CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- 10up restricted site accessWordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability5.3 Medium
- unknown paymentfor gateway for woocommercePaymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks5.3 Medium
- unknown sifalo paySifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure5.3 Medium
- artbees sellkitSellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' Parameter5.3 Medium
- robokassa payment gateway for woocommerce, unknown robokassa payment gateway for woocommerce +1 moreRobokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed5.3 Medium
- unknown wp encryptionWP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler6.5 Medium
- unknown ltl freight quotesLTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route5.3 Medium
- radiustheme classified listingClassified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers5.9 Medium
- unknown campay shortcode payment gatewayCamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference5.3 Medium
- rank math seo math seo, unknown rank math seo +1 moreRank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion5.3 Medium
- wpwax directorist: ai-powered business directory, listings & classified adsDirectorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter8.1 High
- masaakitanaka booking packageBooking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'7.5 High
- google chromeMissing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote...4.2 Medium
- omnispace agora projectOmnispace Agora Project < 26.10.0 Broken Function-Level Authorization via User-Edit7.1 High
- omnispace agora projectOmnispace Agora Project < 26.10.0 Broken Access Control via spaceAffectList8.6 High
- microsoft windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 +8 more +10 moreRole: DNS Server Tampering Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +25 more +27 moreWindows Group Policy Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows server 2012 +12 more +14 moreRole: DNS Server Tampering Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWebDAV Elevation of Privilege Vulnerability7.8 High
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +7 more +9 moreWindows Kernel-Mode Drivers Elevation of Privilege Vulnerability7.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 moreWindows Modern Device Management (MDM) Tampering Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWindows Routing and Remote Access Service (RRAS) Tampering Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Overlay Filter Tampering Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +25 more +27 moreWindows Network List Service Tampering Vulnerability5.5 Medium
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Elevation of Privilege Vulnerability8.8 High
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +26 more +28 moreWebDAV Security Feature Bypass Vulnerability6.5 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +15 more +17 moreWindows Broadcast DVR User Service Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 moreWindows Error Reporting Information Disclosure Vulnerability5.5 Medium
- microsoft windows 10 version 1607, windows 10 version 1809, windows 10 version 21h2 +22 more +24 moreWindows Geotag Broker Elevation of Privilege Vulnerability7.8 High
- microsoft windows server 2012, windows server 2012 (server core installation), windows server 2012 r2 +8 more +10 moreRole: DNS Server Tampering Vulnerability5.5 Medium
- microsoft windows 10 version 21h2, windows 10 version 22h2, windows 11 version 23h2 +14 more +16 moreWindows AppX Deployment Extensions Elevation of Privilege Vulnerability8.8 High
- microsoft windows 10 version 1809, windows 10 version 21h2, windows 10 version 22h2 +18 more +20 moreWindows AppX Deployment Service Tampering Vulnerability5.5 Medium
- microsoft windows 11 version 24h2, windows 11 version 25h2, windows 11 version 26h1 +7 more +9 moreWindows Event Tracing Spoofing Vulnerability5.5 Medium
- microsoft visual studio codeVisual Studio Code Remote Code Execution Vulnerability8.8 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Elevation of Privilege Vulnerability8.8 High
- microsoft visual studio codeVisual Studio Code Security Feature Bypass Vulnerability7.8 High
- sergix44 xbackboneXBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint5.3 Medium
- webkul qloappsQloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips5.3 Medium
- webkul aureus erpAureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL6.3 Medium
- youlaitech youlai-bootyoulai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint7.1 High
- youlaitech youlai-bootyoulai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege Escalation8.7 High
- iflytek skillhubSkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint7.2 High
- phase consolePhase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query6.0 Medium
- stonewuu ai-fusion-videoai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials7.1 High
- wukongopensource wukong aicrmWukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys7.1 High
- wukongopensource wukong aicrmWukong AICRM through 20260610 Missing Authorization in User and Role Management APIs8.7 High
- fortinet fortisiemA missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute...3.4 Low
- liuyuyang01 thrivex-serverThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints6.9 Medium
- makunet maku-bootMakunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints7.1 High
- 1024-lab smartadminSmartAdmin through 3.30.0 Missing Authorization via AdminProtectController7.1 High
- Show moreLoading…