CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- elastic kibanaMissing Authorization in Kibana Leading to Unauthorized Deletion of Data6.5 Medium
- siyuan-note siyuanSiYuan before v3.8.4 Missing Authorization via siyuan-send-windows5.3 Medium
- cap-go capgo.appCap-go capgo.app Authorization Bypass via channel_permission_overrides8.7 High
- flowiseai flowiseFlowise through 3.1.4 Authorization Bypass via BullMQ Dashboard8.7 High
- flowiseai flowiseFlowise through 3.1.4 Missing Authorization via Chat Message Routes7.5 High
- openclaw clawhubClawHub Changelog Preview Information Disclosure via Authorization Bypass7.1 High
- j0hnsmith testimonials widgetTestimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update7.5 High
- unknown mcp server for wordpressMCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check2.7 Low
- openclawOpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration8.7 High
- openclawOpenClaw before 2026.7.1 Authentication Bypass via activation5.3 Medium
- openclawOpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming5.3 Medium
- openclawOpenClaw before 2026.7.1 Authentication Bypass via Active Memory5.3 Medium
- openclawOpenClaw before 2026.7.1 Authorization Bypass via Codex Install8.7 High
- openclawOpenClaw before 2026.7.1 Authentication Bypass via MCP Channel8.6 High
- openclaw discordOpenClaw Discord before 2026.7.1 Authorization Bypass5.3 Medium
- openclaw feishu, googlechat, matrix +1 more +3 moreOpenClaw Channel Plugins before 2026.8.1 Channel Read Allowlist Bypass7.1 High
- openclaw slackOpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM8.7 High
- openclawOpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback4.8 Medium
- openclaw voice-callopenclaw voice-call before 2026.8.1 Authorization Bypass8.7 High
- openclawOpenClaw before 2026.8.1 Authentication Bypass via Active Memory2.3 Low
- openclaw whatsappopenclaw WhatsApp before 2026.8.1 Authentication Bypass7.2 High
- openclaw discordVulnerability in discord6.0 Medium
- openclaw diagnostics-prometheusOpenClaw diagnostics-prometheus before 2026.9.3 Authentication Bypass5.3 Medium
- google chromeMissing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote...5.4 Medium
- google chromechromedriver-154.0.8037.57-1.1 on GA media4.3 Medium
- google chromeMissing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote...5.4 Medium
- google chromeMissing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote...8.1 High
- google chromeMissing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote...4.8 Medium
- google chromeMissing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a...6.5 Medium
- google chromeMissing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote...4.3 Medium
- google chromeMissing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker...5.4 Medium
- google chromeMissing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote...5.4 Medium
- google chromeMissing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a...8.4 High
- google chromeMissing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote...8.4 High
- horilla horilla-hrHorilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)6.5 Medium
- the wikimedia foundation mediawiki - translate extensionMissing permission check in the Translate sandbox doRemind action5.3 Medium
- rustdeskRustDesk before 1.5.0 One-Way File Transfer Bypass2.3 Low
- rustdeskRustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages5.3 Medium
- tduckcloud tduck-survey-formTDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission Endpoint5.3 Medium
- tduckcloud tduck-survey-formTDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints5.3 Medium
- glpi-project glpiGLPI: Arbitrary Document Read via Form Context Authorization Bypass7.1 High
- glpi-project glpiGLPI: Privilege Escalation via authtype API manipulation7.5 High
- glpi-project glpiGLPI: Unexpected access to update operations through the API6.0 Medium
- zammadZammad: Authenticated agents can read AI summary error messages from inaccessible tickets2.3 Low
- zammadZammad: Channel admins can read unauthorized attachments via signature rich-text body5.1 Medium
- zammadZammad: Pending upload deletion bypass via legacy attachment endpoint2.3 Low
- zammadZammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers2.1 Low
- zammadZammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak5.1 Medium
- bludit cmsBludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint7.1 High
- payloadcms payloadPayload CMS storage-vercel-blob Adapter Improper Access Control on Upload Route5.3 Medium
- Show moreLoading…