cve.bz

CWE-862: Missing Authorization, page 12

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Ask an AI about CWE-862

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2026-102985EPSS 0.3%

    Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember r…

  2. 5.3CVE-2026-110773EPSS 0.2%

    GrowChief through 0.3.0 contains a missing authorization vulnerability in the getAllUsers handler that allows any authenticated user to list users across all organizations because the IsSuperAdmin guard is absent. Attackers with a self-reg…

  3. 5.3CVE-2026-110772EPSS 0.3%

    Sure 0.7.0 through 0.7.6-alpha.6 contains a missing authorization vulnerability in Transactions::BulkUpdatesController#create that allows family members to bypass account sharing permissions. Authenticated members with read_only or no shar…

  4. 9.2CVE-2026-102748EPSS 0.6%

    Dgraph is an open source distributed GraphQL database. Prior to 25.4.0, Dgraph Zero registers administrative HTTP routes on port 6080 without authentication when the administrative interface is enabled. The /removeNode route accepts attack…

  5. 5.6CVE-2026-102682EPSS 0.2%

    Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. From 0.0.98 until 1.6.0, the pipecat-ai package's built-in development runner exposes unauthenticated endpoints including /start,…

  6. 8.8CVE-2026-88164EPSS 0.8%

    Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

  7. 8.2CVE-2026-108480EPSS 0.2%

    Missing Authorization vulnerability in Skydropx Skydropx skydropx allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Skydropx: from n/a through 2.1.4.

  8. 7.5CVE-2026-91156EPSS 0.5%

    Discourse is an open-source discussion platform. Prior to 2026.9.0, 2026.8.1, 2026.7.3, and 2026.1.9, MessageBus audience calculation could deliver messages from a read-restricted category chat channel to an authenticated user who could vi…

  9. 6.5CVE-2026-100404EPSS 0.4%

    Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue…

  10. 7.1CVE-2026-110629EPSS 0.6%

    VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen …

  11. 2.3CVE-2026-110624EPSS 0.3%

    Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to list other groups' tags and document types by supplying a group_id parameter. Attackers who know a group's UUID can query GET /…

  12. 7.7CVE-2026-110623EPSS 0.5%

    Papermerge Core through 3.5.3 contains a missing authorization vulnerability in the shared nodes API that allows authenticated users to share other users' documents by supplying arbitrary node UUIDs. Attackers can call POST /shared-nodes o…

  13. 7.7CVE-2026-110622EPSS 0.5%

    Papermerge Core through 3.5.3 contains a missing authorization vulnerability that allows authenticated users to manipulate other users' pages because page management and OCR endpoints skip has_node_perm checks. Attackers knowing page UUIDs…

  14. 8.7CVE-2026-110621EPSS 0.5%

    Swetrix Cloud before 5.1.0 contains a missing authorization vulnerability in ProjectController.addProject that allows authenticated users to hijack arbitrary projects by moving them into their own organisation. Attackers can create an orga…

  15. 6.3CVE-2026-110617EPSS 0.6%

    we-mp-rss through 1.5.3 contains a missing authorization vulnerability in the /api/v1/wx/tools/export/download endpoint that allows unauthenticated attackers to download export archives because its authentication dependency is commented ou…

  16. 7.1CVE-2026-110615EPSS 0.4%

    jshERP through 3.6 contains a missing authorization vulnerability in the POST /user/batchSetStatus endpoint that allows authenticated low-privilege users to change other users' account status. Attackers can submit crafted ids and status va…

  17. 7.7CVE-2025-71433EPSS 0.6%

    Kaneo before 2.1.6 contains a missing authorization vulnerability that allows authenticated users to access other workspaces by supplying project, task, label or workspace identifiers to API routes lacking membership checks. Attackers who …

  18. 8.7CVE-2026-82026EPSS 0.9%

    Radar before 1.12.2 contains a missing authorization vulnerability in the handleLocalTerminal WebSocket endpoint (/api/local-terminal) that allows authenticated or unauthenticated attackers to spawn a privileged shell by relying only on a …

  19. 6.5CVE-2026-107433EPSS 0.3%

    Missing Authorization vulnerability in miniOrange WP OAuth Server miniorange-oauth-20-server allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP OAuth Server: from n/a through 6.4.0.

  20. 7.3CVE-2026-107426EPSS 0.3%

    Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7…

  21. 6.5CVE-2026-107425EPSS 0.3%

    Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket …

  22. 6.5CVE-2026-107417EPSS 0.2%

    Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pus…

  23. 7.5CVE-2026-107431EPSS 0.3%

    Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.6.

  24. 5.3CVE-2026-110227EPSS 0.2%

    Missing Authorization vulnerability in 10up Restricted Site Access restricted-site-access allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Restricted Site Access: from n/a through 7.6.2.

  25. 6.5CVE-2026-103907EPSS 0.3%

    The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to, and including, 3.2.19. Th…

  26. 5.3CVE-2026-94360EPSS 0.2%

    The Paymentfor Gateway for WooCommerce WordPress plugin before 1.0.6 does not verify the authenticity of an inbound payment notification before marking an order as paid, allowing unauthenticated attackers to mark orders as paid without any…

  27. 5.3CVE-2026-94260EPSS 0.3%

    The Sifalo Pay WordPress plugin before 2.5.3 does not verify ownership of, or authorisation for, the order being updated when it handles a payment return, allowing unauthenticated attackers to write arbitrary payment session metadata onto…

  28. 5.3CVE-2026-94254EPSS 0.2%

    The SellKit WordPress plugin before 2.8.0 does not validate a client-supplied product price when totals are recalculated during checkout, allowing unauthenticated attackers to place orders for any purchasable product at a price of their o…

  29. 5.3CVE-2026-91076EPSS 0.2%

    The Robokassa payment gateway for Woocommerce WordPress plugin before 1.9.0 does not verify the authenticity of an incoming payment-notification request before acting on the order named in it, allowing unauthenticated attackers to force an…

  30. 6.5CVE-2026-108064EPSS 0.2%

    The WP Encryption WordPress plugin before 7.8.8.2 does not perform a capability or nonce check on one of the handlers that drives its SSL certificate-provisioning routine, allowing unauthenticated users to make the WP Encryption WordPres…

  31. 5.3CVE-2026-107158EPSS 0.3%

    The LTL Freight Quotes WordPress plugin before 4.2.19 does not perform any authorization check or validation on one of its REST routes that writes to the database, allowing unauthenticated users to modify some of the LTL Freight Quotes W…

  32. 5.9CVE-2026-106646EPSS 0.3%

    The Classified Listing WordPress plugin before 6.1.1 does not verify that the requester owns or can edit the target listing when a gallery request references an unattached media item, allowing any authenticated user with a subscriber-leve…

  33. 5.3CVE-2026-105975EPSS 0.2%

    The CamPay Shortcode Payment Gateway WordPress plugin before 1.7 does not verify the authenticity of Mobile Money payment confirmations and derives the payment result from client-supplied parameters, allowing unauthenticated attackers to m…

  34. 5.3CVE-2026-104751EPSS 0.2%

    The Rank Math SEO WordPress plugin before 1.0.280 does not perform a capability or nonce check before clearing its stored SEO analysis data, allowing unauthenticated users to delete it.

  35. 8.1CVE-2026-17092EPSS 0.5%

    The Directorist: AI-Powered Business Directory, Listings & Classified Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 8.10.2.1. This is due to the plugin not properly verifying that a us…

  36. 7.5CVE-2026-103423EPSS 0.5%

    The Booking Package plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.29 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it poss…

  37. 4.2CVE-2026-110160EPSS 0.2%

    Missing authorization in ReadingMode in Google Chrome prior to 155.0.8059.79 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially bypass site isolation via a crafted HTML page. …

  38. 8.8CVE-2026-70098EPSS 0.6%

    Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.

  39. 8.6CVE-2026-63174EPSS 0.2%

    Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a space administrator to assign users into spaces outside their authority because the spaceAffectList affectation was performed without verif…

  40. 7.1CVE-2026-63172EPSS 0.2%

    Omnispace Agora Project before 26.10.0 contains a broken access control vulnerability that allows a regular, non-administrative member to create user accounts by invoking the user-edit action without a function-level authorization check. A…

  41. 5.4CVE-2026-56826EPSS 0.3%

    Shopper is a Headless e-commerce Admin Panel. From 2.0.0 until 2.9.2, authenticated users who could reach the Settings pages with only access_setting could directly invoke destructive actions through the Livewire endpoint because packages/…

  42. 5.5CVE-2026-96926EPSS 0.3%

    Missing authorization in DNS Server allows an authorized attacker to perform tampering locally.

  43. 5.5CVE-2026-96855EPSS 0.3%

    Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.

  44. 5.5CVE-2026-96316EPSS 0.3%

    Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to perform tampering locally.

  45. 5.5CVE-2026-96315EPSS 0.3%

    Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally.

  46. 5.5CVE-2026-96311EPSS 0.3%

    Improper authorization in Windows Network List Service allows an authorized attacker to perform tampering locally.

  47. 8.8CVE-2026-88198EPSS 0.7%

    Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

  48. 7.8CVE-2026-88135EPSS 0.3%

    Improper access control in WebDAV allows an authorized attacker to elevate privileges locally.

  49. 6.5CVE-2026-87714EPSS 0.4%

    Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a network.

  50. 5.5CVE-2026-85938EPSS 0.3%

    Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.