CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- themegrill user registrationWordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability5.6 Medium
- magepeople inc. deposits and partial payments for woocommerceWordPress Deposits and Partial Payments for WooCommerce plugin <= 4.0.1 - Broken Access Control vulnerability6.5 Medium
- codemstory 워드프레스 결제 심플페이WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability6.5 Medium
- ameliabooking ameliaWordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability7.5 High
- profilepress membership team profilepressWordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability5.9 Medium
- profilepress membership team profilepressWordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability6.5 Medium
- dell secure connect gateway (scg) policy manager, policy manager for secure connect gateway +1 moreDell Secure Connect Gateway (SCG) Policy Manager, versions prior to 5.34.00.16, contains a...4.3 Medium
- wp media rocketWordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability6.5 Medium
- unitech web unitechpayUnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned Webhook5.3 Medium
- codesnippetspro code snippetsCode Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet3.3 Low
- unknown social web suiteSocial Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update5.3 Medium
- unknown sku error fixer for woocommerceSKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deletion6.5 Medium
- microsoft azure event grid, azure event grid system +1 moreAzure Event Grid Spoofing Vulnerability7.7 High
- hazelcastHazelcast: Authorization bypass in IMap Predicates API8.7 High
- banq jivejdonJivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move5.3 Medium
- hewlett packard enterprise hpe intelligent management center (imc), hpe intelligent management center (imc) +1 moreAn authentication bypass vulnerability exists in HPE Intelligent Management Center (iMC) prior to...9.1 Critical
- indicoIndico: Missing access check in legacy session export API4.3 Medium
- openstack mistralIn OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request...7.1 High
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation4.3 Medium
- caz informatics services trade inc. advancity alms cloudIDOR in Caz Informatics' Advancity ALMS Cloud6.5 Medium
- creator lms lms, wpfunnels creator lms +1 moreWordPress Creator LMS plugin <= 1.2.21 - Broken Access Control vulnerability5.3 Medium
- liquid web / stellarwp event ticketsWordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability4.3 Medium
- villatheme coreWordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability4.3 Medium
- liquid web / stellarwp event ticketsWordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability5.4 Medium
- visual composer website builderWordPress Visual Composer Website Builder plugin <= 45.16.3 - Broken Access Control vulnerability5.3 Medium
- bdthemes ultimate post kitWordPress Ultimate Post Kit plugin <= 4.5.5 - Broken Access Control vulnerability6.5 Medium
- yith woocommerce product bundlesWordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability5.3 Medium
- liquid web / stellarwp givewpWordPress GiveWP plugin <= 4.18.0 - Broken Access Control vulnerability5.3 Medium
- progressive robot ltd hmailserverMissing Authorization in hMailServer7.8 High
- easy digital downloads digital downloads, unknown easy digital downloads +1 moreEasy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabled5.3 Medium
- unknown tutorstarterTutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX5.3 Medium
- apache software foundation dolphinschedulerApache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials7.1 High
- unknown backwpupBackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php5.3 Medium
- brocade fabric os, broadcom fabric operating system +1 moreA missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of...5.1 Medium
- splunk, splunk enterprise, secure gateway +2 moreMissing Access Control through the REST API in Splunk Secure Gateway4.3 Medium
- aws amazon athenaMissing authorization checks in Amazon Athena engine version 3 request handling6.3 Medium
- wpmu dev forminatorWordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability7.5 High
- drupal easy breadcrumbEasy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-2123.7 Low
- drupal dkanDKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-2085.3 Medium
- drupal xray auditXray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-2066.5 Medium
- drupal views shareViews Share - Moderately critical - Access bypass - SA-CONTRIB-2026-2055.3 Medium
- cisco license on-premCisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability9.1 Critical
- @backstage plugin-kubernetes-backend, backstage, linuxfoundation backstage\/plugin-kubernetes-backend +2 moreBackstage: Improper entity validation in deprecated Kubernetes services endpoint5.3 Medium
- wger-project wgerwger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry6.5 Medium
- sc internet vivoo wp rentalsWordPress WP Rentals theme <= 3.14.2 - Broken Access Control vulnerability5.3 Medium
- arraytics bookticsWordPress Booktics plugin <= 1.0.27 - Broken Access Control vulnerability4.3 Medium
- wp chill modula image galleryWordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability5.3 Medium
- wpmu dev hustleWordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability4.3 Medium
- veeam backup and replicationThis vulnerability in Veeam Backup & Replication allows a Backup Viewer to modify the Enterprise...6.1 Medium
- veeam agent for windowsThis vulnerability in Veeam Agent for Microsoft Windows allows any local user to terminate...6.8 Medium
- Show moreLoading…