CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- open-emr openemrOpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration8.1 High
- open-emr openemrOpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstall7.1 High
- open-emr openemrOpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth6.5 Medium
- open-emr openemrOpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI6.5 Medium
- suitecrmSuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record7.1 High
- suitecrmSuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorization8.1 High
- suitecrmSuiteCRM: Non-admin user creates SchedulersJob: SSRF via cron7.1 High
- balbooa.com gridbox extension for joomlaJoomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.06.9 Medium
- tinyhumansai openhumanOpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`9.0 Critical
- red hat hardened imagesDnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction6.6 Medium
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access8.1 High
- keywordrush content egg – affiliate product importer & price comparisonContent Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blocks6.9 Medium
- arthi-chaud meeloMeelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints5.3 Medium
- apache software foundation ofbizApache OFBiz: Unauthenticated HR organization and employee disclosure5.3 Medium
- apache software foundation ofbizApache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage6.5 Medium
- apache software foundation ofbizApache OFBiz: Missing authorization - catalog quick-admin product writes6.5 Medium
- apache software foundation ofbizApache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services6.5 Medium
- apache software foundation ofbizApache OFBiz: Authorization bypass - self-grant content OWNER6.5 Medium
- apache software foundation ofbizApache OFBiz: Missing authorization - search-result bulk catalog mutation6.5 Medium
- apache ofbizApache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile4.3 Medium
- apache ofbizApache OFBiz: Unbounded multi-form row count from a parameter name7.5 High
- apache ofbizApache OFBiz: webtools xmldsdump exports any entity to any path7.1 High
- apache ofbizApache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers5.3 Medium
- red hat exploit intelligence, openshift serverless, build of apache camel 4 for quarkus 3 +7 more +9 moreIo.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw7.7 High
- unknown security for woocommerceSecurity For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user9.8 Critical
- catfoldersCatFolders < 2.5.7 - Subscriber+ Folder Ownership Reset and User Restriction Disable via catf_run_merge3.1 Low
- g5theme essential real estateEssential Real Estate < 5.3.5 - Customer+ Arbitrary Paid Package Activation and Forged Paid Invoice via ere_free_package_ajax4.3 Medium
- jackdewey community eventsCommunity Events < 1.6.0 - Unauthenticated Pending Events Disclosure via ajax_admin_event_list5.3 Medium
- fv flowplayer video player flowplayer video player, unknown fv flowplayer video player +1 moreFV Player < 7.5.56.7212 - Subscriber+ Cloud Storage File Disclosure via Media Browser Handlers4.3 Medium
- samsung semiconductor exynos 1580, exynos 1680, exynos 2500 +1 more +3 moreIncorrect authorization in Samsung framework services due to missing permission checks7.5 High
- kyvernoKyverno before 1.19.2 Cross-Namespace Resource Read via generate.clone8.3 High
- kyvernoKyverno 1.17.0 before 1.19.2 Cross-Namespace Write via NamespacedMutatingPolicy mutateExisting8.4 High
- kyvernoKyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy9.4 Critical
- presentonPresenton User Configuration user-config JSON.parse cross-site request forgery5.3 Medium
- nliautaud pico-content-editornliautaud pico-content-editor cross-site request forgery5.3 Medium
- openedx openedx-platformOpen edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce5.3 Medium
- glpi-project glpiGLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds5.3 Medium
- shenzhen shine industrial co., ltd. vitafitVitaFit Cloud API Excessive Data Exposure via relation/search Endpoint7.1 High
- glpi-project glpiGLPI: Unallowed notifications sending7.1 High
- gpustackGPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover8.8 High
- cisco telepresenceTelepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets8.5 High
- retspen webvirtcloudWebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints7.2 High
- sonatype nexus repository 3, nexus repository manager +1 moreNexus Repository 3 - Group Repository Member Authorization Bypass5.3 Medium
- sonatype nexus repository 3Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation8.6 High
- zulipZulip: Saving a draft DM to a user bypasses can_access_all_users_group permission6.5 Medium
- zulipZulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels5.3 Medium
- invoiceninjaInvoice Ninja < 5.13.28 Broken Access Control via Vendor Portal7.1 High
- sender – newsletter, sms and email marketing automation for woocommerceSender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_download5.3 Medium
- wedevs wepos – point of sale (pos) for woocommerce & dokanwePOS before 2.0.3 Missing Authorization via payment/process Endpoint5.3 Medium
- wc lovers wcfm marketplaceWordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability7.5 High
- Show moreLoading…