CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- kvcache-ai mooncakeMooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC6.9 Medium
- kvcache-ai mooncakeMooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC8.8 High
- kvcache-ai mooncakeMooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC6.9 Medium
- royalnavneet delete all comments of wordpressWordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability6.5 Medium
- picuWordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability7.3 High
- blubrry powerpress podcastingWordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability7.2 High
- marco van wieren wpo365WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability8.5 High
- realmag777 bearWordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability7.3 High
- progress planner plannerWordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability8.8 High
- beplusthemes sermon'eWordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability7.5 High
- awesomemotive easy digital downloads, easy digital downloads digital downloads +1 moreWordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability7.5 High
- payplug for woocommerce (official)WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability6.5 Medium
- wxdlabs wxd backup liteWordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability7.5 High
- themetechmount truebookerWordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability6.5 Medium
- flipper code – wordpress development company advanced posts listing – show post list easilyWordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability7.5 High
- wc lovers woocommerce multivendor marketplace – rest apiWordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability7.5 High
- 10web social photo feed, unknown 10web social photo feed +1 moreWordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability6.5 Medium
- patterns in the cloud autoship cloud for woocommerce subscription productsWordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken Access Control vulnerability6.5 Medium
- payplug for woocommerce (official)WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulnerability7.5 High
- digitalpoint app for cloudflare®WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability6.5 Medium
- marcin wise chatWordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability7.1 High
- ecpaytechsupport ecpay ecommerce for woocommerceWordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability7.1 High
- saleswonder team tobias wp2leadsWordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability7.1 High
- qualcomm 5g fixed wireless access platform firmware, 9205 lte modem firmware, 9205s modem firmware +164 more +166 moreMissing Authorization in Core7.8 High
- unknown fast courierFast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint5.3 Medium
- wp manage ninja fluent affiliate proWordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability7.5 High
- green invoice morning for woocommerceWordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability7.5 High
- wallstrdev wds mcp content managerWordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability4.3 Medium
- iatoai iato mcpWordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerability6.5 Medium
- wp manage ninja fluentbooking proWordPress FluentBooking Pro plugin < 2.5.0 - Broken Access Control vulnerability7.5 High
- sourcecodester drug recommendation systemSourceCodester Drug Recommendation System cross-site request forgery5.3 Medium
- docker buildxBake filesystem entitlement consent is skipped for certain secret and oci-layout definitions6.9 Medium
- langflow-ai langflow, langflow-base +1 moreLangflow: Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints5.4 Medium
- penpotPenpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command6.5 Medium
- penpotPenpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session5.9 Medium
- penpotPenpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle5.3 Medium
- tryghost ghostGhost: Authorization Issue Allowed Author Role to Delete any Post6.5 Medium
- kirillbdev wc ukraine shippingWordPress WC Ukraine Shipping plugin <= 1.23.2 - Broken Access Control vulnerability6.5 Medium
- apps mav scratch & win – giveaways and contestsWordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability7.6 High
- ateeq rafeeq repairbuddyWordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability7.1 High
- arraytics timeticsWordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerability6.5 Medium
- stiofan userswpWordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability6.5 Medium
- villatheme lookzyWordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability6.5 Medium
- makeplane planePlane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token7.4 High
- makeplane planePlane: Cross-tenant stored XSS in intake enables account takeover8.7 High
- makeplane planePlane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization8.5 High
- makeplane planePlane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/8.7 High
- makeplane planePlane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)6.5 Medium
- makeplane planePlane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users6.5 Medium
- techfry tf content, joomlafry.com tf content for joomla +1 moreJoomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.46.9 Medium
- Show moreLoading…