CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- wp chill strong testimonialsWordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability5.4 Medium
- wp e-signature ninja forms signature contract add-onWordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vulnerability5.3 Medium
- saad iqbal wp easypayWordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability5.3 Medium
- jordy meow ai engineWordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability4.3 Medium
- wordliftWordPress WordLift plugin <= 3.54.15 - Broken Access Control vulnerability5.4 Medium
- saad iqbal apiexperts square for woocommerceWordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability5.3 Medium
- wp chill strong testimonialsWordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability4.3 Medium
- sonatype nexus repository 3Nexus Repository 3 - Privilege Escalation via Role Management8.7 High
- sonatype nexus repository 3Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload7.1 High
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules...6.5 Medium
- espocrmEspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment6.0 Medium
- espocrmEspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users6.5 Medium
- espocrmEspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record4.3 Medium
- espocrmEspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes6.5 Medium
- themegrill user registrationWordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability7.1 High
- elemntor elementor website builder – more than just a page builderElementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters4.3 Medium
- themeum tutor lmsTutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite7.5 High
- unknown easy https redirection (ssl)Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite4.2 Medium
- unknown easync bookingeaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update5.3 Medium
- quadlayers checkout field manager (checkout manager) for woocommerceCheckout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID8.1 High
- crestalnetwork intentkitIntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode8.7 High
- No product listedELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management...8.8 High
- tp-link systems inc. omada software controllerImproper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API7.5 High
- tp-link system inc. omada software controller (windows)Insufficient Authorization and User Boundary Validation in Omada Controller MSP7.5 High
- error311 fileriseFileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares8.2 High
- openaev-platform openaevOpenAEV has unauthenticated access and missing object-level authorization on player lessons API8.2 High
- makeplane planePlane: Any project member can modify (deactivate) other members' records6.5 Medium
- growchiefGrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint5.3 Medium
- we-promise sureSure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update5.3 Medium
- dgraph-io dgraphDgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service9.2 Critical
- pipecat-ai pipecatPipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation5.6 Medium
- skydropxWordPress Skydropx plugin <= 2.1.4 - Broken Access Control vulnerability8.2 High
- microsoft sharepoint server subscription edition, sharepoint server +1 moreMicrosoft Office SharePoint Elevation of Privilege Vulnerability8.8 High
- zulipZulip: Guests can read new messages in non-subscribed public channels6.5 Medium
- discourseDiscourse: Chat MessageBus delivers read-restricted messages to unauthorized users7.5 High
- krayin laravel-crmVentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions7.1 High
- papermerge papermerge-corePapermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all2.3 Low
- papermerge papermerge-corePapermerge Core through 3.5.3 Missing Authorization in Shared Nodes API7.7 High
- papermerge papermerge-corePapermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints7.7 High
- swetrixSwetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId8.7 High
- rachelos we-mp-rsswe-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint6.3 Medium
- jishenghua jsherpjshERP through 3.6 Missing Authorization via /user/batchSetStatus7.1 High
- usekaneo kaneoKaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access7.7 High
- videowhisper paid videochat turnkey siteWordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability7.3 High
- muralidharan ramasamy push notification for post and buddypressWordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability6.5 Medium
- skyhook-io radarRadar < 1.12.2 Missing Authorization via /api/local-terminal8.7 High
- magepeople inc. bus ticket booking with seat reservationWordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability6.5 Medium
- miniorange wp oauth serverWordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability6.5 Medium
- crocoblock jetformbuilderWordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability7.5 High
- jegtheme jeg kit for elementor – powerful addons for elementor, widgets & templates for wordpressJeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action6.5 Medium
- Show moreLoading…