CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- logicaldoc community editionLogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet7.1 High
- logicaldoc community editionLogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet7.1 High
- logicaldoc community editionLogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService8.7 High
- jishenghua jsherpjshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints5.3 Medium
- jishenghua jsherpjshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey7.1 High
- jishenghua jsherpjshERP through 3.6 Privilege Escalation via PUT /user/updateUser8.7 High
- jishenghua jsherpjshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList5.3 Medium
- jishenghua jsherpjshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter5.3 Medium
- jishenghua jsherpjshERP through 3.6 Missing Authorization via /log/list and /log/info5.3 Medium
- jishenghua jsherpjshERP through 3.6 Missing Authorization via /log Audit Endpoints5.3 Medium
- guchengwuyue yshop-crmyshop-crm through 2.1.3 Missing Authorization via invoice check endpoint5.3 Medium
- guchengwuyue yshop-crmyshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint5.3 Medium
- guchengwuyue yshop-crmyshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check5.3 Medium
- opensource-socialnetworkOpen Source Social Network (OSSN) through 10.1 Missing Authorization via Album Photo Routes6.9 Medium
- wp user manager user managerWordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability4.3 Medium
- wp desk flexible subscriptionsWordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability4.3 Medium
- codection products restricted users for woocommerceWordPress Products Restricted Users for WooCommerce plugin <= 0.7 - Broken Access Control vulnerability5.3 Medium
- bastien ho event postWordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability5.4 Medium
- villatheme tmdsWordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability5.4 Medium
- videowhisper.com videowhisper site manager for chatgpt, claude, codexWordPress VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin <= 1.2.10 - Broken Access Control vulnerability5.4 Medium
- unknown wp comment cleanerWP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_comment6.5 Medium
- yangzongzhuan ruoyiyangzongzhuan RuoYi cross-site request forgery5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig7.1 High
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/delete5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/user/addSysUserGroup5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/user/doUpdateDepartInfo5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsers5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById5.3 Medium
- jeecgbootJeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths5.3 Medium
- unicomai wanwuUnicomAI Wanwu through 0.6.5 Missing Authorization via DELETE /v1/appspace/app/publish5.3 Medium
- thorsten phpmyfaqphpMyFAQ through 4.1.10 Missing Authorization via MCP Server faq_search Tool4.8 Medium
- coreshopCoreShop through 2026.2.2 Missing Authorization via ResourceController listAction5.3 Medium
- abilityai trinityAbilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes5.3 Medium
- dbeaver cloudbeaverCloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet2.3 Low
- Show moreLoading…