CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- techfry tf content, joomlafry.com tf content for joomla +1 moreJoomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.46.9 Medium
- kit (formerly convertkit) for woocommerce, nathanbarry kit (formerly convertkit) for woocommerce +1 moreWordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability5.3 Medium
- chouby polylangWordPress Polylang plugin <= 3.8.7 - Sensitive Data Exposure vulnerability4.3 Medium
- arraytics wp event solutionWordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability5.3 Medium
- techjewel fluent forms pro add on packWordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Broken Access Control vulnerability5.3 Medium
- deepak anand wp dummy content generatorWordPress WP Dummy Content Generator plugin <= 4.0.0 - Broken Access Control vulnerability4.3 Medium
- brainstorm force starter templatesWordPress Starter Templates plugin <= 4.7.7 - Broken Access Control vulnerability5.4 Medium
- blubrry powerpress podcastingWordPress PowerPress Podcasting plugin <= 11.17.9 - Sensitive Data Exposure vulnerability5.3 Medium
- liquid web / stellarwp event ticketsWordPress Event Tickets plugin <= 5.30.0 - Broken Access Control vulnerability4.3 Medium
- jeroen peters name directoryWordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability5.3 Medium
- brandtoss wp mailster, wp mailster mailster +1 moreWordPress WP Mailster plugin <= 1.9.0.0 - Broken Access Control vulnerability5.3 Medium
- brandtoss wp admin auditWordPress WP Admin Audit plugin <= 1.2.17 - Broken Access Control vulnerability4.3 Medium
- rextheme wp vrWordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability6.5 Medium
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration6.5 Medium
- mediatek mt6878 firmware, mt6881 firmware, mt6899 firmware +10 more +12 moreIn aidl, there is a possible escalation of privilege due to a missing permission check. This...6.7 Medium
- zitadelZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment9.3 Critical
- arraytics wpcafe – restaurant menu, online food ordering & table booking systemWPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete5.3 Medium
- nelio content – editorial calendar & social media auto-postingNelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter8.1 High
- unknown mailchimp for woocommerceMailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion5.3 Medium
- villatheme photo reviews for woocommercePhoto Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter8.1 High
- wpinsider-1 simple membershipSimple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints7.5 High
- alttextai alt text ai – automatically generate image alt text for seo and accessibilityAlt Text AI <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Action4.3 Medium
- ultimatemember ultimate member – user profile, registration, login, member directory, content restriction & membership pluginUltimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass7.5 High
- hkuds vibe-tradingHKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE9.3 Critical
- triggerdotdev trigger.devTrigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO8.3 High
trigger.devnpmTrigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)7.1 High- utmstackUTMStack < 11.2.16 Missing Authorization via Command WebSocket6.5 Medium
- alanaktion phprojectPhproject < 1.8.7 Missing Authorization via Issues REST API7.1 High
- mispMISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View5.3 Medium
- mispMISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data7.1 High
- meari iot cloud platform openapi serviceMissing Authorization in Meari IoT Cloud Platform OpenAPI Service7.1 High
- mispMISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization5.3 Medium
- meari iot cloud platform openapi serviceMissing Authorization in Meari IoT Cloud Platform OpenAPI Service6.3 Medium
- thimpress learnpressWordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability4.3 Medium
- kiera howe websamuraiWordPress WebSamurai plugin <= 1.0.7 - Broken Access Control vulnerability6.5 Medium
- airano mcp bridgeWordPress Airano MCP Bridge plugin <= 2.11.0 - Broken Access Control vulnerability6.5 Medium
- avez electronics communication training and consultancy trade inc. learning management system (lms)IDOR in AVEZ Electronics's LMS6.5 Medium
- yeswikiYesWiki before 4.6.7 Missing Authorization via Attachment Download Handler8.7 High
- yeswikiYesWiki before 4.6.7 Authorization Bypass via Public API Mode9.2 Critical
- yeswikiYesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions8.7 High
- siyuan-note siyuanSiYuan before 3.8.5 Information Disclosure via /api/export/preview8.7 High
- siyuan-note siyuanSiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints6.9 Medium
- amauric wpmobile.app – android and ios app builderWPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter9.8 Critical
- havelsan inc. sef - ai chatbot platformUnauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef - AI Chatbot Platform5.3 Medium
- mstore api, unknown mstore api +1 moreMStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter4.3 Medium
- unknown wp edit password protectedWP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API5.3 Medium
- popup maker wp, unknown popup maker wp +1 morePopup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization5.4 Medium
- unknown wp user frontendWP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form4.3 Medium
- stylemixthemes motorsMotors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured3.1 Low
- calcom cal.diycalcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization5.3 Medium
- Show moreLoading…