CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- dbeaver cloudbeaverCloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation5.3 Medium
- churchcrm crmFrappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document5.3 Medium
- frappe hrmsFrappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation5.3 Medium
- frappe hrmsFrappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount5.3 Medium
- the-commit-company ravenRaven 2.0.0 through 3.0.0 Missing Authorization via join_workspace Invite-Only Bypass5.3 Medium
- the-commit-company ravenRaven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs5.3 Medium
- tianma-if edgeeverEdgeEver through 1.108.0 Missing Authorization via Memo-Template API Routes5.3 Medium
- glpi-project glpiGLPI through 12.0.0 Missing Authorization via ajax/map.php5.3 Medium
- phpipamphpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages5.3 Medium
- rill data rillRill 0.77.0 through 0.90.5 OAuth Missing Authorization via Dynamic Client Registration8.6 High
- combodo itopCombodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController5.3 Medium
- suitecrmSuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate5.3 Medium
- suitecrmSuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point5.3 Medium
- orneryd nornicdbNornicDB through 1.4.1 Missing Authorization via Vector Search Endpoints7.1 High
- unknown wp posts password batch managerWP Posts Password Batch Manager <= 1.1 - Unauthenticated Bulk Post Password Rewrite8.6 High
- unknown insurifyInsurify <= 1.0 - Unauthenticated Arbitrary Option Deletion via removeimg_popup9.1 Critical
- unknown quick quotesQuick quotes <= 1.0.0 - Unauthenticated Integer-Value Option Update9.1 Critical
- unknown insurifyInsurify <= 1.0 - Unauthenticated Arbitrary Option Creation and Overwrite via saveemailtemplatedesign9.1 Critical
- unknown click5 crm add-on to contact form 7click5 CRM add-on to Contact Form 7 <= 1.0.4 - Unauthenticated Arbitrary Options Update9.8 Critical
- unknown click5 crm add-on to gravity formsclick5 CRM add-on to Gravity Forms <= 1.0.3 - Unauthenticated Arbitrary Options Update9.8 Critical
- unknown click5 crm add-on to wpformsclick5 CRM add-on to WPForms <= 1.0.3 - Unauthenticated Arbitrary Options Update9.8 Critical
- unknown click5 crm add-on to ninja formsclick5 CRM add-on to Ninja Forms <= 1.0.1 - Unauthenticated Arbitrary Options Update9.8 Critical
- unknown weddingcity liteWeddingCity Lite <= 1.0.4 - Unauthenticated Arbitrary Post and Attachment Deletion7.5 High
- unknown envira galleryEnvira Gallery < 1.16.2 - Contributor Missing Authorization via Convert Gallery REST Route2.7 Low
- unknown memberheroSimple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_user4.3 Medium
- wukongopensource wukong hrmWukong_HRM through commit 186115e Missing Authorization via EmployeeAspect and EmployeeUtil8.7 High
- elunez eladmineladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint5.3 Medium
- 1panel-dev cordyscrmCordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import5.3 Medium
- 1panel-dev cordyscrmCordysCRM through 1.9.3 Missing Authorization via /approval-resource/push5.3 Medium
- 1panel-dev cordyscrmCordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test5.3 Medium
- 1panel-dev cordyscrm1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort5.3 Medium
- 1panel-dev cordyscrm1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title7.1 High
- 1panel-dev cordyscrm1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints7.1 High
- elunez eladminEladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName7.1 High
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById7.1 High
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/search5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById5.3 Medium
- Show moreLoading…