CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- zephyrproject zephyrUnvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory8.8 High
- fv flowplayer video player flowplayer video player, unknown fv flowplayer video player +1 moreFV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration Wizard3.8 Low
- mollie payments for woocommerce, unknown mollie payments for woocommerce +1 moreMollie Payments for WooCommerce < 8.2.0 - Unauthenticated Unpublished Product Purchase via mollie_paypal_create_order3.7 Low
- mollie payments for woocommerce, unknown mollie payments for woocommerce +1 moreMollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_pay3.7 Low
- asus armoury crateMissing authorization in ASUS Armoury Crate allows a local attacker to write content into a...6.9 Medium
- mlflowMLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability5.4 Medium
- mlflowMLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability6.3 Medium
- mlflowMLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability5.4 Medium
- 0xdps emailflareemailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint7.1 High
- 0xdps emailflareemailflare before commit cf31f33 Missing Authorization via /api/keys Routes7.2 High
- sourcehut meta.sr.htSourceHut meta.sr.ht 0.56.11 before 0.89.0 Registration Authorization Bypass via /register/step26.9 Medium
- tanium enforceTanium addressed an improper access controls vulnerability in Enforce.6.5 Medium
- google chromeMissing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote...6.5 Medium
- google chromeMissing authorization in Input in Google Chrome prior to 157.0.8103.38 allowed a remote attacker...6.5 Medium
- google chromeMissing authorization in V8 in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to...8.8 High
- google chromeMissing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote...6.5 Medium
- google chromeMissing authorization in SiteIsolation in Google Chrome prior to 157.0.8103.38 allowed a remote...5.3 Medium
- google chromeMissing authorization in WebView in Google Chrome on on Android prior to 157.0.8103.38 allowed a...5.3 Medium
- google chromeMissing authorization in PerformanceAPIs in Google Chrome prior to 157.0.8103.38 allowed a remote...6.5 Medium
- google chromeMissing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote...6.5 Medium
- google chromeMissing authorization in DevTools in Google Chrome prior to 157.0.8103.38 allowed a remote...6.5 Medium
- google chromeMissing authorization in Chromoting in Google Chrome on on Mac prior to 157.0.8103.38 allowed a...5.5 Medium
- google chromeMissing authorization in PDF in Google Chrome prior to 157.0.8103.38 allowed a remote attacker to...6.5 Medium
- google chromeMissing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote...8.8 High
- google chromeMissing authorization in BackgroundFetch in Google Chrome prior to 157.0.8103.38 allowed a remote...8.8 High
- tp-link systems inc. tapo cloud serviceBroken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy8.3 High
- clickcease click fraud protection, eranfl clickcease click fraud protection +1 moreWordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerability5.3 Medium
- mycredWordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability4.3 Medium
- wpvibes anywhere elementorWordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability5.3 Medium
- mycredWordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability4.3 Medium
- dokan, inc. dokanWordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability5.3 Medium
- wc lovers wcfm membershipWordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability4.3 Medium
- dokan, inc. dokanWordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability5.3 Medium
- wpmu dev forminatorWordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability5.3 Medium
- wc lovers wcfm membershipWordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability5.3 Medium
- uncanny owl automatorWordPress Uncanny Automator plugin <= 7.7.1 - Broken Access Control vulnerability5.3 Medium
- ajay better searchWordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerability5.3 Medium
- nvidia slurmNVIDIA Slurm contains a vulnerability where a user could alter the supplemental group list as...6.3 Medium
- dromara domain-admindomain-admin before 1.6.79 Missing Authorization via getGroupUserList5.3 Medium
- dbgateDbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save5.3 Medium
- froxlorFroxlor before 2.3.15 Authorization Bypass via Mysqls.add API5.3 Medium
- froxlorFroxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API5.3 Medium
- azuracastAzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints5.3 Medium
- corebunch instaticInstatic before 0.0.21 Authorization Bypass via MCP Content Read Tools7.1 High
- typo3 extension "mail"Broken Access Control in extension "Mail" (mail)7.1 High
- eclipse foundation mnestixMissing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering8.8 High
- eclipse foundation threadxUser-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege8.5 High
- wso2 api manager, api control plane, identity server key manager connector (apim-km-wso2is) +2 morePrivilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)9.8 Critical
- wso2 jwt grant type for oauth2, api control plane, api manager +7 more +9 moreImproper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers4.8 Medium
- unknown dt directory lite addonDT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings Update5.3 Medium
- Show moreLoading…