CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- motorola setup appA component of one of the Motorola system applications was exported without permission, allowing...4.8 Medium
- zephyrproject zephyrSMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state4.4 Medium
- mamunur rashid review schemaWordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability6.5 Medium
- apps mav gratisfactionWordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability7.6 High
- wedevs wp project managerWordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability6.3 Medium
- apps mav social boostWordPress Social Boost plugin <= 3.6.2 - Broken Access Control vulnerability7.6 High
- aruba.it aruba migration toolWordPress Aruba Migration Tool plugin <= 1.0.4 - Broken Access Control vulnerability6.5 Medium
- themeisle wp full stripe freeWordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability7.5 High
- magepeople inc. wptravellyWordPress WpTravelly plugin <= 2.3.1 - Broken Access Control vulnerability5.4 Medium
- villatheme affi – affiliate marketing for woocommerceWordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability5.3 Medium
- ahmad majestic support, majestic support support +1 moreWordPress Majestic Support plugin <= 1.2.0 - Broken Access Control vulnerability5.3 Medium
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Broken Access Control vulnerability5.3 Medium
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability5.3 Medium
- tryghost ghostGhost 5.3.0 before 6.58.0 Unauthenticated Comment Read6.9 Medium
- tryghost ghostGhost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts6.9 Medium
- tryghost ghostGhost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset8.7 High
- n8n-io n8nn8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node6.3 Medium
- n8n-io n8nn8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub7.5 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation...4.3 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links7.2 High
- mispMISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes7.1 High
- unknown payments for hubtelPayments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback5.3 Medium
- unknown wp fusion liteWP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update6.5 Medium
- davidanderson redux frameworkRedux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter4.3 Medium
- genians, inc genian nac 4.0.175 release, genian nac 5.0.65 lts release, genian nac 5.0.75 lts release +6 more +8 moreGenians, Inc Genian NAC/ZTNA Remote Code Execution5.9 Medium
- genians, inc genian ssl pns (frodo-core)Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass7.3 High
- croixhaug simply schedule appointmentsSimply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_type…7.5 High
- google androidIn platform_msg_handler_init of default_msg_handlers.c, there is a possible permission bypass due...6.7 Medium
- google androidIn isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing...8.8 High
- google androidIn is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission...4.4 Medium
- openclaw windows nodeOpenClaw Windows Node before 2026.7.1-3 Missing Authorization7.1 High
- optimoleWordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability6.5 Medium
- supsystic ultimate maps by supsysticWordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability6.5 Medium
- nvidia virtual gpu managerNVIDIA vGPU software for Windows and Linux contains a vulnerability in the GPU kernel driver...7.8 High
- nvidia geforce, guest driver, rtx, quadro, nvs +2 more +4 moreNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode...5.5 Medium
- nvidia geforce, guest driver, rtx, quadro, nvs +2 more +4 moreNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode...5.5 Medium
- nvidia geforce, guest driver, rtx, quadro, nvs +2 more +4 moreNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer...5.5 Medium
- nvidia geforce, rtx, quadro, nvs, tesla +2 moreNVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an...7.3 High
- nvidia geforce, guest driver, rtx, quadro, nvs +1 more +3 moreNVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer...7.8 High
- nvidia geforce, guest driver, rtx, quadro, nvs +2 more +4 moreNVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an...7.8 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template...3.1 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed...2.7 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be...4.3 Medium
- jetbrains hubIn JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send...7.7 High
- nexcess the events calendarWordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability5.4 Medium
- miniorange prevent files / folders accessWordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability4.3 Medium
- creative themes blocksy companionWordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability6.5 Medium
- flexyma allable connectorWordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability5.4 Medium
- jose conti mcp content manager liteWordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability6.5 Medium
- webtoffee wordpress backup & migrationWordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability7.5 High
- Show moreLoading…