cve.bz

CWE-862: Missing Authorization, page 11

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Ask an AI about CWE-862

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2026-105973EPSS 0.2%

    The Visual Form Builder WordPress plugin through 3.1 does not perform authorization or nonce checks when reordering form fields, allowing any authenticated user (Subscriber and above) to alter the field structure of any form on the site, p…

  2. 5.3CVE-2026-110721EPSS 0.2%

    The NotificationX plugin for WordPress is vulnerable to Missing Authorization leading to arbitrary content injection in versions up to, and including, 3.3.3 The /notificationx/v1/popup-submit REST route is registered with permission_callba…

  3. 7.5CVE-2026-110590EPSS 0.3%

    The Klarna for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.13.3 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes …

  4. 4.3CVE-2026-110019EPSS 0.2%

    The Bulk Page Generator – LPagery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0 This is due to the plugin not properly verifying that a user is authorized to perform an action. This …

  5. 7.5CVE-2026-107746EPSS 0.3%

    The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.16.0.6 This is due to the plugin not properly verifying that a user is authorized to…

  6. 7.5CVE-2026-107659EPSS 0.3%

    The Modula Image Gallery – Photo Grid & Video Gallery plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.0.11 via the 'id (post ID in /wp-json/wp/v2/modula-gallery/{id}) or none for…

  7. 6.9CVE-2026-109812EPSS 0.1%

    A missing authorization vulnerability exists in the internal API `/api/v1/secrets/` of some of Moxa's industrial computing products. A low-privileged authenticated attacker with adjacent network access could exploit this vulnerability to a…

  8. 7.0CVE-2026-92629EPSS 0.1%

    A potential improper authorization vulnerability was reported in Lenovo Baiying PC Client, distributed exclusively in the Chinese market, that could allow a local authenticated user to execute arbitrary code with elevated privileges.

  9. 5.3CVE-2026-111353EPSS 0.3%

    Peppermint through 0.5.5 contains a missing authorization vulnerability that allows any authenticated user to create time entries and attachments as other users by supplying a user id in the request body. Attackers can send POST requests t…

  10. 2.3CVE-2026-111350EPSS 0.3%

    Papermark through 0.22.0 contains a missing authorization vulnerability in the data room viewer group API that allows authenticated users to delete other teams' viewer groups and share links. Attackers who know a victim team's data room an…

  11. 6.9CVE-2026-111349EPSS 0.4%

    Craftplan through 0.7.5 contains a missing authorization vulnerability in the CRM Customer resource that allows unauthenticated attackers to create customer records via JSON:API and GraphQL. Attackers can send anonymous requests to POST /a…

  12. 5.3CVE-2026-111343EPSS 0.3%

    pig through 4.1.1 contains a missing authorization vulnerability in SysUserController.user that allows any authenticated user to read other users' profiles via GET /admin/user/details/{id}. Low-privilege attackers can enumerate sequential …

  13. 8.7CVE-2026-111277EPSS 0.5%

    NivoCart through 2.5.1 contains a missing authorization vulnerability in the download() action of account/order that allows unauthenticated attackers to retrieve guest order invoices by supplying an order_id. Attackers can iterate the orde…

  14. 9.6CVE-2026-105039EPSS 0.3%

    EnergizeLab station-middleware (NestJS) Docker images 1.6.5 through 1.8.2 do not check user roles on administrative APIs. Any authenticated low-privilege user can retrieve AI provider keys and change configuration and object-store contents.

  15. 8.8CVE-2026-106700EPSS 0.3%

    ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController. The method lacks the method-level authorization check app…

  16. 5.3CVE-2026-96449EPSS 0.2%

    Missing Authorization vulnerability in WPExperts WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP EasyPay: from n/a through 4.5.4.

  17. 9.1CVE-2026-111235EPSS 0.4%

    An authorization bypass vulnerability exists in the REST API of multiple versions of OpenNMS Meridian and Horizon. The /rest/** Spring Security filter chains authorize requests with intercept-url rules that name the HTTP method as an upper…

  18. 5.3CVE-2026-110378EPSS 0.2%

    Missing Authorization vulnerability in WP E-Signature Ninja Forms Signature Contract Add-On ninja-signature-contract-forms-add-on allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ninja Forms Signat…

  19. 4.3CVE-2026-110374EPSS 0.2%

    Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Login with phone number: from n/a through 1.8.77.

  20. 5.3CVE-2026-110364EPSS 0.2%

    Missing Authorization vulnerability in WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce flexible-quantity-measurement-price-calculator-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security…

  21. 5.3CVE-2026-110362EPSS 0.2%

    Missing Authorization vulnerability in Planet studio PlanetStudio Payment Gateway planetstudio-payment-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PlanetStudio Payment Gateway: from n/…

  22. 5.3CVE-2026-110360EPSS 0.2%

    Missing Authorization vulnerability in WPdreams Ajax Search Lite ajax-search-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ajax Search Lite: from n/a through 4.14.5.

  23. 5.4CVE-2026-109897EPSS 0.2%

    Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.

  24. 5.3CVE-2026-109689EPSS 0.2%

    Missing Authorization vulnerability in WP Sunshine Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through 3.7.4.

  25. 5.3CVE-2026-108499EPSS 0.2%

    Missing Authorization vulnerability in WebberZone Knowledge Base knowledgebase allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Knowledge Base: from n/a through 3.2.0.

  26. 5.3CVE-2026-55414EPSS 0.4%

    NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. From 1.1.0 until 3.0.4, and in 3.1.0, the public getFormDefinitionByObjecten…

  27. 5.4CVE-2026-110891EPSS 0.2%

    Missing Authorization vulnerability in WordLift Srl WordLift wordlift allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WordLift: from n/a through 3.54.15.

  28. 4.3CVE-2026-110888EPSS 0.2%

    Missing Authorization vulnerability in Meow Apps AI Engine ai-engine allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AI Engine: from n/a through 3.8.3.

  29. 4.3CVE-2026-110371EPSS 0.2%

    Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Strong Testimonials: from n/a through 3.3.12.

  30. 5.3CVE-2026-110367EPSS 0.2%

    Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4.7…

  31. 8.7CVE-2026-97712EPSS 0.3%

    Sonatype Nexus Repository 3 allows a user that holds the role create or role update permission to grant roles and privileges that the account does not hold. This can give the user more access than intended, up to full administrative access.

  32. 7.1CVE-2026-97665EPSS 0.3%

    A missing authorization check in Nexus Repository 3's NuGet Components API upload path allows an account holding only repository read and browse privileges to upload and persist NuGet symbol packages (.snupkg) to a hosted repository, bypas…

  33. 6.0CVE-2026-75505EPSS 0.3%

    EspoCRM is an open source customer relationship management application. Prior to 10.0.2, an authenticated user with mass-update permission can supply a known attachment identifier to the mass-update functionality. The mass-update processor…

  34. 6.5CVE-2026-111092EPSS 0.3%

    In JetBrains YouTrack before 2026.2.19575 2026.3.16075 2026.3.16397 2026.3.16402 mail rules allowed a project admin to execute cross-project issue commands

  35. 4.3CVE-2026-46708EPSS 0.2%

    EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a low-privileged user who can access a shared TargetList can invoke opt-out or cancel-opt-out actions for a protected Contact or Lead that the user can…

  36. 6.5CVE-2026-46694EPSS 0.2%

    EspoCRM is an open source customer relationship management application. Prior to 9.3.7, a portal user with stream access to a parent record can directly fetch a Note through the portal Note API and read an internal stream note when the not…

  37. 6.5CVE-2026-46691EPSS 0.2%

    EspoCRM is an open source customer relationship management application. Prior to 9.3.7, an authenticated user with Import scope access can send POST /api/v1/Import/{id}/exportErrors with another user's import identifier and retrieve an att…

  38. 7.1CVE-2026-109692EPSS 0.2%

    Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.

  39. 7.5CVE-2026-96537EPSS 0.2%

    The Tutor LMS WordPress plugin before 4.1.1 does not perform a capability check in a routine that regenerates its managed pages, allowing unauthenticated users to force-publish unpublished pages and overwrite their content, create missing…

  40. 4.3CVE-2026-11905EPSS 0.3%

    The Elementor Website Builder – more than just a page builder plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 4.2.3 via the 'keys_conversion_map' parameter. This makes it possible …

  41. 4.2CVE-2026-104643EPSS 0.1%

    The Easy HTTPS Redirection (SSL) WordPress plugin before 2.0.2 does not perform capability checks in some of its AJAX actions, allowing any authenticated user, such as a Subscriber, to read URLs its content scanner collected from private a…

  42. 5.3CVE-2026-103304EPSS 0.2%

    The eaSYNC Booking WordPress plugin before 1.3.31 does not perform authorization or nonce checks on several of its cancellation-related AJAX actions, allowing unauthenticated users to create booking cancellation requests, trigger booking …

  43. 8.1CVE-2026-17031EPSS 0.3%

    The Checkout Field Manager (Checkout Manager) for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.9.6 This is due to the plugin not properly verifying that a user is authorized…

  44. 8.7CVE-2026-76066EPSS 0.4%

    IntentKit through 2.6.3, fixed in commit 5b91da5, contains an authorization bypass vulnerability where the executor validates tool calls against the full tool registry rather than the per-request narrowed tool advertisement enforced by Too…

  45. 7.5CVE-2026-107795EPSS 0.2%

    Omada Controller's MSP and OpenAPI certificate/private-key management APIs do not properly enforce administrative authorization, allowing an authenticated user to perform privileged certificate management operations.  Successful exploitat…

  46. 7.5CVE-2026-102298EPSS 0.4%

    In Omada Controller MSP mode, the user-confirmation endpoint fails to enforce the required permission check. An authenticated user can supply a caller-controlled Identifier parameter to validate credentials for another account and receive …

  47. 8.2CVE-2026-71854EPSS 0.2%

    OpenAEV is an open source platform allowing organizations to plan, schedule and conduct cyber adversary simulation campaign and tests. Prior to version 2.260622.0, on a default installation, the `/api/player/**` lessons endpoints can be ca…

  48. 8.2CVE-2026-61843EPSS 0.4%

    FileRise is a self-hosted web-based file manager with multi-file upload, editing, and batch operations. Prior to 3.18.0, FileRise upload-enabled shared-folder and upload-only links do not reject a destination filename that already exists. …

  49. 6.5CVE-2026-102985EPSS 0.3%

    Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember r…

  50. 5.3CVE-2026-110773EPSS 0.2%

    GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-reg…