CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- red hat jboss enterprise application platform 7, jboss enterprise application platform 8.1, jboss enterprise application platform expansion pack +1 more +3 moreWildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean6.5 Medium
- unknown hide price until loginHide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration5.3 Medium
- af themes wp post authorWP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields3.7 Low
- unknown link libraryLink Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass5.3 Medium
- supsysticcom contact form by supsysticContact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion5.3 Medium
- octopus deploy serverIn affected versions of Octopus Server with the LDAP authentication provider enabled, any...5.3 Medium
- domoticzDomoticz: Missing authorization and path traversal in the udevices Lua parser handler5.4 Medium
- wwbn avideo-encoderAVideo-Encoder: missing authentication on control and status endpoints7.3 High
- bricks builderBricks Broken Access Control via query_result Endpoint7.5 High
- pi websolution piweb disable payment method / partial payment for woocommercePiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees6.9 Medium
- dolibarr erp/crmDolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php6.9 Medium
- drupal oauth2 token managerOAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-2904.8 Medium
- dalibo postgresql anonymizerPostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query6.5 Medium
- dalibo postgresql anonymizerPostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker views4.8 Medium
- dalibo postgresql anonymizerPostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent5.7 Medium
- dalibo postgresql anonymizerPostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles3.5 Low
- eugeny russhrussh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation8.3 High
- drupal commerce coreCommerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-2546.5 Medium
- jenkins project jenkinsA missing permission check in Jenkins 2.587 and earlier, LTS 2.580.1 and earlier allows attackers...4.3 Medium
- jenkinsJenkins 2.587 and earlier, LTS 2.580.1 and earlier converts the launch commands in older agent...8.8 High
- apache software foundation kafkaApache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs6.5 Medium
- fogprojectFOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution8.8 High
- yosemitecrew yosemite-crewYosemiteCrew: Missing organization authorization on service and PMS library/template routes8.3 High
- xibosignage xibo-cmsXibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure5.4 Medium
- xibosignage xibo-cmsXibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices4.3 Medium
- xibosignage xibo-cmsXibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments6.5 Medium
- xibosignage xibo-cmsXibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export6.5 Medium
- xibosignage xibo-cmsXibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion7.1 High
- getnora-io noraNORA missing cross-user token-management authorization7.1 High
- ihomefinder, inc. optima expressWordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability7.5 High
- david anderson redux frameworkWordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability6.5 Medium
- wphocus my auctions allegroWordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability5.4 Medium
- unknown essential addons for elementorEssential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification5.3 Medium
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...7.1 High
- dell powerprotect data domain management centerDell PowerProtect Data Domain Management Center, Feature Release versions 7.7.1.0 through 8.8,...9.6 Critical
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...6.5 Medium
- dell powerprotect data domainDell PowerProtect Data Domain, Feature Release versions 7.7.1.0 through 8.8, LTS2024 release...9.8 Critical
- shortpixel enable media replaceEnable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow4.3 Medium
- hwk-fr advanced custom fields: extendedAdvanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints5.3 Medium
- hornero clean loginClean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook4.3 Medium
- magepeopleteam travelly – tour & travel booking manager for woocommerceTravelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter4.3 Medium
- barrykooij related posts for wordpressRelated Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter4.3 Medium
- richplugins rich showcase for google reviewsRich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page6.5 Medium
- barrykooij related posts for wordpressRelated Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter4.3 Medium
- quantumcloud ai chatbot for woocommerce – woowbotAI ChatBot for WooCommerce <= 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Action4.3 Medium
- odefranca paypal brasil para woocommerce, paypal brasil para woocommerce +1 morePayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action5.3 Medium
- payplug for woocommerce (official), unknown payplug for woocommerce (official) +1 morePayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure6.5 Medium
- unknown wporloginWPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update6.5 Medium
- unknown royal addons for elementorRoyal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe5.3 Medium
- unknown royal addons for elementorRoyal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision3.8 Low
- Show moreLoading…