CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint5.3 Medium
- villatheme ald – dropshipping and fulfillment for aliexpress and woocommerceWordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.4 - Broken Access Control vulnerability4.3 Medium
- wpmu dev forminatorWordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability7.5 High
- dmitry v. barcode scanner with inventory & order managerWordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability7.3 High
- upcasted aws s3 for wordpress plugin – upcastedWordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability6.3 Medium
- stylemix ulistingWordPress uListing plugin <= 2.2.0 - Settings Change vulnerability7.6 High
- themegoods dkWordPress DK theme <= 3.2.1 - Broken Access Control vulnerability7.5 High
- themegoods grand newsWordPress Grand News theme <= 3.4 - Broken Access Control vulnerability7.5 High
- automattic jetpack videopressWordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability6.5 Medium
- pubjet | پابجتWordPress Pubjet | پابجت plugin <= 5.4.8 - Settings Change vulnerability7.6 High
- wordableWordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability8.1 High
- rashid wpsectionWordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability8.1 High
- web impian bayarcash woocommerceWordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability7.5 High
- villatheme gift4uWordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability6.9 Medium
- tencentcloud octopOctop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers7.1 High
- immich-app immichImmich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata5.3 Medium
- rubengc automatorwp – no-code workflow automation, integration & webhooks plugin, now with aiAutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action4.3 Medium
- stylemixthemes motorsWordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability7.5 High
- bestwpdeveloper wp cv builderCV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload5.3 Medium
- joomunited wp file downloadWP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions8.1 High
- techjewel fluent forms – customizable contact forms, survey, quiz, & conversational form builderFluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification5.4 Medium
- unknown accept paypal payments using contact form 7Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status Forgery5.3 Medium
- senols ai puffer – ai chatbot, ai writer & automationAI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action3.1 Low
- senols ai puffer – ai chatbot, ai writer & automationAI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint3.1 Low
- rtcamp rtmedia for wordpress, buddypress and bbpressrtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files[tmp_name]' Parameter7.5 High
- elemntor hello plusHello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site5.4 Medium
- kodezen academy lms – ai course builder, quizzes, certificates & elearningAcademy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id6.5 Medium
code.vikunja.io/apiGoVikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal2.3 Lowcode.vikunja.io/apiGoVikunja: Cross-project task disclosure through subtask expansion6.0 Mediumcode.vikunja.io/apiGoVikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID6.3 Medium- contaoContao: Improper access control in the preview links module4.3 Medium
- nginxui nginx ui, 0xjacky nginx-ui +1 moreNginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up8.8 High
- 0xjacky nginx-ui, nginxui nginx ui +1 more0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser8.8 High
- ageerle ruoyi-airuoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint5.3 Medium
- ageerle ruoyi-airuoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search5.3 Medium
- illumos illumos-gate, omnios +1 moreMissing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones1.9 Low
- illumos illumos-gate, omnios +1 moreMissing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership1.9 Low
- bplugins before after image comparison – image comparison for wpWordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability5.4 Medium
- themehunk th shop maniaWordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability7.1 High
- syed balkhi envira galleryEnvira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint5.3 Medium
- asgaros forumWordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Control vulnerability4.3 Medium
- dev institute restrict user access – membership plugin with forceWordPress Restrict User Access – Membership Plugin with Force plugin <= 2.8.1 - Broken Access Control vulnerability5.3 Medium
- ashok dudhat wp event manager, wp event manager event manager +1 moreWordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerability5.4 Medium
- unfocus projects scripts n stylesWordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability5.3 Medium
- cool plugins ai translation for polylangWordPress AI Translation for Polylang plugin <= 1.6.2 - Broken Access Control vulnerability5.4 Medium
- unknown livees checkoutLivees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure6.5 Medium
- morkva shipping for nova poshtaShipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion5.3 Medium
- Show moreLoading…