CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- apple ipados, macos, visionos +3 more +5 moreA permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7.2...5.5 Medium
- apple macosA permissions issue was addressed with improved validation. This issue is fixed in macOS Golden...5.5 Medium
- hashicorp consul, consul enterprise +1 moreConsul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API7.5 High
- villatheme customer coupons for woocommerceWordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability4.3 Medium
- thimpress learnpressWordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability5.3 Medium
- thimpress learnpressWordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability5.4 Medium
- ameliabooking ameliaWordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability5.3 Medium
- google mcp toolbox for databases (googleapis/mcp-toolbox)Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write9.3 Critical
- No product listedA broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restrict…6.5 Medium
- churchcrm crmFrappe CRM before 1.89.1 Missing Authorization via Phone Lookup API7.1 High
- frappe builderFrappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt5.3 Medium
- supsystic contact form by supsysticWordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability5.3 Medium
- saad iqbal apiexperts square for woocommerceWordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability5.3 Medium
- saad iqbal apiexperts square for woocommerceWordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability4.3 Medium
- cyberhobo geo mashupWordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability5.4 Medium
- wp smart widgets better post & filter widgets for elementorWordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability6.5 Medium
- magepeople inc. booking and rental managerWordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability5.3 Medium
- villatheme bopo – woocommerce product bundle builderWordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability5.3 Medium
- wp discussion board discussion boardWordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerability5.3 Medium
- andy ha departWordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability4.3 Medium
- jordy meow ai engineWordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerability4.3 Medium
- datafeedr product sets pluginDatafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization5.3 Medium
- yeswikiYesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts7.2 High
- parse-community parse-serverParse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB8.8 High
- linkstackorg linkstackLinkStackOrg LinkStack cross-site request forgery5.3 Medium
- instawp connect, unknown instawp connect +1 moreInstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings3.1 Low
- unknown wpvrWP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard4.9 Medium
- stellarwp givewpGiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses2.7 Low
- unknown chikkili- google pay india for woocommerceChikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature5.3 Medium
- faveosuite faveo helpdeskFaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization6.9 Medium
- magepeople inc. wpeventlyWordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability6.5 Medium
- knit pay upi qr code payment gateway for woocommerceWordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability7.5 High
- bottelet daybydaycrmDaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign5.3 Medium
- quadlayers wp social feed galleryWordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability6.5 Medium
- brainstorm force suredashWordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability6.5 Medium
- cervantessec cervantesBroken access control in JiraController7.1 High
- blazethemes news kit addons for elementorNews Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form5.4 Medium
- blazethemes news kit addons for elementorNews Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer4.3 Medium
- madrasthemes mas videosMAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist6.5 Medium
- unknown advanced twenty seventeenAdvanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme5.4 Medium
fastmcpPyPI,fastmcp-slimPyPI +1 moreFastMCP: Post-transform component authorization is skipped on direct calls6.8 Medium- tenda f6Tenda F6 Web Management cross-site request forgery5.3 Medium
- intranda goobi-viewer-coreGoobi viewer: WebSocket endpoints lack server-side authentication and origin validation6.5 Medium
- dji crystalsky zs600cDJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization7.0 High
- dji crystalsky zs600cDJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root8.6 High
- zimbra collaboration suiteZimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation8.7 High
- hallo welt! gmbh bluespiceBlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users7.1 High
- magepeople inc. car rental managerWordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability6.5 Medium
- knit pay payWordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability6.5 Medium
- amauri wpmobile.appWordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability7.5 High
- Show moreLoading…