allows SSRF and exfiltration of stored integration credentials8.5 High
- verbb formieFormie: Missing authorization on sent notification resend modal exposes submission PII7.7 High
- red hat ansible automation platform 2.5 for rhel 8, ansible automation platform 2.5 for rhel 9, ansible automation platform 2.6 +2 more +4 moreAutomation-controller: automation-controller-container: automation-controller: any authenticated user reads red hat subscription/license details via /config/4.3 Medium
- red hat ansible automation platform 2, ansible automation platform 2.7 +1 moreAutomation-controller: automation-controller-container: aap controller: copyapiview.post() missing read authorization check enables job template secret recovery8.5 High
- tangible loops & logicWordPress Loops & Logic plugin <= 4.2.4 - Broken Access Control vulnerability7.5 High
- conekta group payment gatewayWordPress Conekta Payment Gateway plugin <= 6.2.4 - Broken Access Control vulnerability6.5 Medium
- vcita online booking & scheduling calendar for wordpress by vcitaWordPress Online Booking & Scheduling Calendar for WordPress by vcita plugin <= 4.6.0 - Broken Access Control vulnerability7.5 High
- shahjahan jewel fluent supportWordPress Fluent Support plugin <= 2.3.2 - Broken Access Control vulnerability5.4 Medium
- appmysiteWordPress AppMySite plugin <= 3.15.4 - Broken Access Control vulnerability6.5 Medium
- webwizards marketkingWordPress MarketKing plugin <= 2.1.70 - Broken Access Control vulnerability5.3 Medium
- Show moreLoading…