cve.bz

CWE-862: Missing Authorization, page 191

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2023-4668EPSS 0.6%

    The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. This can allow unauthenticated attackers to extract sensitive data includi…

  2. 5.3CVE-2023-3998EPSS 0.5%

    The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the userRate function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated attacker…

  3. 5.3CVE-2023-3869EPSS 0.5%

    The wpDiscuz plugin for WordPress is vulnerable to unauthorized modification of data due to a missing authorization check on the voteOnComment function in versions up to, and including, 7.6.3. This makes it possible for unauthenticated att…

  4. 5.3CVE-2022-4943EPSS 0.5%

    The miniOrange's Google Authenticator plugin for WordPress is vulnerable to authorization bypass due to a missing capability check when changing plugin settings in versions up to, and including, 5.6.5. This makes it possible for unauthenti…

  5. 4.1CVE-2022-3622EPSS 0.6%

    The Blog2Social plugin for WordPress is vulnerable to authorization bypass due to missing capability checks in versions up to, and including, 6.9.11. This makes it possible for authenticated attackers, with subscriber-level permissions an…

  6. 4.3CVE-2023-4947EPSS 0.4%

    The WooCommerce EAN Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the refresh_order_ean_data AJAX action in versions up to 6.1.0. This makes it possible for aut…

  7. 4.3CVE-2023-4943EPSS 0.6%

    The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_visibility function. This makes it possible for authenticated at…

  8. 5.3CVE-2021-4353EPSS 0.7%

    The WooCommerce Dynamic Pricing and Discounts plugin for WordPress is vulnerable to unauthenticated settings export in versions up to, and including, 2.4.1. This is due to missing authorization on the export() function which makes makes it…

  9. 8.8CVE-2020-36698EPSS 1.2%

    The Security & Malware scan by CleanTalk plugin for WordPress is vulnerable to unauthorized user interaction in versions up to, and including, 2.50. This is due to missing capability checks on several AJAX actions and nonce disclosure in t…

  10. 7.8CVE-2023-27792EPSS 0.2%

    An issue found in IXP Data Easy Install v.6.6.14884.0 allows an attacker to escalate privileges via lack of permissions applied to sub directories.

  11. 5.3CVE-2023-4645EPSS 0.8%

    The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai_ajax function. This can allow unauthenticated attackers to extract sensitive data such as post titles and slu…

  12. 4.3CVE-2023-4938EPSS 0.5%

    The BEAR for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.1.3.3. This is due to a missing capability check on the woobe_bulkoperations_apply_default_combination function. This makes it possible for a…

  13. 4.3CVE-2023-44689EPSS 0.4%

    e-Gov Client Application (Windows version) versions prior to 2.1.1.0 and e-Gov Client Application (macOS version) versions prior to 1.1.1.0 are vulnerable to improper authorization in handler for custom URL scheme. A crafted URL may direct…

  14. 5.4CVE-2023-42473EPSS 0.3%

    S/4HANA Manage (Withholding Tax Items) - version 106, does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges which has low impact on the confidentiality and integrity of the applica…

  15. 6.5CVE-2022-36228EPSS 0.4%

    Nokelock Smart padlock O1 Version 5.3.0 is vulnerable to Insecure Permissions. By sending a request, you can add any device and set the device password in the Nokelock app.

  16. 7.1CVE-2023-45247EPSS 0.2%

    Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 36497, Acronis Cyber Protect 16 (Linux, macOS, Wind…

  17. 7.5CVE-2023-43700EPSS 0.9%

    Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no not require authentication.

  18. 5.3CVE-2023-5331EPSS 0.4%

    Mattermost fails to properly check the creator of an attached file when adding the file to a draft post, potentially exposing unauthorized file information.

  19. 5.3CVE-2023-45370EPSS 0.4%

    An issue was discovered in the SportsTeams extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. SportsTeams: Special:SportsManagerLogo and Special:SportsTeamsManagerLogo do not check for th…

  20. 6.7CVE-2023-40654EPSS 0.09%

    In FW-PackageManager, there is a possible missing permission check. This could lead to local escalation of privilege with System execution privileges needed

  21. 6.7CVE-2023-40653EPSS 0.09%

    In FW-PackageManager, there is a possible missing permission check. This could lead to local escalation of privilege with System execution privileges needed

  22. 5.5CVE-2023-40650EPSS 0.08%

    In Telecom service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  23. 5.5CVE-2023-40649EPSS 0.08%

    In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  24. 5.5CVE-2023-40648EPSS 0.08%

    In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  25. 5.5CVE-2023-40647EPSS 0.08%

    In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  26. 5.5CVE-2023-40646EPSS 0.08%

    In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  27. 5.5CVE-2023-40645EPSS 0.08%

    In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  28. 5.5CVE-2023-40644EPSS 0.08%

    In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  29. 5.5CVE-2023-40643EPSS 0.08%

    In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  30. 5.5CVE-2023-40642EPSS 0.08%

    In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  31. 5.5CVE-2023-40641EPSS 0.08%

    In Messaging, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  32. 5.5CVE-2023-40640EPSS 0.08%

    In SoundRecorder service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges

  33. 5.5CVE-2023-40639EPSS 0.08%

    In SoundRecorder service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges

  34. 4.4CVE-2023-40638EPSS 0.09%

    In Telecom service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed

  35. 5.5CVE-2023-40637EPSS 0.08%

    In telecom service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges

  36. 4.4CVE-2023-40636EPSS 0.09%

    In telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with System execution privileges needed

  37. 7.8CVE-2023-40635EPSS 0.08%

    In linkturbo, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed

  38. 7.8CVE-2023-40634EPSS 0.08%

    In phasechecksercer, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed

  39. 5.5CVE-2023-40633EPSS 0.08%

    In phasecheckserver, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges needed

  40. 4.4CVE-2023-40631EPSS 0.09%

    In Dialer, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed

  41. 5.5CVE-2023-21291EPSS 0.1%

    In visitUris of Notification.java, there is a possible way to reveal image contents from another user due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interactio…

  42. 6.7CVE-2023-21244EPSS 0.1%

    In visitUris of Notification.java, there is a possible bypass of user profile boundaries due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not nee…

  43. 7.1CVE-2023-45246EPSS 0.2%

    Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 36343, Acronis Cyber Protect 16 (Linux, macOS, Wind…

  44. 5.3CVE-2023-4469EPSS 0.6%

    The Profile Extra Fields by BestWebSoft plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the prflxtrflds_export_file function in versions up to, and including, 1.2.7. This makes it poss…

  45. 5.5CVE-2023-45245EPSS 0.3%

    Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 36119.

  46. 7.1CVE-2023-45244EPSS 0.2%

    Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35895, Acronis Cyber Protect 16 (Linux, macOS, Wind…

  47. 5.5CVE-2023-45243EPSS 0.3%

    Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build…

  48. 5.5CVE-2023-45242EPSS 0.2%

    Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35739, Acronis Cyber Protect 17 (Linux, macOS, Windows) before build…

  49. 5.5CVE-2023-45240EPSS 0.2%

    Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35739.

  50. 5.5CVE-2023-44214EPSS 0.2%

    Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 35739.