CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- liquid web / stellarwp givewpWordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability6.5 Medium
- cusrev customer reviews for woocommerceWordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability7.5 High
- mra13 / team tips and tricks hq wp express checkout (accept paypal payments)WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability7.5 High
- makecommerce.net makecommerce for woocommerceWordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability8.2 High
- booklyWordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability7.5 High
- hostinger migratorWordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability7.5 High
- wpwax formgentWordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability7.1 High
- gravitykit gravityexport lite for gravity formsWordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability7.5 High
- nsquared simply schedule appointmentsWordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability6.5 Medium
- amauri wpmobile.appWordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability6.9 Medium
- mispMISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection8.6 High
- unknown media library organizerMedia Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation2.7 Low
- inspirelabs inpost plInPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook5.3 Medium
- unknown all in one files uploadAll in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update4.3 Medium
- watchguard fireware, fireware os +1 moreFireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B7.1 High
- watchguard fireware, fireware os +1 moreFireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A7.1 High
- grafana enterprise, oss +1 morePaused shared dashboard access tokens still expose data source configuration5.3 Medium
- google chromeMissing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker...6.5 Medium
- google chromeMissing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote...6.5 Medium
- wikimedia foundation mediawiki - templatesandbox extensionTemplateSandbox does not check read permissions for the page being previewed9.1 Critical
- devolutions serverMissing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and...5.0 Medium
- devolutions serverMissing authorization in the attachment history API in Devolutions Server 2026.3.5.0 and earlier...5.4 Medium
- devolutions serverImproper access control in the partial connection API in Devolutions Server 2026.3.5.0 and...5.4 Medium
- apache software foundation polarisApache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials8.1 High
- apache software foundation dolphinschedulerApache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure6.5 Medium
- pretixRevenue information leak2.7 Low
- interprobe information technologies inc. qorela dcPrivilege Escalation via Account Takeover in Interprobe's Qorela DC8.8 High
- gitlabMissing Authorization in GitLab3.7 Low
- gitlabMissing Authorization in GitLab4.3 Medium
- hitachi energy rtu500 series cmu firmwareAn improper authorization vulnerability in the RTU500’s web application allows an authenticated...6.5 Medium
- apache karafApache Karaf: Authorization bypass in JMX MBean lifecycle operations8.8 High
- apache karafApache Karaf: config:install missing ACL entry allows privilege escalation to admin6.3 Medium
- apache karafApache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create9.8 Critical
- No product listedREBUILD file-editor-save authorization6.9 Medium
- gz-yami mall4jmall4j through 4.0 Missing Authorization in Admin User Address Endpoints7.1 High
- webkul bagistoWebkul Bagisto Invoice Mass Status Update state authorization5.1 Medium
- dannymcc bluehoodBluehood: Missing authentication on Bluehood API routes when web auth is enabled9.1 Critical
- enterprisedb warehousepgWarehousePG pg_file_write/pg_file_rename/pg_file_unlink/pg_logdir_ls privilege escalation8.7 High
- canonical lxdLXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse6.3 Medium
- apache software foundation rollerApache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers9.9 Critical
- unknown wp verify apiWP Verify API <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Recipients5.3 Medium
- netcore nbr100v2Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization10.0 Critical
- red hat enterprise linux 10, enterprise linux 7, enterprise linux 8 +1 more +3 moreFlatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull3.3 Low
- zhistaredu startrainingzhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization5.3 Medium
- mathurvishal cloudclassroom-php-projectmathurvishal CloudClassroom-PHP-Project cross-site request forgery5.3 Medium
- nextscripts nextscripts: social networks auto-posterNextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion5.9 Medium
- ihomefinder optima express idxOptima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache5.3 Medium
- malcure malware shield — removal, repair, monitor, unknown malcure malware shield — removal, repair, monitor +1 moreMalcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request7.2 High
- azuracastAzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass8.2 High
- coollabsio coolifycoollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization6.9 Medium
- Show moreLoading…