CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- progressive robot ltd hmailserverMissing Authorization in hMailServer8.1 High
- progressive robot ltd hmailserverMissing Authorization in hMailServer4.3 Medium
- progressive robot ltd hmailserverMissing Authorization in hMailServer6.5 Medium
- bjorntech swish for woocommerceWordPress BjornTech Swish for WooCommerce plugin <= 3.7.8 - Broken Access Control vulnerability6.5 Medium
- enterprisedb warehousepgWarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing...2.3 Low
- enterprisedb warehousepgWarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing...7.1 High
- enterprisedb warehousepgWarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE...5.3 Medium
- magepeople inc. wptravellyWordPress WpTravelly plugin <= 2.3.5 - Broken Access Control vulnerability5.3 Medium
- chamilo chamilo-lmsChamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers6.9 Medium
- chamilo chamilo-lmsChamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController6.9 Medium
- shopperdotcom shopperShopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components8.7 High
- wpdeveloper schedulepressSchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action5.3 Medium
- oneplus oxygenosOnePlus OxygenOS improper neutralization of special elements vulnerability8.5 High
- unknown wava payment pluginWava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook6.5 Medium
- unknown wava payment pluginWava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook5.3 Medium
- jordy meow ai engineAI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt4.9 Medium
- productive minds commerce, unknown productive commerce +1 moreProductive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation4.3 Medium
- unknown smartyparcelSmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion4.3 Medium
- revmakx backup and staging by wp time capsuleBackup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live8.2 High
- moloniMoloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice6.5 Medium
- masaakitanaka booking packageBooking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization5.3 Medium
- unknown ettrick escape room bookingEttrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass5.3 Medium
- triggerdotdev trigger.devTrigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials7.2 High
- triggerdotdev trigger.devTrigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route2.3 Low
- arcadedata arcadedbArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol5.3 Medium
- arcadedata arcadedbArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure5.3 Medium
- arcadedata arcadedbArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH5.3 Medium
- oracle siebel crm, oracle corporation siebel apps - marketing +1 moreVulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing)....4.3 Medium
- oracle siebel crm, oracle corporation siebel crm cloud applications +1 moreVulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component:...6.6 Medium
- oracle siebel crm, oracle corporation siebel crm cloud applications +1 moreVulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component:...4.1 Medium
- oracle peoplesoft enterprise peopletoolsVulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component:...2.9 Low
- google chromeMemory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...8.8 High
- google chromeMemory corruption in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeMemory corruption in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeUse after free in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeUse after free in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeMemory corruption in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...8.8 High
- google chromeUse after free in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...9.6 Critical
- google chromeMemory corruption in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...6.5 Medium
- google chromeMemory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...9.6 Critical
- google chromeMemory corruption in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...8.8 High
- google chromeMemory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...8.8 High
- google chromeMemory corruption in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...6.5 Medium
- google chromeMemory corruption in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...8.8 High
- google chromeImproper input validation in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker...8.8 High
- google chromeUse after free in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...8.8 High
- google chromeImproper input validation in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote...9.6 Critical
- google chromeImproper input validation in API in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeMemory corruption in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote...8.8 High
- google chromeOut of bounds read in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to...6.5 Medium
- Show moreLoading…