CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- tigroumeow ai engine – mcp server & ai chatbot for wordpress, with claude, chatgpt & geminiAI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration7.5 High
- themekraft buddyformsBuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification5.3 Medium
- dots fraud prevention for woocommerce and eddFraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer Blacklisting5.4 Medium
- keywordrush content egg – affiliate product importer & price comparisonContent Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter4.3 Medium
- keywordrush content egg – affiliate product importer & price comparisonContent Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action4.3 Medium
- socfortress copilotSOCFortress CoPilot: Stored case-report template injection permits backend code execution9.0 Critical
@eeacms/volto-chatbotnpm@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy8.2 High- kubeflow pipelinesKubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads6.5 Medium
- kubeflow pipelinesKubeflow Pipelines: Run log streaming endpoint bypasses namespace authorization, exposing pod execution logs cross-tenant7.5 High
- centreonBroken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure6.5 Medium
- zitadelZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval8.6 High
- progress software ws ftp serverPrivilege Escalation via Missing Authorization in WS_FTP Manager9.1 Critical
- thimpress learnpressWordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability5.4 Medium
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities9.9 Critical
- ibm langflow oss, langflow +1 moreLangflow OSS is affected by multiple vulnerabilities8.8 High
- wedevs happy addons for elementorWordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability6.4 Medium
- wedevs wp erpWordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability4.3 Medium
- miniorange page restriction wordpress (wp)WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability5.3 Medium
- mycredWordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability5.3 Medium
- cozmoslabs profile builderWordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability5.3 Medium
- kit (formerly convertkit)WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability5.3 Medium
- wp desk custom price for woocommerceWordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability5.3 Medium
- brainstorm force suredashWordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability4.3 Medium
- mamunur rashid shopbuilder – elementor woocommerce builder addonsWordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability5.3 Medium
- themegrill user registrationWordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability5.3 Medium
- magepeople inc. taxi booking manager for woocommerceWordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability5.3 Medium
- wpfunnelsWordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability5.3 Medium
- wp desk flexible quantity – measurement price calculator for woocommerceWordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability5.3 Medium
- wpfunnelsWordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability5.3 Medium
- brainstorm force sureformsWordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability5.3 Medium
- stylemix masterstudy lmsWordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability4.3 Medium
- webba appointment booking bookingWordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability4.3 Medium
- wedevs wp user frontendWordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability4.3 Medium
- wp user manager user managerWordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability5.3 Medium
- wedevs wp user frontendWordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability5.3 Medium
- stylemix masterstudy lms wordpress pluginMasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax5.3 Medium
- kaliforms kali formsWordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability5.3 Medium
- red hat ceph storage 9, enterprise linux 10, enterprise linux 6 +7 more +9 moreDnsmasq: dnsmasq: --leasequery without address argument applies no source address check4.3 Medium
- hivepress claim listingsWordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability4.3 Medium
- relywp simple cloudflare turnstileWordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability5.3 Medium
- ahmad wp job portalWordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability4.3 Medium
- kaliforms kali formsWordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability6.5 Medium
- crocoblock jetengineWordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability6.5 Medium
- rextheme product feed managerWordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability5.3 Medium
- yith paypal express checkout for woocommerce, yithemes yith paypal express checkout for woocommerce +1 moreWordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability5.3 Medium
- thimpress learnpressWordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability7.5 High
- eyal fitoussi geo my wordpressWordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability7.5 High
- villatheme handmade – dropshipping for etsy and woocommerceWordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability7.1 High
- videowhisper broadcast live videoWordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability7.1 High
- red hat build of keycloak, single sign-on 7 +1 moreKeycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions5.4 Medium
- Show moreLoading…