CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- froxlorFroxlor 0.10.0 before 2.3.15 Missing Authorization via SubDomains.delete API5.3 Medium
- codewithcj sparkyfitnessSparkyFitness before 0.17.0 Missing Authorization via food-variants DELETE Endpoint5.3 Medium
- usememos memosMemos before 0.27.0 Missing Authorization via ActivityService ListActivities/GetActivity5.3 Medium
- sharkordSharkord before 0.0.26 Missing Authorization via changeLogo tRPC Route5.3 Medium
- sharkordSharkord before 0.0.8 Missing Authorization via updateSettings tRPC Route5.3 Medium
- eclipse foundation threadxModule delete dispatchers do not enforce kernel-object ownership before irreversible deletion6.9 Medium
- wp user manager user managerWordPress WP User Manager plugin <= 2.9.25 - Broken Access Control vulnerability4.3 Medium
- magepeople inc. bus ticket booking with seat reservationWordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability5.3 Medium
- arraytics bookticsWordPress Booktics plugin <= 1.0.30 - Broken Access Control vulnerability5.3 Medium
- elightup meta box – wordpress custom fields frameworkWordPress Meta Box – WordPress Custom Fields Framework plugin <= 5.15.2 - Broken Access Control vulnerability6.5 Medium
- a2aproject a2a-javaA2A Java SDK has a fail-open default task authorization7.5 High
- castos seriously simple podcastingWordPress Seriously Simple Podcasting plugin <= 3.17.0 - Broken Access Control vulnerability5.3 Medium
- unblu inc. sparkUnblu Spark Authorization Bypass in Configuration Cascade Operations9.3 Critical
- opencatsOpenCATS before 0.10.0 Missing Authorization in Reports Module EEO Reports5.3 Medium
- opencatsOpenCATS before 0.10.0 Missing Authorization via Import Revert Action5.3 Medium
- opencatsOpenCATS before 0.10.0 Missing Authorization in Saved-List AJAX Endpoints5.3 Medium
- opencatsOpenCATS before 0.10.0 Missing Authorization via ajax/testEmailSettings.php5.3 Medium
- opencatsOpenCATS before 0.10.0 Missing Authorization via Activity AJAX Endpoints5.3 Medium
- typo3 extension "fal protect"Broken Access Control in extension "FAL Protect" (fal_protect)6.3 Medium
- typo3 extension "sgalinski cookie consent"Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)5.3 Medium
- typo3 extension "sgalinski cookie consent"Missing Authorization in extension "sgalinski Cookie Consent" (sg_cookie_optin)7.1 High
- typo3 extension "typo3 shop by coding.ms"Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)6.9 Medium
- typo3 extension "typo3 shop by coding.ms"Broken Access Control in extension "TYPO3 Shop by coding.ms" (shop)6.9 Medium
- typo3 extension "typo3 ai integration extension"Broken Access Control in extension "TYPO3 AI Integration Extension" (ns_t3ai)7.2 High
- typo3 extension "analytics"Broken Access Control in extension "Analytics" (analytics)5.3 Medium
- apple ipados, ios and ipados, iphone os +2 moreAn authorization issue was addressed with improved state management. This issue is fixed in iOS...5.5 Medium
- apple macosAn authorization issue was addressed with improved state management. This issue is fixed in macOS...5.5 Medium
- apple macosAn authorization issue was addressed with improved entitlement checks. This issue is fixed in...4.4 Medium
- apple macos, visionos +1 moreAn authorization issue was addressed with improved state management. This issue is fixed in...5.5 Medium
- evoscientistEvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents9.3 Critical
- tracer-cloud opensreOpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection9.3 Critical
- traefikTraefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations6.4 Medium
- wso2 forgerock key manager component, api control plane, api manager +1 more +3 moreRefresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption5.4 Medium
- mljar mercuryMercury: Unauthenticated Remote Code Execution via /api/kernels9.8 Critical
- fossbillingFOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions2.3 Low
- progressive robot ltd hmailserverMissing Authorization in hMailServer6.5 Medium
- progressive robot ltd hmailserverMissing Authorization in hMailServer6.5 Medium
- camunda 7Camunda Missing Authorization in Task Sub-Resources8.6 High
- automattic sensei lmsSensei LMS 4.26.4 Broken Access Control via save_new_message5.3 Medium
- automattic sensei lmsSensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX5.3 Medium
- boxyhq saas-starter-kitBoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API5.3 Medium
- operacle checkcleCheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules9.3 Critical
- flarum extension managerFlarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API6.9 Medium
- risingwavelabs risingwaveRisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors7.1 High
- churchcrm crmFrappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log5.3 Medium
- churchcrm crmFrappe CRM before 1.81.2 Missing Authorization on CRM Notification Records5.3 Medium
- surferWordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability5.4 Medium
- yith woocommerce product bundlesWordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability5.3 Medium
- shahjahan jewel fluentformWordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability5.3 Medium
- thimpress learnpressWordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability5.4 Medium
- Show moreLoading…