CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- google chromeUse after free in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...9.6 Critical
- google chromeUse after free in Frames in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeUse after free in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeMemory corruption in ShadowDOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...8.8 High
- google chromeMemory corruption in Views in Google Chrome on on Mac prior to 156.0.8078.47 allowed a remote...6.5 Medium
- google chromeMemory corruption in Speech in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...6.5 Medium
- google chromeMissing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeMemory corruption in iOSWebView in Google Chrome on on iOS prior to 156.0.8078.47 allowed a...6.5 Medium
- google chromeMemory corruption in BFCache in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeMemory corruption in SignIn in Google Chrome on on iOS prior to 156.0.8078.47 allowed a remote...6.5 Medium
- google chromeMemory corruption in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a...8.8 High
- google chromeMemory corruption in ServiceWorker in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeMemory corruption in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...8.8 High
- google chromeUse after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeUse after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeImproper input validation in Mobile in Google Chrome on on iOS prior to 156.0.8078.47 allowed a...8.8 High
- google chromeUse after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeUse after free in Glic in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeMemory corruption in Contacts in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...8.8 High
- google chromeMemory corruption in Bluetooth in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...8.8 High
- google chromeUse after free in Accessibility in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...8.8 High
- google chromeUse after free in PerformanceAPIs in Google Chrome prior to 156.0.8078.47 allowed a remote...9.6 Critical
- google chromeUse after free in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeMemory corruption in Extensions in Google Chrome on on Android prior to 156.0.8078.47 allowed a...8.8 High
- google chromeUse after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeMemory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeUse after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeOut of bounds read in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...6.5 Medium
- google chromeUse after free in Chromecast in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeUse after free in Core in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote...9.6 Critical
- google chromeMemory corruption in Compositing in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeMemory corruption in IME in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeImproper input validation in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeUse after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeUse after free in Paint in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeUse after free in Input in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeUse after free in V8 in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...9.6 Critical
- google chromeUse after free in Passwords in Google Chrome on on Android prior to 156.0.8078.47 allowed a...8.8 High
- google chromeUse after free in FileSystem in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeUse after free in WebUI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- amazon kiro crewMissing authorization in the WhatsApp channel in Kiro Crew9.0 Critical
- modelcontextprotocol typescript-sdkMCP TypeScript SDK: Experimental tasks were not tied to the session that created them8.6 High
- apostrophecms apostropheApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)5.3 Medium
- apostrophecms apostropheApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints3.7 Low
- apostrophecms apostropheApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers4.3 Medium
- @apostrophecms import-export, apostrophecms apostrophe +1 moreApostropheCMS: Import API bypasses publication roles for protected content6.5 Medium
- apostrophecms apostropheApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization4.3 Medium
- @apostrophecms import-export, apostrophecms apostrophe +1 moreApostropheCMS: Missing Authentication in `cleanExport` Route3.1 Low
- apostrophecms apostropheApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users4.3 Medium
- apache software foundation couchdbApache CouchDB: Auth bypass in prefixed _users and _replicator databases8.1 High
- Show moreLoading…