CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- jetlinks communityJetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints5.3 Medium
- jetlinks communityJetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save7.1 High
- mateaix matecloudMateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API8.6 High
- b3log symphonyB3log Symphony through 3.6.4 Missing Authorization in Admin Console Routes6.9 Medium
- joraniJorani before 1.0.4 Missing Authorization and SSRF via Contracts::import()5.3 Medium
- joraniJorani before 1.0.4 Missing Authorization in HR Export Actions5.3 Medium
- arraytics wp event solutionWordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability5.3 Medium
- wp chill download monitor integration for woocommerceWordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability4.3 Medium
- leap13 premium addons for elementorWordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability5.3 Medium
- leantimeLeantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods8.8 High
- girishsaraf online-appointment-booking-systemgirishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization6.9 Medium
- girishsaraf online-appointment-booking-systemgirishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization6.9 Medium
- wazuh wazuh-managerWazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker9.4 Critical
- wazuh wazuh-managerWazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command8.7 High
- nvidia aistore frameworkNVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL...8.6 High
- mozilla firefox, thunderbird +1 moreSite isolation issue in the DOM: Web Authentication component9.6 Critical
- bender customer&partnerExposure of Role List to Low-Privileged Remote Users in Bender Custom&Partner Service5.3 Medium
- themegrill user registrationWordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability5.4 Medium
- themegrill user registrationWordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability5.3 Medium
- pluginus.net foxWordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability5.3 Medium
- themegrill user registrationWordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability5.3 Medium
- mahmudul hasan arif fluentboardsWordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerability5.4 Medium
- ameliabooking ameliaWordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability5.3 Medium
- wp user manager user managerWordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability5.3 Medium
- karolína vyskočilová pay for payment for woocommerceWordPress Pay for Payment for WooCommerce plugin <= 3.0.1 - Broken Access Control vulnerability5.3 Medium
- fullworks quick paypal paymentsWordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulnerability5.3 Medium
- wpgraphqlWordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability5.3 Medium
- sap se s/4hana (linear asset management rap business object)Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object)4.7 Medium
- sap se cla-assistantBroken Access Control in CLA-Assistant � CLA Signature PII Disclosure6.5 Medium
- sap se manufacturing integration and intelligence (configuration service)Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)9.1 Critical
- mozilla firefox, thunderbird +1 moreMitigation bypass in the Enterprise Policies component5.4 Medium
- frappe erpnextERPNext: Unauthorised access to financial data due to missing validation6.5 Medium
- frappe erpnextFrappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data7.1 High
- frappe erpnextFrappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification5.3 Medium
- frappe erpnextFrappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints5.3 Medium
- frappe erpnextFrappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints7.1 High
- frappe erpnextFrappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation5.3 Medium
- frappe erpnextFrappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification5.3 Medium
- frappe erpnextFrappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data7.1 High
- frappe erpnextFrappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints7.1 High
- frappe erpnextFrappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data7.1 High
- frappe erpnextFrappe ERPNext before 15.115.0 Missing Authorization on Endpoints7.1 High
- frappe erpnextFrappe ERPNext before 15.118.2 Unauthorized Item Master Data Access7.1 High
- frappe erpnextFrappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints7.1 High
- frappe erpnextFrappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints5.3 Medium
- frappe erpnextFrappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data7.1 High
- frappe erpnextFrappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization7.1 High
- frappe erpnextFrappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data7.1 High
- frappe erpnextFrappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data7.1 High
- frappe erpnextFrappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints5.3 Medium
- Show moreLoading…