CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- aces lorisLORIS has incorrect access checks in API for Imaging Browser6.3 Medium
- shopperdotcom shopperShopper: missing variant-delete authorization permits destructive single and bulk actions8.1 High
- sinamics ztnetZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser8.1 High
- infiniflow ragflowRAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization7.1 High
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Non-administrators can share a server with every user6.0 Medium
- pgadmin 4, pgadmin.org pgadmin 4 +1 morepgAdmin 4: Connection services are not restricted in server mode7.1 High
- franklioxygen mytubeMyTube: Visitor Can Access Hidden Video Metadata and Content7.1 High
- thalesgroup sentinel keys serverUnauthenticated Stack Buffer Overflow in Sentinel Keys Server9.3 Critical
- acato wp rest cacheWordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability7.5 High
- nexcess givewpWordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability6.5 Medium
- masteriyo - lmsWordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability6.5 Medium
- realmag777 huskyWordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability7.5 High
- magepeopleteam booking and rental managerWordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability6.5 Medium
- cardano-scaling hydraHydra: Deposit Claim omits Head state-token spending requirement8.2 High
- wp email newsletter team - fluentcrm fluent crmWordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability5.3 Medium
- unitecms unlimited elements for elementor (free widgets, addons, templates), unlimited elements for elementor (free widgets, addons, templates) +1 moreWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability4.3 Medium
- liquid web / stellarwp bookitWordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability4.3 Medium
- arraytics bookticsWordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability4.3 Medium
- liquid web / stellarwp event ticketsWordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability4.3 Medium
- arraytics bookticsWordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability5.3 Medium
- thechangelog changelog.comchangelog.com before commit 7b35e829 Missing Authorization via Preview Routes6.9 Medium
- wordpressdotorg openstation – admin dashboard notes, custom dashboard, ai assistant & pwaOpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via…4.3 Medium
- saadiqbal email templates customizer and designer for wordpress and woocommerceEmail Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter7.5 High
- jordy meow meow galleryMeow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint6.5 Medium
- morpheus65535 bazarrBazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery10.0 Critical
- frappe lmsFrappe LMS allows unpublished certificate access5.3 Medium
- frappe lmsFrappe LMS: Quiz result manipulation and cross-user submission forgery5.3 Medium
- liquid web / stellarwp event ticketsWordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability4.3 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability5.4 Medium
- zuke-build zukeZuke: Command-form registry descriptors bypass the MCP launch policy8.0 High
- wp email newsletter team - fluentcrm fluent crmWordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability5.4 Medium
- pipeshub-aiPipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route7.1 High
- sonicjs-org sonicjsSonicJS through 3.0.0 Missing Authorization in Content Write API7.1 High
- wpgraphqlWPGraphQL before 2.24.1 Missing Authorization via createComment Mutation6.9 Medium
- webba appointment booking bookingWordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability5.4 Medium
- liquid web / stellarwp the events calendarWordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability5.3 Medium
- crocoblock jetformbuilderWordPress JetFormBuilder plugin <= 3.6.7.1 - Broken Access Control vulnerability5.3 Medium
- socfortress copilotSOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression)7.5 High
- arraytics timeticsWordPress Timetics plugin <= 1.0.65 - Broken Access Control vulnerability5.3 Medium
- manageengine sharepoint manager plusImproper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plus7.9 High
- socfortress copilotSOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)8.5 High
- mgdaaslab wharttestWHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center Scheduled-Task APIs5.3 Medium
- devlive-community datacapDataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization8.7 High
- admpub ngingNging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path5.3 Medium
- tencentblueking bk-cmdbBlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail5.3 Medium
- themeum kirkiKirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API7.2 High
- arcadedata arcadedbArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint5.3 Medium
- moodleMoodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems5.3 Medium
- jellyfinJellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions7.1 High
- jellyfinJellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}5.1 Medium
- Show moreLoading…