cve.bz

CWE-862: Missing Authorization, page 190

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.7CVE-2023-42655EPSS 0.09%

    In sim service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local escalation of privilege with System execution privileges needed

  2. 5.5CVE-2023-42654EPSS 0.08%

    In dm service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  3. 5.5CVE-2023-42652EPSS 0.09%

    In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  4. 5.5CVE-2023-42651EPSS 0.09%

    In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  5. 5.5CVE-2023-42650EPSS 0.09%

    In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  6. 5.5CVE-2023-42648EPSS 0.09%

    In engineermode, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  7. 5.5CVE-2023-42646EPSS 0.08%

    In Ifaa service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  8. 5.5CVE-2023-42644EPSS 0.09%

    In dm service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  9. 5.5CVE-2023-42643EPSS 0.08%

    In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  10. 5.5CVE-2023-42642EPSS 0.08%

    In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  11. 5.5CVE-2023-42641EPSS 0.08%

    In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  12. 5.5CVE-2023-42640EPSS 0.09%

    In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  13. 5.5CVE-2023-42639EPSS 0.09%

    In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  14. 5.5CVE-2023-42638EPSS 0.08%

    In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  15. 5.5CVE-2023-42637EPSS 0.09%

    In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  16. 5.5CVE-2023-42636EPSS 0.09%

    In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  17. 5.5CVE-2023-42635EPSS 0.09%

    In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  18. 5.5CVE-2023-42634EPSS 0.09%

    In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  19. 5.5CVE-2023-42633EPSS 0.09%

    In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  20. 5.5CVE-2023-42632EPSS 0.09%

    In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  21. 5.5CVE-2023-42631EPSS 0.08%

    In validationtools, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  22. 6.5CVE-2023-4198EPSS 0.7%

    Improper Access Control in Dolibarr ERP CRM <= v17.0.3 allows an unauthorized authenticated user to read a database table containing customer data

  23. 8.1CVE-2022-3007EPSS 0.3%

    The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used for performing Over-The-Air (OTA) firmware updates on the Bluetooth Low Energy (…

  24. 3.3CVE-2023-5862EPSS 0.3%

    Missing Authorization in GitHub repository hamza417/inure prior to Build95.

  25. 7.8CVE-2023-21393EPSS 0.1%

    In Settings, there is a possible way for the user to change SIM due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploita…

  26. 7.8CVE-2023-21389EPSS 0.1%

    In Settings, there is a possible bypass of profile owner restrictions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for ex…

  27. 7.8CVE-2023-21388EPSS 0.1%

    In Settings, there is a possible restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  28. 5.5CVE-2023-21382EPSS 0.09%

    In Content Resolver, there is a possible method to access metadata about existing content providers on the device due to a missing permission check. This could lead to local information disclosure with no additional execution privileges ne…

  29. 7.8CVE-2023-21378EPSS 0.09%

    In Telecomm, there is a possible way to silence the ring for calls of secondary users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is n…

  30. 7.8CVE-2023-21373EPSS 0.09%

    In Telephony, there is a possible way for a guest user to change the preferred SIM due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not …

  31. 7.8CVE-2023-21341EPSS 0.1%

    In Permission Manager, there is a possible way to bypass required permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not neede…

  32. 5.5CVE-2023-21340EPSS 0.1%

    In Telecomm, there is a possible way to get the call state due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

  33. 5.5CVE-2023-21329EPSS 0.1%

    In Activity Manager, there is a possible way to determine whether an app is installed due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is no…

  34. 7.8CVE-2023-21328EPSS 0.10%

    In Package Installer, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges …

  35. 5.5CVE-2023-21321EPSS 0.09%

    In Package Manager, there is a possible cross-user settings disclosure due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for ex…

  36. 7.8CVE-2023-21313EPSS 0.09%

    In Core, there is a possible way to forward calls without user knowledge due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…

  37. 5.5CVE-2023-21294EPSS 0.10%

    In Slice, there is a possible disclosure of installed packages due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitati…

  38. 7.8CVE-2021-39810EPSS 0.1%

    In verifyDefaults of CardEmulationManager.java, there is a possible way to set a third party app as the default contactless payment app without user consent due to a missing permission check. This could lead to local escalation of privileg…

  39. 5.4CVE-2023-5251EPSS 0.6%

    The Grid Plus plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'grid_plus_save_layout_callback' and 'grid_plus_delete_callback' functions in versions up to, a…

  40. 7.5CVE-2023-5426EPSS 0.6%

    The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta functions in vers…

  41. 8.8CVE-2023-5425EPSS 0.7%

    The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_change_user_meta and pmdm_wp_change_post_meta functions in versions up to, and including, 1…

  42. 6.5CVE-2023-30969EPSS 0.4%

    The Palantir Tiles1 service was found to be vulnerable to an API wide issue where the service was not performing authentication/authorization on all the endpoints.

  43. 8.8CVE-2023-5311EPSS 1.9%

    The WP EXtra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register() function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, wi…

  44. 8.1CVE-2023-4606EPSS 0.6%

    An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command.   This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.

  45. 4.3CVE-2023-46652EPSS 0.5%

    A missing permission check in Jenkins lambdatest-automation Plugin 1.20.9 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of LAMBDATEST credentials stored in Jenkins.

  46. 7.8CVE-2023-43488EPSS 0.2%

    The vulnerability allows a low privileged (untrusted) application to modify a critical system property that should be denied, in order to enable the ADB (Android Debug Bridge) protocol to be exposed on the network, exploiting it to gain a…

  47. 8.1CVE-2023-37910EPSS 0.7%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move support in version 14.0-rc-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, a…

  48. 7.5CVE-2023-5132EPSS 0.8%

    The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parseRemoteRequest function in versions up to, and including, 6.0.1. This makes it possible for unauthen…

  49. 9.8CVE-2023-5533EPSS 0.6%

    The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9 as well as 4.9.2. This makes it possible for unau…

  50. 4.3CVE-2023-4941EPSS 0.6%

    The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_swap function. This makes it possible for authenticated attacker…