cve.bz

CWE-862: Missing Authorization, page 198

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2021-4346EPSS 1.2%

    The uListing plugin for WordPress is vulnerable to Unauthenticated Arbitrary Account Changes in versions up to, and including, 1.6.6. This is due to missing login checks on the stm_listing_profile_edit AJAX action. This makes it possible f…

  2. 5.3CVE-2021-4345EPSS 0.7%

    The uListing plugin for WordPress is vulnerable to authorization bypass due to missing capability and nonce checks on the UlistingUserRole::save_role_api method in versions up to, and including, 1.6.6. This makes it possible for unauthenti…

  3. 9.8CVE-2021-4343EPSS 1.4%

    The Unauthenticated Account Creation plugin for WordPress is vulnerable to Unauthenticated Account Creation in versions up to, and including, 1.6.6. This is due to the stm_listing_register AJAX action function being accessible and taking r…

  4. 9.8CVE-2021-4341EPSS 1.1%

    The uListing plugin for WordPress is vulnerable to authorization bypass via Ajax due to missing capability checks, missing input validation, and a missing security nonce in the stm_update_email_data AJAX action in versions up to, and inclu…

  5. 5.3CVE-2021-4339EPSS 0.9%

    The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file on the /1/api/ulisting-user/search REST-API route in versions up to, and including, 1.6.6. …

  6. 5.4CVE-2021-4338EPSS 0.6%

    The 404 to 301 plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the open_redirect & save_redirect functions in versions up to, and including, 3.0.7. This makes it possible for authenticated att…

  7. 9.3CVE-2020-36730EPSS 2.3%

    The CMP for WordPress is vulnerable to authorization bypass due to a missing capability check on the cmp_get_post_detail(), niteo_export_csv(), and cmp_disable_comingsoon_ajax() functions in versions up to, and including, 3.8.1. This makes…

  8. 4.3CVE-2020-36729EPSS 0.7%

    The 2J-SlideShow Plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the 'twoj_slideshow_setup' function called via the wp_ajax_twoj_slideshow_setup AJAX action in versions up to, and including, …

  9. 8.1CVE-2020-36725EPSS 1.1%

    The TI WooCommerce Wishlist and TI WooCommerce Wishlist Pro plugins for WordPress are vulnerable to an Options Change vulnerability in versions up to, and including, 1.21.11 and 1.21.4 via the 'ti-woocommerce-wishlist/includes/export.class…

  10. 6.5CVE-2020-36721EPSS 1.0%

    The Brilliance <= 1.2.7, Activello <= 1.4.0, and Newspaper X <= 1.3.1 themes for WordPress are vulnerable to Plugin Activation/Deactivation. This is due to the 'activello_activate_plugin' and 'activello_deactivate_plugin' functions in the …

  11. 7.1CVE-2020-36720EPSS 0.8%

    The Kali Forms plugin for WordPress is vulnerable to Authenticated Options Change in versions up to, and including, 2.1.1. This is due to the update_option lacking proper authentication checks. This makes it possible for any authenticated …

  12. 9.8CVE-2020-36719ExploitEPSS 4.3%

    The ListingPro - WordPress Directory & Listing Theme for WordPress is vulnerable to Arbitrary Plugin Installation, Activation and Deactivation in versions before 2.6.1. This is due to a missing capability check on the lp_cc_addons_actions …

  13. 7.3CVE-2020-36716EPSS 0.8%

    The WP Activity Log plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the setup_page function in versions up to, and including, 4.0.1. This makes it possible for unauthenticated attackers to ru…

  14. 4.6CVE-2020-36715EPSS 0.7%

    The Login/Signup Popup plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on several functions in versions up to, and including, 1.4. This makes it possible for authenticated attackers to inject arb…

  15. 5.3CVE-2020-36712EPSS 0.7%

    The Kali Forms plugin for WordPress is vulnerable to Unauthenticated Arbitrary Post Deletion in versions up to, and including, 2.1.1. This is due to the kaliforms_form_delete_uploaded_file function lacking any privilege or user protections…

  16. 4.3CVE-2020-36702EPSS 0.4%

    The Ultimate Addons for Gutenberg plugin for WordPress is vulnerable to Authenticated Settings Change in versions up to, and including, 1.14.7. This is due to missing capability checks on several AJAX actions. This makes it possible for au…

  17. 4.3CVE-2020-36699EPSS 0.8%

    The Quick Page/Post Redirect Plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the qppr_save_quick_redirect_ajax and qppr_delete_quick_redirect functions in versions up to, and including, 5.1.9.…

  18. 6.5CVE-2020-36697EPSS 0.9%

    The WP GDPR plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in versions up to, and including, 2.1.1. This makes it possible for unauthenticated attackers to delete any comment and modify the plu…

  19. 7.5CVE-2020-36696EPSS 1.1%

    The Product Input Fields for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the handle_downloads() function in versions up to, and including, 1.2.6. This makes it possible for un…

  20. 4.3CVE-2019-25143EPSS 0.7%

    The GDPR Cookie Compliance plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the gdpr_cookie_compliance_reset_settings AJAX action in versions up to, and including, 4.0.2. This makes it possibl…

  21. 8.8CVE-2019-25142EPSS 1.3%

    The Mesmerize & Materialis themes for WordPress are vulnerable to authenticated options change in versions up to, and including,1.6.89 (Mesmerize) and 1.0.172 (Materialis). This is due to 'companion_disable_popup' function only checking th…

  22. 9.8CVE-2019-25141ExploitEPSS 4.5%

    The Easy WP SMTP plugin for WordPress is vulnerable to authorization bypass in versions up to, and including, 1.3.9. This is due to missing capability checks on the admin_init() function, in addition to insufficient input validation. This …

  23. 5.3CVE-2019-25139EPSS 0.8%

    The Coming Soon Page & Maintenance Mode plugin for WordPress is vulnerable to unauthenticated settings reset in versions up to, and including 1.8.1 due to missing capability checks in the ~/functions/data-reset-post.php file which makes it…

  24. 6.5CVE-2023-33477EPSS 1.0%

    In Harmonic NSG 9000-6G devices, an authenticated remote user can obtain source code by directly requesting a special path.

  25. 6.4CVE-2023-2183EPSS 1.0%

    Grafana is an open-source platform for monitoring and observability. The option to send a test alert is not available from the user panel UI for users having the Viewer role. It is still possible for a user with the Viewer role to send a…

  26. 6.5CVE-2023-30948EPSS 0.5%

    A security defect in Foundry's Comments functionality resulted in the retrieval of attachments to comments not being gated by additional authorization checks. This could enable an authenticated user to inject a prior discovered attachment …

  27. 5.5CVE-2023-30915EPSS 0.08%

    In email service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

  28. 5.5CVE-2023-30914EPSS 0.08%

    In email service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

  29. 5.5CVE-2023-30866EPSS 0.08%

    In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

  30. 5.5CVE-2023-30865EPSS 0.08%

    In dialer service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.

  31. 7.8CVE-2023-30864EPSS 0.09%

    In Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  32. 7.8CVE-2023-30863EPSS 0.09%

    In Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  33. 5.5CVE-2022-48448EPSS 0.08%

    In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  34. 5.5CVE-2022-48447EPSS 0.08%

    In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  35. 5.5CVE-2022-48446EPSS 0.08%

    In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  36. 5.5CVE-2022-48445EPSS 0.08%

    In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  37. 5.5CVE-2022-48444EPSS 0.08%

    In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  38. 5.5CVE-2022-48443EPSS 0.08%

    In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  39. 5.5CVE-2022-48442EPSS 0.07%

    In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  40. 5.5CVE-2022-48441EPSS 0.07%

    In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  41. 5.5CVE-2022-48440EPSS 0.07%

    In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  42. 7.8CVE-2022-48392EPSS 0.08%

    In dialer service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  43. 5.5CVE-2022-48391EPSS 0.08%

    In telephony service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  44. 7.8CVE-2022-48390EPSS 0.08%

    In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  45. 6.5CVE-2023-33970EPSS 0.5%

    Kanboard is open source project management software that focuses on the Kanban methodology. A vulnerability related to a `missing access control` was found, which allows a User with the lowest privileges to leak all the tasks and projects …

  46. 5.4CVE-2023-33968EPSS 0.4%

    Kanboard is open source project management software that focuses on the Kanban methodology. Versions prior to 1.2.30 are subject to a missing access control vulnerability that allows a user with low privileges to create or transfer tasks t…

  47. 5.4CVE-2023-2415EPSS 0.7%

    The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the vcita_logout_callback function in versions up to, and includin…

  48. 5.3CVE-2023-2299EPSS 0.6%

    The Online Booking & Scheduling Calendar for WordPress by vcita plugin for WordPress is vulnerable to unauthorized medication of data via the /wp-json/vcita-wordpress/v1/actions/auth REST-API endpoint in versions up to, and including, 4.4.…

  49. 4.3CVE-2023-3053EPSS 0.5%

    The Page Builder by AZEXO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'azh_add_post' function in versions up to, and including, 1.27.133. This makes it possible for authe…

  50. 8.8CVE-2023-28657EPSS 0.7%

    Improper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user of the PC where the affected product is installed may gain an administrative privilege. As a result, information regarding the produ…