cve.bz

CWE-862: Missing Authorization, page 193

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.5CVE-2023-38457EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges

  2. 7.8CVE-2023-38456EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges

  3. 7.8CVE-2023-38455EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges

  4. 5.5CVE-2023-38454EPSS 0.08%

    In vowifi service, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  5. 7.8CVE-2023-38453EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges

  6. 7.8CVE-2023-38452EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges

  7. 7.8CVE-2023-38451EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges

  8. 7.8CVE-2023-38450EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges

  9. 7.8CVE-2023-38449EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges

  10. 5.5CVE-2023-38448EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges

  11. 5.5CVE-2023-38447EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges

  12. 5.5CVE-2023-38446EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges

  13. 5.5CVE-2023-38445EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local denial of service with no additional execution privileges

  14. 7.8CVE-2023-38444EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges

  15. 7.8CVE-2023-38443EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges

  16. 5.5CVE-2023-38442EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  17. 5.5CVE-2023-38441EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  18. 5.5CVE-2023-38440EPSS 0.08%

    In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  19. 5.5CVE-2023-38439EPSS 0.09%

    In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  20. 5.5CVE-2023-38438EPSS 0.09%

    In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  21. 5.5CVE-2023-38437EPSS 0.09%

    In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  22. 5.5CVE-2023-38436EPSS 0.09%

    In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  23. 5.5CVE-2023-33918EPSS 0.09%

    In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  24. 5.5CVE-2023-33917EPSS 0.09%

    In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  25. 5.5CVE-2023-33916EPSS 0.09%

    In vowifiservice, there is a possible missing permission check.This could lead to local information disclosure with no additional execution privileges

  26. 7.5CVE-2023-33915EPSS 0.4%

    In LTE protocol stack, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed

  27. 4.4CVE-2022-48452EPSS 0.09%

    In Ifaa service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed

  28. 6.3CVE-2023-41046EPSS 0.5%

    XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. It is possible in XWiki to execute Velocity code without having script right by creating an XClass with a property of type "TextArea" …

  29. 5.3CVE-2023-23763EPSS 0.7%

    An authorization/sensitive information disclosure vulnerability was identified in GitHub Enterprise Server that allowed a fork to retain read access to an upstream repository after its visibility was changed to private. This vulnerability …

  30. 7.8CVE-2023-24674EPSS 0.2%

    Permissions vulnerability found in Bludit CMS v.4.0.0 allows local attackers to escalate privileges via the role:admin parameter.

  31. 5.5CVE-2023-41750EPSS 0.2%

    Sensitive information disclosure due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 32047.

  32. 4.3CVE-2023-4245EPSS 0.5%

    The WooCommerce PDF Invoice Builder for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the GetInvoiceDetail function in versions up to, and including, 1.2.89. This makes it possible for subscrib…

  33. 4.3CVE-2023-3999EPSS 0.4%

    The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on its AJAX calls in versions up to, and including, 0.6.2. This makes it possible for authenticated attackers, wi…

  34. 4.3CVE-2023-2353EPSS 0.5%

    The CHP Ads Block Detector plugin for WordPress is vulnerable to unauthorized plugin settings update and reset due to a missing capability check on the chp_abd_action function in versions up to, and including, 3.9.4. This makes it possible…

  35. 4.3CVE-2023-2174EPSS 0.4%

    The BadgeOS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_badgeos_log_entries function in versions up to, and including, 3.7.1.6. This makes it possible for authenti…

  36. 4.7CVE-2023-40530EPSS 0.6%

    Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead a user to access an arbitrary website via another applic…

  37. 4.3CVE-2023-38508EPSS 0.7%

    Tuleap is an open source suite to improve management of software developments and collaboration. In Tuleap Community Edition prior to version 14.11.99.28 and Tuleap Enterprise Edition prior to versions 14.10-6 and 14.11-3, the preview of a…

  38. 8.6CVE-2020-23793EPSS 0.8%

    An issue was discovered in spice-server spice-server-0.14.0-6.el7_6.1.x86_64 of Redhat's VDI product. There is a security vulnerablility that can restart KVMvirtual machine without any authorization. It is not yet known if there will be ot…

  39. 4.3CVE-2023-4302EPSS 0.3%

    A missing permission check in Jenkins Fortify Plugin 22.1.38 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, captur…

  40. 6.1CVE-2023-4434EPSS 0.3%

    Missing Authorization in GitHub repository hamza417/inure prior to build88.

  41. 4.3CVE-2023-3244EPSS 0.9%

    The Comments Like Dislike plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the restore_settings function called via an AJAX action in versions up to, and including, 1.2.0. This ma…

  42. 4.3CVE-2023-40344EPSS 0.7%

    A missing permission check in Jenkins Delphix Plugin 3.0.2 and earlier allows attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

  43. 6.1CVE-2023-39507EPSS 0.4%

    Improper authorization in the custom URL scheme handler in "Rikunabi NEXT" App for Android prior to ver. 11.5.0 allows a malicious intent to lead the vulnerable App to access an arbitrary website.

  44. 4.3CVE-2023-4374EPSS 0.7%

    The WP Remote Users Sync plugin for WordPress is vulnerable to unauthorized access of data and addition of data due to a missing capability check on the 'refresh_logs_async' functions in versions up to, and including, 1.2.11. This makes it…

  45. 5.3CVE-2023-40027EPSS 0.6%

    Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When `ui.isAccessAllowed` is set as `undefined`, the `adminMeta` GraphQL query is publicly accessible (no session required). This is different to the behav…

  46. 8.1CVE-2023-39438EPSS 0.5%

    A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information…

  47. 5.5CVE-2023-21288EPSS 0.2%

    In visitUris of Notification.java, there is a possible way to reveal images across users due to a missing permission check. This could lead to local information disclosure with User execution privileges needed. User interaction is not need…

  48. 5.5CVE-2023-21234EPSS 0.08%

    In launchConfirmationActivity of ChooseLockSettingsHelper.java, there is a possible way to enable developer options without the lockscreen PIN due to a missing permission check. This could lead to local escalation of privilege with no addi…

  49. 6.8CVE-2023-21140EPSS 0.1%

    In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with physical access to a device that's been fac…

  50. 6.8CVE-2023-21134EPSS 0.1%

    In onCreate of ManagePermissionsActivity.java, there is a possible way to bypass factory reset protections due to a missing permission check. This could lead to local escalation of privilege with physical access to a device that's been fac…