CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- frappe erpnextFrappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints6.9 Medium
- frappe erpnextFrappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification7.2 High
- frappe erpnextFrappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification7.1 High
- frappe erpnextFrappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data7.1 High
- frappe erpnextFrappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints5.3 Medium
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints7.1 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization in Endpoints5.3 Medium
- frappe erpnextFrappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint5.3 Medium
- frappe erpnextERPNext: Unauthorised status modification due to missing validation7.7 High
- frappe erpnextFrappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization7.1 High
- frappe erpnextFrappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data7.1 High
- frappe erpnextFrappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data7.1 High
- frappe erpnextFrappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data7.1 High
- frappe erpnextFrappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization5.3 Medium
- frappe erpnextFrappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization5.3 Medium
- frappe erpnextFrappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass7.1 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints7.1 High
- frappe erpnextFrappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification7.1 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints7.1 High
- frappe erpnextFrappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data7.1 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification7.1 High
- frappe erpnextFrappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints5.3 Medium
- frappe erpnextFrappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification7.1 High
- elated-themes frappeFrappe before 16.31.0 Improper Access Control in Document Follow Notifications6.9 Medium
- elated-themes frappeFrappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification5.3 Medium
- elated-themes frappeFrappe before 16.33.0 Broken Authorization via send_sms Endpoint5.3 Medium
- open-webuiOpen WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy7.2 High
- nangohq nangoNango: Production flow RBAC bypass on private flow-read routes4.3 Medium
- learnhouseLearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint2.3 Low
- snapotter-hq snapotterSnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API5.3 Medium
- frappe erpnextERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods5.3 Medium
- 0xjacky nginx-uiNginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint8.7 High
- weebzone telegram-stremioTelegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs7.1 High
- 0xjacky nginx-uiNginx UI OTP secure-session step-up is missing on sensitive mutation routes8.3 High
- chad butler wp-membersWordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability5.4 Medium
- wpmu dev forminatorWordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability5.3 Medium
- arraytics bookticsWordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability5.4 Medium
- videowhisper broadcast live videoWordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability4.3 Medium
- videowhisper paid videochat turnkey siteWordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerability5.0 Medium
- netcore nr268Netcore NR268 CGI Endpoint cross-site request forgery5.3 Medium
- arraytics bookticsWordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability5.3 Medium
- librenmsLibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController5.3 Medium
- surrealdbSurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE5.3 Medium
- surrealdbSurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH7.1 High
- getgrav grav-plugin-star-ratingsGrav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization6.9 Medium
- getgrav grav-plugin-guestbookGrav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation5.3 Medium
- getgrav grav-plugin-data-managerGrav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin6.9 Medium
- craftcms cmsCraft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition6.0 Medium
- open-webuiOpen WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes5.3 Medium
- open-webuiOpen WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint5.3 Medium
- Show moreLoading…