CWE-862: Missing Authorization, page 13

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

1. 5.5CVE-2026-83658EPSS 0.3%2026-10-13

   Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally.

2. 7.8CVE-2026-83583EPSS 0.3%2026-10-13

   Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.

3. 7.8CVE-2026-83568EPSS 0.3%2026-10-13

   Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.

4. 5.5CVE-2026-70235EPSS 0.3%2026-10-13

   Improper authentication in Windows Event Tracing allows an authorized attacker to perform spoofing locally.

5. 5.5CVE-2026-70085EPSS 0.3%2026-10-13

   Missing authorization in DNS Server allows an authorized attacker to perform tampering locally.

6. 8.8CVE-2026-69945EPSS 0.3%2026-10-13

   Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.

7. 5.5CVE-2026-69905EPSS 0.3%2026-10-13

   Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform tampering locally.

8. 5.3CVE-2026-110230EPSS 0.3%2026-10-13

   XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/{id}/vanity route. Attackers can supply sequential upload ids to MediaCon…

9. 5.3CVE-2026-110229EPSS 0.3%2026-10-13

   QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, an…

10. 6.3CVE-2026-110218EPSS 0.4%2026-10-13

    Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrieve…

11. 7.1CVE-2026-110216EPSS 0.4%2026-10-13

    youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH requests …

12. 8.7CVE-2026-110215EPSS 0.5%2026-10-13

    youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST…

13. 7.2CVE-2026-110211EPSS 0.4%2026-10-13

    iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets thro…

14. 6.0CVE-2026-110210EPSS 0.5%2026-10-13

    Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key c…

15. 7.1CVE-2026-110209EPSS 0.5%2026-10-13

    Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attackers …

16. 7.1CVE-2026-110208EPSS 0.4%2026-10-13

    Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for t…

17. 8.7CVE-2026-110207EPSS 0.4%2026-10-13

    Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST req…

18. 5.5CVE-2026-103560EPSS 0.3%2026-10-13

    Improper authorization in DNS Server allows an authorized attacker to perform tampering locally.

19. 8.8CVE-2026-102861EPSS 0.8%2026-10-13

    Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.

20. 7.8CVE-2026-102233EPSS 0.4%2026-10-13

    Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.

21. 7.8CVE-2026-100217EPSS 0.3%2026-10-13

    Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.

22. 3.8CVE-2026-106176EPSS 0.2%2026-10-13

    A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests

23. 8.8CVE-2026-85990EPSS 0.4%2026-10-13

    Leantime is an open source project management system. Prior to 3.10.0, for the provisionally grouped account-creation and plugin-management surfaces, Leantime's JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php exposes public A…

24. 6.9CVE-2026-110131EPSS 0.3%2026-10-13

    ThriveX-Server through 4.0 contains a missing authorization vulnerability in the GET /api/article and /api/article/{id} endpoints that allows unauthenticated attackers to read unpublished draft and soft-deleted articles. Attackers can requ…

25. 7.1CVE-2026-110123EPSS 0.3%2026-10-13

    Makunet maku-boot 4.3.0 through 5.0.0 contains a missing authorization vulnerability that allows authenticated users to read mail and SMS configurations by calling /sys/mail/config/list and /sys/sms/config/list without the required authori…

26. 7.1CVE-2026-110117EPSS 0.3%2026-10-13

    SmartAdmin through 3.30.0 contains a missing authorization vulnerability in AdminProtectController that allows authenticated low-privileged employees to modify system-wide level-3 protection settings. Attackers can call the unannotated upd…

27. 5.3CVE-2026-110110EPSS 0.3%2026-10-13

    JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access to enable or disable any alarm configuration. Because the AlarmConfigController _enable and _disable endpoints lack t…

28. 7.1CVE-2026-110109EPSS 0.3%2026-10-13

    JetLinks Community through 2.10.0 contains a missing authorization vulnerability that allows users with only query access on transparent-codec to overwrite product codecs via POST /device/transparent-codec/{productId}. Because the endpoint…

29. 8.6CVE-2026-110108EPSS 0.3%2026-10-13

    MateCloud through 5.0.8 contains a missing authorization vulnerability that allows any authenticated user to manage object storage by calling the unprotected /api/v1/admin/storage endpoints in StorageController. Low-privilege or self-regis…

30. 6.9CVE-2026-110105EPSS 0.3%2026-10-13

    B3log Symphony through 3.6.4 contains a missing authorization vulnerability that allows unauthenticated attackers to reach admin routes because PermissionMidware.check permits routes lacking permission.rule.url entries. Attackers can reque…

31. 5.3CVE-2026-110100EPSS 0.2%2026-10-13

    Jorani before 1.0.4 contains a missing authorization vulnerability in Contracts::import() that allows any authenticated user to import days off into any contract from an arbitrary URL. Attackers can submit a contract id and URL via POST to…

32. 5.3CVE-2026-110099EPSS 0.3%2026-10-13

    Jorani before 1.0.4 contains a missing authorization vulnerability in the Hr controller's exportLeaves, exportOvertime and exportEmployees actions, allowing any authenticated user to export HR data. Attackers can request hr/exportEmployees…

33. 5.3CVE-2026-109898EPSS 0.2%2026-10-13

    Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.25.

34. 4.3CVE-2026-109896EPSS 0.2%2026-10-13

    Missing Authorization vulnerability in WP Chill Download Monitor integration for WooCommerce download-monitor-integration-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Download M…

35. 5.3CVE-2026-109890EPSS 0.2%2026-10-13

    Missing Authorization vulnerability in LeapWorx Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a thr…

36. 5.5CVE-2026-109525EPSS 0.3%2026-10-13

    A vulnerability was identified in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. This affects an unknown part of the file changebookingstatus.php of the component submit2 Handler. Such manipul…

37. 5.5CVE-2026-109524EPSS 0.3%2026-10-13

    A vulnerability was determined in girishsaraf Online-Appointment-Booking-System up to f427b4757128ca253d33d0cc4e87bbb9c999a4d5. Affected by this issue is some unknown functionality of the file Admin/showdoctor.php of the component Admin Di…

38. 9.4CVE-2026-74040EPSS 0.7%2026-10-13

    Wazuh versions from 3.9.0 before 4.14.8 contain an arbitrary file overwrite vulnerability in MasterHandler.process_files_from_worker allowing a cluster worker to overwrite protected master files. Attackers controlling a worker can use a tr…

39. 8.7CVE-2026-74034EPSS 0.4%2026-10-13

    Wazuh from 4.1.0 before 4.14.8 contains a missing origin check in wm_agent_upgrade that allows enrolled agents to issue upgrade_custom commands with attacker-controlled file_path. Attackers can inject an upgrade_custom message over the age…

40. 8.6CVE-2026-65172EPSS 0.4%2026-10-13

    NVIDIA AIStore for Linux and Kubernetes contains a missing authorization vulnerability in the ETL management API where an unauthenticated remote attacker may access ETL information or control existing ETL jobs by sending crafted GET or POS…

41. 5.4CVE-2026-109764EPSS 0.2%2026-10-13

    Mitigation bypass in the Enterprise Policies component. This vulnerability was fixed in Firefox 158, Firefox ESR 153.5, Thunderbird 158, and Thunderbird 153.5.

42. 9.6CVE-2026-109750EPSS 0.4%2026-10-13

    Site isolation issue in the DOM: Web Authentication component. This vulnerability was fixed in Firefox 158 and Thunderbird 158.

43. 5.3CVE-2026-94410EPSS 0.2%2026-10-13

    A low privileged remote attacker is able to view a list of roles that should only be accessible to administrators. This results in a low level of confidentiality breach, as no particularly sensitive information is affected.

44. 5.4CVE-2026-109699EPSS 0.2%2026-10-13

    Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.

45. 5.4CVE-2026-109696EPSS 0.1%2026-10-13

    Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.1.0.

46. 5.3CVE-2026-109684EPSS 0.2%2026-10-13

    Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.

47. 5.3CVE-2026-108496EPSS 0.2%2026-10-13

    Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.24.

48. 5.3CVE-2026-108493EPSS 0.2%2026-10-13

    Missing Authorization vulnerability in Karolína Vyskočilová Pay for Payment for WooCommerce woocommerce-pay-for-payment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pay for Payment for WooComme…

49. 5.3CVE-2026-108492EPSS 0.2%2026-10-13

    Missing Authorization vulnerability in Fullworks Plugins Quick Paypal Payments quick-paypal-payments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Quick Paypal Payments: from n/a through 6.0.3.

50. 5.3CVE-2026-108174EPSS 0.2%2026-10-13

    Missing Authorization vulnerability in PluginUs.Net FOX woocommerce-currency-switcher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FOX: from n/a through 1.5.4.