CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- unknown azexo store locatorAZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary Post Deletion via azt_delete_item6.5 Medium
- migkapa ai alt text generatorAI Alt Text Generator <= 2.7.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter5.3 Medium
- jetmonsters jetformbuilder — dynamic blocks form builderJetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification5.3 Medium
- aresit wp compress – instant performance & speed optimizationWP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters5.3 Medium
- google android xrIn addDragDropListener of WindowManagerService.java, there is a possible permission bypass due to...8.4 High
- google androidIn checkQueryPermission of TelephonyProvider.java, there is a possible permission bypass due to a...4.0 Medium
- petpooja munshiMunshi Missing Authorization in Company Deletion API7.2 High
- eclipse foundation threadxUser-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own6.9 Medium
- owen2345 camaleon cmsCamaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController7.1 High
- codeixer product gallery slider & additional variation images for woocommerceProduct Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAX8.6 High
- sassanix warrackerWarracker before 1.0.4 Missing Authorization via Paperless-ngx Document Linking6.0 Medium
- tubitak bilgem software technologies research institute eta-registerLocal Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's eta-register7.8 High
- No product listedKeyfactor EJBCA through 9.3.3 performs insufficient authorization checks when self-renewing a...6.5 Medium
- apache software foundation wicketApache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component6.3 Medium
- apache software foundation wicketApache Wicket: A listener is invoked on a page instance the request itself created and never configured6.9 Medium
- apache software foundation wicketApache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke2.3 Low
- apache software foundation wicketApache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission6.9 Medium
- apache software foundation wicketApache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource6.3 Medium
- giteaGitea private pull request disclosure on project boards7.5 High
- giteaGitea issue changes on archived repositories through the API6.5 Medium
- giteaGitea private issue disclosure through issue dependency timeline events3.5 Low
- giteaGitea archived repository release, milestone and label modification6.5 Medium
- giteaGitea Actions task token private repository enumeration4.3 Medium
- david lingren media library assistantMedia Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields4.3 Medium
- unknown kali forms — contact form & drag-and-drop builderKali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing4.3 Medium
- google androidIn checkLastKnownCellIdAccessPermission of TelephonyPermissions.java, there is a possible...5.5 Medium
- google androidIn insertInternal of MmsProvider.java, there is a possible multiuser isolation issue due to a...8.4 High
- google androidIn getSubscriptionProperty of SubscriptionManagerService.java, there is a possible information...4.0 Medium
- google androidIn multiple functions of NfcService.java, there is a possible permission bypass due to a missing...8.4 High
- google androidIn setOemUnlockAllowedByUser of OemLockService.java, there is a possible way to bypass FRP due to...8.4 High
- google androidIn notifyPictureProfileHandleSelection of MediaQualityService.java, there is a possible...8.4 High
- google androidIn multiple functions of MediaQualityService.java, there is a possible permission bypass due to a...4.0 Medium
- google androidIn multiple locations, there is a possible permission bypass due to a missing permission check....4.0 Medium
- google androidIn onPersistentGroupsChanged of WifiP2pServiceImpl.java, there is a possible permission bypass...4.0 Medium
- google androidIn getMessenger of WifiP2pServiceImpl.java, there is a possible permission bypass due to a...8.4 High
- google androidIn setAccessibilityWindowAttributes of AccessibilityWindowManager.java, there is a possible...8.4 High
- google androidIn nfa_t4tnfcee_store_rx_buf of nfa_nfcee_act.cc, there is a possible way to achieve code...8.4 High
- google androidIn getRingtone of RingtoneFactory.java, there is a possible unprivileged access risk due to a...4.0 Medium
- davidanderson redux frameworkRedux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript6.5 Medium
- tigroumeow perfect images: regenerate thumbnails, image sizes, webp & avifPerfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement4.3 Medium
- peterschulznl wp data access – app builder for tables, forms, dashboards, charts & mapsWP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter5.9 Medium
- unknown product filter for woocommerce by wbwProduct Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter5.3 Medium
- wpmudev hustle – email marketing, lead generation, optins, popupsHustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX…4.3 Medium
- murgroland wp booking system – booking calendarWP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action9.1 Critical
- popupbuilder popup builder – create highly converting, mobile friendly marketing popups.Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters9.1 Critical
- unknown payable payment gateway for woocommercePAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback5.3 Medium
- mapster wp maps, unknown mapster wp maps +1 moreMapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route7.5 High
- shahjada premium packagesPremium Packages < 7.2.2 - Unauthenticated Order Total Manipulation5.3 Medium
- brainstormforce spectra legacy – gutenberg blocksSpectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters6.5 Medium
- aces lorisLORIS has incorrect access checks in issue_tracker4.3 Medium
- Show moreLoading…