cve.bz

CWE-862: Missing Authorization, page 15

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Ask an AI about CWE-862

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2026-102596EPSS 0.3%

    Nango is an open-source platform for connecting agents and products to third-party APIs. Prior to 0.70.9, on accounts with RBAC enabled through a plan with has_rbac=true, two private flow-read routes, GET /api/v1/integrations/:providerConf…

  2. 8.3CVE-2026-84315EPSS 0.3%

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Sessio…

  3. 8.7CVE-2026-84314EPSS 0.4%

    Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, the POST /api/users/:id user-management endpoint permits an authenticated user to change another user's password without passing RequireSecureSession, even though t…

  4. 2.3CVE-2026-109564EPSS 0.2%

    LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get_playground. Authenticated users with playground creation rights…

  5. 5.3CVE-2026-109562EPSS 0.2%

    SnapOtter 1.15.10 through 2.2.0 contains a missing authorization vulnerability that allows any authenticated principal to call the /api/v1/upload, /api/v1/preview and /api/v1/preview/generate handlers without permission checks. Attackers h…

  6. 7.1CVE-2026-109427EPSS 0.2%

    Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode_string/d…

  7. 5.3CVE-2026-109377EPSS 0.3%

    ERPNext 9.0.0 through 16.50.0 contains a missing authorization vulnerability that allows authenticated users to view stock quantities via whitelisted batch methods. Attackers, including customer portal users, can call get_batch_qty, get_ba…

  8. 9.8CVE-2026-57118EPSS 0.4%

    PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.59, AgentTeam.launch and the Agents alias register GET /{path}/list, POST /{path}, and `POST /{path}/{agent_id}' without access-control checks before listing agents or c…

  9. 5.4CVE-2026-61994EPSS 0.1%

    Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: from n/a through 3.5.7.

  10. 5.3CVE-2026-108486EPSS 0.2%

    Missing Authorization vulnerability in WPMU DEV Forminator forminator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Forminator: from n/a through 1.58.0.

  11. 5.4CVE-2026-107418EPSS 0.2%

    Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.

  12. 5.3CVE-2026-109356EPSS 0.2%

    LibreNMS before 26.9.0 contains a missing authorization vulnerability in PortsController::purge that allows global-read users to physically delete ports without delete privileges. Attackers with read-only accounts can send DELETE requests …

  13. 5.3CVE-2026-109340EPSS 0.2%

    SurrealDB from 3.1.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated users to delete protected graph edges by triggering a REFERENCE ON DELETE CASCADE. Attackers with delete permission on a referenced …

  14. 7.1CVE-2026-109333EPSS 0.3%

    SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a forei…

  15. 6.9CVE-2026-109323EPSS 0.3%

    Grav Star Ratings 2.0.1 through 2.0.3 contains a missing authorization vulnerability that allows unauthenticated visitors to vote by bypassing client-only vote_access and readonly enforcement. Attackers can use the anonymous nonce emitted …

  16. 5.3CVE-2026-109319EPSS 0.2%

    Grav Guestbook plugin 0.5.0 and 0.5.1 contains missing authorization and cross-site request forgery vulnerabilities in Admin moderation actions delete, approve, and approveAll. Authenticated Admin users lacking the admin.guestbook permissi…

  17. 6.9CVE-2026-109316EPSS 0.3%

    Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete p…

  18. 6.0CVE-2026-109306EPSS 0.2%

    Craft CMS from 5.0.0 before 5.10.14 contains a missing authorization vulnerability in AppController::actionSwitchToLicensedEdition() that lets any authenticated user change the installed edition. Low-privileged front-end users can call the…

  19. 5.3CVE-2026-109296EPSS 0.3%

    Open WebUI before 0.11.4 contains a missing authorization vulnerability that allows authenticated users to reach disabled model provider backends by supplying an explicit backend index. Attackers can pass the index as a path segment or que…

  20. 5.3CVE-2026-109284EPSS 0.2%

    Open WebUI from 0.11.0 before 0.11.4 contains an improper authorization vulnerability in the chat fork handler, which places forked chats in the source chat's folder without checking folder write access. Shared folder members downgraded to…

  21. 2.1CVE-2026-108909EPSS 0.2%

    A security flaw has been discovered in Netcore NR268 1.7.121109. Affected by this issue is some unknown functionality of the component CGI Endpoint. Performing a manipulation results in cross-site request forgery. The attack may be initiat…

  22. 5.3CVE-2026-108477EPSS 0.2%

    Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.

  23. 5.0CVE-2026-108476EPSS 0.2%

    Missing Authorization vulnerability in VideoWhisper.com Paid Videochat Turnkey Site ppv-live-webcams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Paid Videochat Turnkey Site: from n/a through 7…

  24. 4.3CVE-2026-108475EPSS 0.2%

    Missing Authorization vulnerability in VideoWhisper.com Broadcast Live Video videowhisper-live-streaming-integration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Broadcast Live Video: from n/a …

  25. 7.1CVE-2026-109203EPSS 0.2%

    LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the ConvertPdf servlet that allows authenticated users to download restricted PDF documents. Attackers can enumerate sequential docId values and use…

  26. 7.1CVE-2026-109202EPSS 0.3%

    LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-ex…

  27. 8.7CVE-2026-109201EPSS 0.3%

    LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedTex…

  28. 5.3CVE-2026-109188EPSS 0.3%

    jshERP through 3.6 contains a missing authorization vulnerability that allows low-privilege authenticated users to create tenant-wide master data via add and import endpoints lacking role checks. Attackers can send POST requests to endpoin…

  29. 7.1CVE-2026-109187EPSS 0.2%

    jshERP through 3.6 contains an information disclosure vulnerability that allows any authenticated user to read platform-wide configuration secrets via the getInfoByKey handler of PlatformConfigController. Low-privilege users of any tenant …

  30. 8.7CVE-2026-109185EPSS 0.3%

    jshERP through 3.6 contains a missing authorization vulnerability in the UserController updateUser handler that allows authenticated users to assign arbitrary roles to any user. Low-privilege attackers can send their own user id with the t…

  31. 5.3CVE-2026-109184EPSS 0.2%

    jshERP through 3.6 contains an improper authorization vulnerability that allows low-privilege authenticated users to read any settlement account ledger by supplying an arbitrary accountId. Attackers restricted to personal or department dat…

  32. 5.3CVE-2026-109183EPSS 0.2%

    jshERP through 3.6 contains an authorization bypass vulnerability that allows authenticated users to create pre-approved bills by setting status in POST /depotHead/addDepotHeadAndDetail requests. Attackers can supply a status of 1 to skip …

  33. 5.3CVE-2026-109179EPSS 0.2%

    jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to read the tenant's operation audit log. Low-privilege users can send GET requests to /log/list or /log/info to view oth…

  34. 5.3CVE-2026-109178EPSS 0.2%

    jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/…

  35. 5.3CVE-2026-109173EPSS 0.2%

    yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /admin-api/crm/invoice/check. The CrmInvoiceController check handler lacks @PreAut…

  36. 5.3CVE-2026-109172EPSS 0.2%

    yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject receivables records by calling POST /admin-api/crm/contract-receivables/check. The handler lacks a @…

  37. 5.3CVE-2026-109171EPSS 0.2%

    yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject contracts by calling POST /admin-api/crm/contract/check. Because CrmContractController lacks @PreAut…

  38. 6.9CVE-2026-108950EPSS 0.3%

    Open Source Social Network (OSSN) through 10.1 contains a missing authorization vulnerability in ossn_album_page_handler that allows unauthenticated attackers to download files via album/getphoto and album/getcover. Attackers can enumerate…

  39. 4.3CVE-2026-107869EPSS 0.2%

    Missing Authorization vulnerability in WP Desk Flexible Subscriptions flexible-subscriptions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Flexible Subscriptions: from n/a through 1.8.4.

  40. 5.3CVE-2026-107863EPSS 0.2%

    Missing Authorization vulnerability in Codection Products Restricted Users for WooCommerce woo-products-restricted-users allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Products Restricted Users f…

  41. 4.3CVE-2026-107423EPSS 0.2%

    Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP User Manager: from n/a through 2.9.22.

  42. 5.4CVE-2026-107432EPSS 0.1%

    Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.

  43. 5.4CVE-2026-107430EPSS 0.1%

    Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper …

  44. 5.4CVE-2026-103356EPSS 0.2%

    Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15.

  45. 6.5CVE-2026-107791EPSS 0.2%

    The WP Comment Cleaner WordPress plugin before 7.2 does not perform a capability check or validate a nonce on one of its bulk comment-deletion routines, allowing authenticated users with minimal permissions, such as subscribers, to perman…

  46. 5.3CVE-2026-108800EPSS 0.2%

    A vulnerability was identified in yangzongzhuan RuoYi 4.8.3. The affected element is an unknown function. Such manipulation leads to cross-site request forgery. The attack can be executed remotely. The vendor was contacted early about this…

  47. 5.3CVE-2026-108891EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController getUserDetailByUserId handler that allows any authenticated user to read other users' details. Low-privileged attackers can supply arbitrary us…

  48. 5.3CVE-2026-108888EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartRoleController exportXls handler that allows any authenticated user to export department roles. Low-privileged attackers holding only the default minima…

  49. 5.3CVE-2026-108887EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysCommentController exportXls handler that allows any authenticated user to export all comments. Low-privileged attackers can request /sys/comment/exportXls to …

  50. 5.3CVE-2026-108886EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController queryChildrenByUsername handler that allows any authenticated user to retrieve other users' account records. Low-privileged attackers can suppl…