CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- clickvisualClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module5.3 Medium
- beizhu-1209 aihelmsAIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API5.3 Medium
- piranhacms piranha cmsPiranha CMS through 12.2 Missing Authorization in Manager Language API5.3 Medium
- 3xxx engineercmsEngineercms through 2.0.5 Missing Authorization via AttachController.Attachment6.9 Medium
- javahuang surveykingSurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview8.2 High
- moul sshportalsshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keys8.3 High
- 10up distributorDistributor before 2.3.2 Missing Authorization in External Connection AJAX Actions5.3 Medium
- 10up distributor10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action5.3 Medium
- hcengineering huly platformHuly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC8.6 High
- devolutions server, mariadb +1 moreMariaDB: Unauthorized file access via CONNECT engine UDFs5.4 Medium
- finsys dockhandDockhand: Unauthenticated container exec via WebSocket upgrade9.6 Critical
- j4care dcm4chee-arc-lightJ4Care dcm4che Missing Authorization8.8 High
- wp chill passsterWordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability5.3 Medium
- liquid web / stellarwp advanced post managerWordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability7.1 High
- yith paypal express checkout for woocommerce, yithemes yith paypal express checkout for woocommerce +1 moreWordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability5.3 Medium
- liquid web / stellarwp bookitWordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability5.3 Medium
- arraytics wp event solutionWordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability5.3 Medium
- pt norther lights production mapsvgWordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability5.3 Medium
- apache software foundation kylinApache Kylin: Missing authorization and path-confinement on system meta dump9.1 Critical
- bogdan bendziukov squeezeSqueeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment5.4 Medium
- ikus-soft rdiffwebMissing Authorization in rdiffweb8.8 High
- mattermost, mattermost server +1 moreMattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users4.3 Medium
- mattermost, mattermost server +1 moreMissing server side validation allowed user to quarantine a DM and GM post6.4 Medium
- gemini labs site reviewsWordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability5.3 Medium
- tusharimran wp map block – google maps, openstreetmap, mapbox, store & shop locator, directory, listings & filtersWP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints4.3 Medium
- jordy meow photo engine (media organizer & lightroom)Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action6.8 Medium
- dimitri grassi salon booking systemSalon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status5.3 Medium
- unknown mb custom post types & custom taxonomiesMB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration4.2 Medium
- unknown visual form builderVisual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization4.3 Medium
- wpchill modula image gallery – photo grid & video galleryModula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT7.5 High
- niklaslindemann bulk page generator – lpageryBulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow4.3 Medium
- klarnaplugin klarna for woocommerceKlarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint7.5 High
- teamfunnelkit funnelkit – funnel builder plugin for woocommerce checkoutFunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter7.5 High
- wpdevteam notificationx – fomo, live sales notification, woocommerce sales popup, gdpr, social proof, announcement banner & floating notification barNotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route5.3 Medium
- moxa aig-302 seriesMissing Authorization on Secret Endpoints6.9 Medium
- lenovo baiying pc clientA potential improper authorization vulnerability was reported in Lenovo Baiying PC Client,...7.0 High
- peppermint lab peppermintPeppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints5.3 Medium
- papermarkPapermark through 0.22.0 Missing Authorization in Data Room Viewer Group API2.3 Low
- puemos craftplanCraftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL6.9 Medium
- pig-mesh pigpig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}5.3 Medium
- nivocartNivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download8.7 High
- ivanti connect secureIvanti Connect Secure 22.8R2.4 mishandles the manner in which the dsinvoked broker trusts DSCache...7.0 High
- energizelab station-middlewareEnergizeLab Station Middleware Admin APIs Missing Role Checks9.6 Critical
- openstack horizon, the opennms group meridian +1 moreOpenNMS REST authorization bypass via non-canonical HTTP method9.1 Critical
- planet studio planetstudio payment gatewayWordPress PlanetStudio Payment Gateway plugin <= 1.3.3 - Broken Access Control vulnerability5.3 Medium
- hamid alinia login with phone numberWordPress Login with phone number plugin <= 1.8.77 - Broken Access Control vulnerability4.3 Medium
- designthemes knowledge baseWordPress Knowledge Base plugin <= 3.2.0 - Broken Access Control vulnerability5.3 Medium
- wp desk flexible quantity – measurement price calculator for woocommerceWordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.23 - Broken Access Control vulnerability5.3 Medium
- sunshinephotocart sunshine photo cartWordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability5.3 Medium
- wpdreams ajax search liteWordPress Ajax Search Lite plugin <= 4.14.5 - Broken Access Control vulnerability5.3 Medium
- Show moreLoading…