CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- shahjahan jewel fluentcommunityWordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerability4.3 Medium
- videowhisper broadcast live videoWordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerability5.3 Medium
- apache software foundation answerApache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions4.3 Medium
- apache software foundation answerApache Answer: Improper Authorization in Question Invite User Lookup5.3 Medium
- mispMISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings5.3 Medium
- apache software foundation kylinApache Kylin: missing JDBC-config authorization6.5 Medium
- mispMISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control7.1 High
- opengauss-serverpg_read_binary_file_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块4.3 Medium
- app cheap builder, unknown app builder +1 moreApp Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php5.3 Medium
- unknown snap financeSnap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions5.3 Medium
- themetechmount truebookerTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification5.3 Medium
- themetechmount truebookerTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions5.3 Medium
- themetechmount truebookerTrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data5.3 Medium
- unknown bdm digital payment gatewayBDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery5.3 Medium
- unknown snap financeSnap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment5.3 Medium
- quomodosoft elementsready addons for elementorElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter5.3 Medium
- unknown activetrail for woocommerceActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation5.3 Medium
- google samInsecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)9.3 Critical
- google samMissing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)9.3 Critical
- aircheng-org iwebshop-5aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgery5.3 Medium
- giteaGitea API disclosure of private user social graph, keys and stars6.5 Medium
- giteaGitea watched repositories API disclosure after access revocation4.3 Medium
- dyad-sh dyaddyad-sh dyad OAuth Callback cross-site request forgery5.3 Medium
- vanus-labs vanusVanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs7.2 High
- kit (formerly convertkit)WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability6.5 Medium
- saad iqbal advanced file managerWordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability6.5 Medium
- jordy meow ai engineAI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media4.9 Medium
- jordy meow ai engineAI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media4.9 Medium
- strategy11 team tasty recipes liteTasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion4.9 Medium
- pickplugins product designer for woocommerce, unknown pickplugins product designer for woocommerce +1 moreProduct Designer <= 1.0.40 - Unauthenticated Design Template Data Injection5.3 Medium
- david-crty databasementDavid-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization5.1 Medium
- cozy vision sms alert order notificationsWordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerability4.3 Medium
- admidioAdmidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed6.9 Medium
- admidioAdmidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php7.1 High
- thorsten phpmyfaqphpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads7.1 High
- thorsten phpmyfaqphpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints7.1 High
- thorsten phpmyfaqphpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard5.3 Medium
- unknown acf frontend admin by dynamiappsFrontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission5.3 Medium
- patreon wordpress, unknown patreon wordpress +1 morePatreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration3.7 Low
- thimpress learnpress – wordpress lms plugin for create and sell online coursesLearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action6.5 Medium
- murgroland wp booking system – booking calendarWP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action7.5 High
- murgroland wp booking system – booking calendarWP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse6.8 Medium
- murgroland wp booking system – booking calendarWP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action6.5 Medium
- hostspa fastcache by host.itFastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook4.3 Medium
- frappe hrmsFrappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS6.5 Medium
- lingguoai lingguo-dramaLingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API8.7 High
- allegro ralphAllegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API5.3 Medium
- smartloli efakEFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys7.1 High
- smartloli efakEFAK through 5.1.0 Privilege Escalation via /api/users REST API8.7 High
- ekkolearnai ekko-studioEkko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips5.3 Medium
- Show moreLoading…