CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Also known as AuthZ.
A kind of CWE-285 Improper Authorization.
From the CWE List. © The MITRE Corporation.
Newest
- unknown fiber adminFiber Admin < 4.0.1 - Unauthenticated Arbitrary Post and Term Order Modification via fiad_cpo_update and fiad_cpo_tax_update5.3 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect6.5 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.1 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect7.4 High
- ibm api connectMultiple Vulnerabilities in IBM API Connect9.1 Critical
- davidanderson redux frameworkRedux Framework <= 4.5.16 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via download_options AJAX Action5.3 Medium
- ibm api connectMultiple Vulnerabilities in IBM API Connect9.8 Critical
- artbees jupiter x coreJupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Limited File Download via 'file' Parameter5.3 Medium
- artbees jupiter x coreJupiter X Core <= 4.62.0 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'archive_query' Parameter5.9 Medium
- ibericode mc4wpWordPress MC4WP plugin <= 4.14.1 - Broken Access Control vulnerability5.3 Medium
- publishpress revisionsWordPress PublishPress Revisions plugin <= 4.2.0 - Broken Access Control vulnerability4.3 Medium
- wproyal royal elementor addonsWordPress Royal Elementor Addons plugin <= 1.7.1068 - Broken Access Control vulnerability4.3 Medium
- chouby polylangWordPress Polylang plugin <= 3.9 - Broken Access Control vulnerability5.4 Medium
- red hat openshift pipelines, builds for red hat openshift, openshift serverless +2 more +4 morePipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount8.8 High
- filegatorFileGator: Missing authorization in POST /upload allows cross-user read and deletion of temporary files5.9 Medium
- filegatorFileGator: Missing authorization in GET /batchdownload allows cross-user retrieval of another user's archive5.4 Medium
- ignisda ryotRyot: `createOrUpdateUserIntegration` trusts a client-supplied `integrationId` with no ownership check, letting any user hijack/overwrite another user's integration (cross-tenant IDOR)5.9 Medium
- rapid7 velociraptorVelociraptor: Low-priv analyst reads arbitrary server files via ungated sql() VQL plugin6.5 Medium
- bubka 2fauth2FAuth: Missing Authorization on Share Recipients Endpoint Allows Cross-User Account Enumeration6.5 Medium
- dbeaver cloudbeaverCloudBeaver: Authorization Bypass (BFLA) - Data Export Restriction Bypass6.5 Medium
github.com/canonical/lxdGoLXD has restricted project bypass leading to arbitrary command execution9.9 Critical- freescout-help-desk freescoutFreeScout: Incomplete fix for CVE-2026-40570: load_customer_info exposes cross-visibility customer PII6.5 Medium
- freescout-help-desk freescoutFreeScout: Missing Authorization and Exposure of Sensitive Information to an Unauthorized Actor and Authorization Bypass Through User-Controlled Key6.5 Medium
- gridaco gridaGrida through 0.0.24 Missing Authorization in Forms File-Preview API8.2 High
- posit software, pbc workbench, rstudio server +1 moreRStudio Server / Posit Workbench localhost port-proxy does not enforce per-session port ownership4.7 Medium
- sgoudelis ground-stationGround Station 0.6.0 before 0.8.20 Credential Disclosure via get-orbital-sources7.1 High
- wp swings upsell order bump offer for woocommerceWordPress Upsell Order Bump Offer for WooCommerce plugin <= 3.1.6 - Broken Access Control vulnerability7.1 High
moodleUbuntuMoodle: missing access checks on h5p content files7.5 High- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19656 users without update permission could change issue...3.1 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562, 2026.1.14137, 2025.3.169041 missing authorization ...3.5 Low
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 missing authorization allowed Project Admin to manage...4.7 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19197 article editors could change visibility of restricted...5.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 missing authorization allowed users with read-only...5.4 Medium
- jetbrains youtrackIn JetBrains YouTrack before 2026.2.19562 missing authorization in the saved query endpoint...7.5 High
- jetbrains youtrackIn JetBrains YouTrack before 2025.3.170763, 2026.1.14150, 2026.2.19656 improper URL validation...8.4 High
- jetbrains hubIn JetBrains Hub before 2026.2.52519 missing authorisation allowed users with read-only access to...2.7 Low
- infomaniak network vod infomaniakVOD Infomaniak <= 1.5.15 - Missing Authorization to Authenticated (Subscriber+) Unauthorized Video Importation via vodimportvideo AJAX Action4.3 Medium
- themeisle redirection for contact form 7Redirection for Contact Form 7 <= 3.2.14 - Missing Authorization to Unauthenticated Arbitrary Post Meta Modification and Arbitrary File Copy via 'wpcf7-redirect' Parameter5.3 Medium
- arraytics eventin – events calendar, tickets, registration, booking & woocommerceEventin <= 4.1.29 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'id' Parameter6.5 Medium
- magepeopleteam travelly – tour & travel booking manager for woocommerceTravelly <= 2.3.11 - Missing Authorization to Authenticated (Contributor+) Payment Gateway Credential Disclosure via edit_form_top Handler on Tour/Hotel Edit Screen6.5 Medium
- mdjm event management, unknown mdjm event management, mobile events manager +2 moreMDJM Event Management and Mobile Events Manager <= 1.7.8.7 - Unauthenticated Arbitrary Role Deletion9.1 Critical
- red hat build of keycloak 26.4, build of keycloak 26.4.17, build of keycloak 26.6 +2 more +4 moreKeycloak-services: keycloak-services: dcr registration-time claim-path gap allows forging realm_access.roles6.5 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: saml broker ignores proxyrestriction delegation constraints4.9 Medium
- plugins360 all-in-one video galleryAll-in-One Video Gallery < 5.1.0 - Unauthenticated Views and Duration Post Meta Write5.3 Medium
- red hat build of keycloak 26.6, build of keycloak 26.6.8, single sign-on 7 +2 moreKeycloak-services: keycloak-services: injection of roles into realm default-roles via dcr endpoint6.8 Medium
- grafana enterprise, oss +1 moreDashboard snapshot permission bypass8.5 High
- kubeflow pipelinesKubeflow Pipelines API server lacks authorization for shared pipeline uploads9.6 Critical
- open-emr openemrOpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)6.5 Medium
- open-emr openemrOpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory5.4 Medium
- open-emr openemrOpenEMR: Missing authorization on QRDA Category I/III download endpoints6.5 Medium
- Show moreLoading…