CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- litespeedtech litespeed cacheLiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal3.1 Low
- ghozylab popup builderPopup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter3.7 Low
- lxc incusIncus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}7.0 High
- openbaoOpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints2.1 Low
- roskus prospero flow crmMissing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts8.6 High
- smilecdr hapi fhirSmileCDR HAPI FHIR unauthorized read via subscription2.3 Low
- canonical jujuMissing authorization in the unit resources download route in Juju controllers7.1 High
- knime business hubDataApp links without login expose job information to other user in KNIME Business Hub6.3 Medium
- devolutions serverMissing authorization in the PAM AD computer import endpoint in Devolutions Server 2026.3.5.0...4.3 Medium
- schorschii oco-serverOCO-Server: Self-Service Portal uninstall-job authorization bypass6.5 Medium
- cozmoslabs paid member subscriptionsWordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability6.5 Medium
- evershopcommerce evershopEverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API6.9 Medium
- yoomoney юkassa для woocommerceWordPress ЮKassa для WooCommerce plugin <= 2.17.3 - Broken Access Control vulnerability5.3 Medium
- ahmad majestic support, majestic support support +1 moreWordPress Majestic Support plugin <= 1.2.1 - Broken Access Control vulnerability5.3 Medium
- miniorange page restriction wordpress (wp)WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability5.3 Medium
- sunshinephotocart sunshine photo cartWordPress Sunshine Photo Cart plugin <= 3.7.5 - Broken Access Control vulnerability5.3 Medium
- acf extended extendedWordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability7.5 High
- brainstorm force suredashWordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability5.3 Medium
- brainstorm force suredashWordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability5.3 Medium
- ideabox creations powerpack addons for elementorWordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Broken Access Control vulnerability4.3 Medium
- wp chill strong testimonialsWordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerability4.3 Medium
- elightup falcon – wordpress optimizations & tweaksWordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerability5.3 Medium
- wpmet metformWordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerability5.3 Medium
- kings plugins marketkingWordPress MarketKing plugin <= 2.1.72 - Broken Access Control vulnerability5.4 Medium
- digitalme eroomWordPress eRoom plugin <= 1.7.1 - Settings Change vulnerability5.4 Medium
- unknown mb custom post types & custom taxonomiesMB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' Parameter4.8 Medium
- infility global, unknown infility global +1 moreInfility Global < 2.16.25 - Unauthenticated Google Translate API Key Update3.7 Low
- openremoteOpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints9.0 Critical
- splunk soarMissing Authorization through the REST API in Splunk SOAR6.5 Medium
- splunk soarImproper Access Control during App Downloads in Splunk SOAR6.5 Medium
- splunk soarSensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR4.3 Medium
- splunk, splunk enterprise +1 moreMissing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise4.3 Medium
- splunk, splunk enterprise +1 moreImproper Access Control in Field Extraction Management in Splunk Enterprise4.3 Medium
- splunk, splunk enterprise, secure gateway +2 moreMissing Authorization through REST API Endpoints in Splunk Secure Gateway6.5 Medium
- jupyter-server jupyter serverJupyter Server: Gateway WebSocket handler bypasses kernel execute authorization8.8 High
- sourcecodester food order management systemSourceCodester Food Order Management System Admin Endpoint authorization6.9 Medium
- zephyrproject zephyrMissing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer5.3 Medium
- apache software foundation pulsarApache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data8.7 High
- apache software foundation pulsarApache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint5.3 Medium
- apache software foundation pulsarApache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission4.9 Medium
- apache software foundation pulsarApache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic7.2 High
- apache software foundation pulsarApache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints2.3 Low
- drupal tinypngTinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-2463.7 Low
- apache software foundation pulsarApache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants2.3 Low
- digitalme eroomWordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability4.3 Medium
- apache software foundation pulsarApache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands5.3 Medium
- drupal swiper formatterSwiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-2335.3 Medium
- drupal ágora transparency themeÁgora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-2315.3 Medium
- storybookjs storybookStorybook: Missing origin validation in Storybook preview allows code injection from malicious websites8.6 High
- electronElectron: Extension tabs.query returns tab URLs and titles without the tabs permission3.1 Low
- Show moreLoading…