cve.bz

CWE-862: Missing Authorization, page 18

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Ask an AI about CWE-862

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-108637EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to remove user group members by calling DELETE /sys/user/deleteUserGroupBatch. Attackers can supply any groupId and comma…

  2. 5.3CVE-2026-108636EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartController appImportExcel handler that allows any authenticated user to import departments. Low-privileged attackers can upload a crafted Excel workbook…

  3. 5.3CVE-2026-108635EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the GET /sys/sysDepart/getDepartmentHead endpoint of SysDepartController that allows any authenticated user to list department staff. Low-privileged attackers can en…

  4. 5.3CVE-2026-108634EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obta…

  5. 5.3CVE-2026-108633EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create department permission bindings via POST /sys/sysDepartPermission/add. Attackers can submit arbitrary departId, …

  6. 5.3CVE-2026-108632EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController queryById handler that allows any authenticated user to read department permission records. Low-privileged attackers can request GE…

  7. 5.3CVE-2026-108631EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysDepartPermissionController delete handler that allows low-privileged authenticated users to delete department permission bindings. Attackers can obtain row id…

  8. 5.3CVE-2026-108630EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in SysDepartPermissionController that allows any authenticated user to modify department permission records by calling the edit endpoint. Low-privileged attackers can o…

  9. 5.3CVE-2026-108629EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartPermissionController that allows any authenticated user to modify department data rules. Low-privileged attackers can send depar…

  10. 8.6CVE-2026-108628EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDeptRolePermission endpoint of SysDepartPermissionController that allows any authenticated user to modify department role permissions. Low-privileged attacke…

  11. 5.3CVE-2026-108627EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the loadDatarule handler of SysRoleController that lets any authenticated user query role data rules. Low-privileged attackers can request GET /sys/role/datarule/{pe…

  12. 5.3CVE-2026-108626EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController queryById handler that allows low-privileged authenticated users to read any message push record. Attackers can supply arbitrary record ids …

  13. 5.3CVE-2026-108625EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message push records by calling PUT /sys/message/sysMessage/edit. Attackers can submit a request body naming an…

  14. 5.3CVE-2026-108624EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysMessageController deleteBatch handler that allows low-privileged authenticated users to delete message records. Attackers can obtain record ids from the ungua…

  15. 7.1CVE-2026-108623EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController deleteBatch handler that allows any authenticated user to delete system audit log entries. Low-privileged attackers can send a DELETE request wi…

  16. 5.3CVE-2026-108622EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysLogController delete handler that allows any authenticated user to delete audit log entries. Low-privileged attackers can obtain log ids from the unguarded /s…

  17. 5.3CVE-2026-108621EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController edit handler that allows any authenticated user to modify organizational positions. Low-privileged attackers can obtain position ids from t…

  18. 5.3CVE-2026-108620EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysPositionController deleteBatch handler that allows any authenticated user to delete organizational positions. Low-privileged attackers can send comma-separate…

  19. 5.3CVE-2026-108619EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete message templates via the DELETE /sys/message/sysMessageTemplate/deleteBatch endpoint. Attackers can supply com…

  20. 5.3CVE-2026-108618EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify message templates via PUT /sys/message/sysMessageTemplate/edit. Attackers can obtain template ids from the ungu…

  21. 5.3CVE-2026-108617EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to create message templates by calling POST /sys/message/sysMessageTemplate/add. Attackers holding only minimal roles can…

  22. 5.3CVE-2026-108616EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController deleteBatch handler that allows any authenticated user to delete AI evaluator records. Low-privileged attackers can send comma-separated i…

  23. 5.3CVE-2026-108615EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController delete handler that allows low-privileged authenticated users to delete AI evaluator records. Attackers can send DELETE requests to /airag…

  24. 5.3CVE-2026-108614EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragExtDataController exportXls handler that allows any authenticated user to export AI evaluator data. Low-privileged attackers can request /airag/extData/expo…

  25. 5.3CVE-2026-108613EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiragAppController release handler that allows any authenticated user to publish or unpublish other users' AI applications. Low-privileged attackers can send POS…

  26. 5.3CVE-2026-108612EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController deleteBatch handler that allows low-privileged authenticated users to delete word templates. Attackers can send a DELETE request to /a…

  27. 5.3CVE-2026-108611EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController delete handler that allows any authenticated user to delete word templates. Low-privileged attackers can send DELETE requests to /aira…

  28. 5.3CVE-2026-108610EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AigcWordTemplateController edit handler that allows any authenticated user to modify word templates. Low-privileged attackers can send PUT or POST requests to /a…

  29. 5.3CVE-2026-108606EPSS 0.3%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController deleteById handler that allows any authenticated user to delete OCR records. Low-privileged attackers can obtain record ids from the unguarded GE…

  30. 5.3CVE-2026-108605EPSS 0.2%

    JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the AiOcrController updateById handler that allows any authenticated user to modify global OCR templates. Low-privileged attackers can send PUT requests to /airag/oc…

  31. 7.5CVE-2026-65459EPSS 0.3%

    Unauthenticated Arbitrary Content Deletion in Forminator <= 1.57.3 versions.

  32. 7.3CVE-2026-62118EPSS 0.2%

    Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.

  33. 6.3CVE-2026-62035EPSS 0.2%

    Subscriber Broken Access Control in AWS S3 for WordPress Plugin – Upcasted <= 3.1.0 versions.

  34. 7.6CVE-2026-62033EPSS 0.3%

    Subscriber Settings Change in uListing <= 2.2.0 versions.

  35. 7.5CVE-2026-42706EPSS 0.2%

    Unauthenticated Broken Access Control in DK <= 3.2.1 versions.

  36. 7.5CVE-2026-42705EPSS 0.2%

    Unauthenticated Broken Access Control in Grand News <= 3.4 versions.

  37. 6.5CVE-2026-40808EPSS 0.3%

    Subscriber Broken Access Control in Jetpack VideoPress <= 3.6 versions.

  38. 7.6CVE-2026-40802EPSS 0.3%

    Subscriber Settings Change in Pubjet | پاب‌جت <= 5.4.8 versions.

  39. 8.1CVE-2026-40801EPSS 0.3%

    Subscriber Broken Access Control in Wordable <= 8.2.10 versions.

  40. 8.1CVE-2026-40777EPSS 0.4%

    Subscriber Broken Access Control in WPSection <= 1.5.1 versions.

  41. 4.3CVE-2026-103685EPSS 0.2%

    Missing Authorization vulnerability in VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce woo-alidropship allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ALD – Dropshippi…

  42. 7.5CVE-2026-106609EPSS 0.2%

    Missing Authorization vulnerability in Web Impian Bayarcash WooCommerce bayarcash-wc allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bayarcash WooCommerce: from n/a through 4.4.2.

  43. 6.9CVE-2026-103357EPSS 0.3%

    Missing Authorization vulnerability in VillaTheme GIFT4U gift4u-gift-cards-all-in-one-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GIFT4U: from n/a through 1.1.3.

  44. 7.1CVE-2026-108581EPSS 0.2%

    TencentCloud Octop through 1.0.2b6 contains a missing authorization vulnerability that allows authenticated low-privileged users to read stored provider API keys via GET /api/providers and GET /api/voice/providers. Attackers can query thes…

  45. 5.3CVE-2026-108165EPSS 0.2%

    Immich through 3.3.1 contains a missing authorization vulnerability in the partner synchronization stream that allows authenticated partners to read Locked Folder asset metadata because sync queries do not exclude Locked visibility. Attack…

  46. 7.5CVE-2026-93950EPSS 0.2%

    Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a through 1.4.108.

  47. 4.3CVE-2026-104728EPSS 0.3%

    The AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not properly verify…

  48. 8.1CVE-2026-94538EPSS 0.2%

    The WP File Download plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.3.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it pos…

  49. 5.3CVE-2026-3717EPSS 0.2%

    The CV Builder – Professional Resume Builder SaaS plugin for WordPress is vulnerable to unauthorized arbitrary file upload due to a missing capability check on the 'wp_save_signature_image' function in all versions up to, and including, 1.…

  50. 5.4CVE-2026-15178EPSS 0.2%

    The Fluent Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.2.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possibl…