cve.bz

CWE-862: Missing Authorization, page 199

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 3.8CVE-2023-2434EPSS 0.7%

    The Nested Pages plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'reset' function in versions up to, and including, 3.2.3. This makes it possible for authenticated attackers, with ed…

  2. 5.4CVE-2023-2547EPSS 0.4%

    The Feather Login Page plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'deleteUser' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for a…

  3. 8.8CVE-2023-2545EPSS 0.7%

    The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOfUsers' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible…

  4. 4.2CVE-2023-24605EPSS 0.4%

    OX App Suite before backend 7.10.6-rev37 does not enforce 2FA for all endpoints, e.g., reading from a drive, reading contact data, and renaming tokens.

  5. 5.4CVE-2023-2945EPSS 0.4%

    Missing Authorization in GitHub repository openemr/openemr prior to 7.0.1.

  6. 4.3CVE-2023-32316EPSS 0.4%

    CloudExplorer Lite is an open source cloud management tool. In affected versions users can add themselves to any organization in CloudExplorer Lite. This is due to a missing permission check on the user profile. It is recommended to upgrad…

  7. 4.3CVE-2023-32311EPSS 0.4%

    CloudExplorer Lite is an open source cloud management platform. In CloudExplorer Lite prior to version 1.1.0 users organization/workspace permissions are not properly checked. This allows users to add themselves to any organization. This v…

  8. 5.0CVE-2022-39335EPSS 0.6%

    Synapse is an open-source Matrix homeserver written and maintained by the Matrix.org Foundation. The Matrix Federation API allows remote homeservers to request the authorization events in a room. This is necessary so that a homeserver rece…

  9. 7.8CVE-2023-2480EPSS 0.2%

    Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications

  10. 7.4CVE-2023-33983EPSS 0.6%

    The Introduction Client in Briar through 1.5.3 does not implement out-of-band verification for the public keys of introducees. An introducer can launch man-in-the-middle attacks against later private communication between two introduced pa…

  11. 7.5CVE-2023-33948EPSS 0.7%

    The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Med…

  12. 8.8CVE-2023-2494EPSS 0.4%

    The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_postdata' function in versions up to, and including, 3.3.19. Thi…

  13. 4.3CVE-2023-27304EPSS 0.5%

    Operation restriction bypass vulnerability in Message and Bulletin of Cybozu Garoon 4.6.0 to 5.9.2 allows a remote authenticated attacker to alter the data of Message and/or Bulletin.

  14. 7.8CVE-2023-31826EPSS 0.3%

    Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data.

  15. 7.5CVE-2023-33252EPSS 0.6%

    iden3 snarkjs through 0.6.11 allows double spending because there is no validation that the publicSignals length is less than the field modulus.

  16. 5.4CVE-2023-2716EPSS 0.5%

    The Groundhogg plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'ajax_upload_file' function in versions up to, and including, 2.7.9.8. This makes it possibl…

  17. 4.3CVE-2023-2715EPSS 0.6%

    The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'submit_ticket' function in versions up to, and including, 2.7.9.8. This makes it possible for authenticated at…

  18. 4.3CVE-2023-2714EPSS 0.5%

    The Groundhogg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'check_license' functions in versions up to, and including, 2.7.9.8. This makes it possible for authenticated a…

  19. 3.7CVE-2023-28623EPSS 0.5%

    Zulip is an open-source team collaboration tool with unique topic-based threading. In the event that 1: `ZulipLDAPAuthBackend` and an external authentication backend (any aside of `ZulipLDAPAuthBackend` and `EmailAuthBackend`) are the only…

  20. 3.1CVE-2023-32677EPSS 0.6%

    Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can add users to streams, and separately to limit who can invite users to the organization. In Zulip S…

  21. 5.4CVE-2023-2757EPSS 0.5%

    The Waiting: One-click countdowns plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on 'saveLang' functions in versions up to, and including, 0.6.2. This could lead to Cross-Site Scripting due to …

  22. 3.3CVE-2023-20726EPSS 0.08%

    In mnld, there is a possible leak of GPS location due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID:…

  23. 3.5CVE-2023-2590EPSS 0.5%

    Missing Authorization in GitHub repository answerdev/answer prior to 1.0.9.

  24. 5.5CVE-2023-32112EPSS 0.1%

    Vendor Master Hierarchy - versions SAP_APPL 500, SAP_APPL 600, SAP_APPL 602, SAP_APPL 603, SAP_APPL 604, SAP_APPL 605, SAP_APPL 606, SAP_APPL 616, SAP_APPL 617, SAP_APPL 618, S4CORE 100, does not perform necessary authorization checks for …

  25. 7.8CVE-2022-48388EPSS 0.09%

    In powerEx service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  26. 7.8CVE-2022-48384EPSS 0.1%

    In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  27. 7.8CVE-2022-48383EPSS 0.1%

    .In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  28. 5.5CVE-2022-48379EPSS 0.09%

    In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  29. 5.5CVE-2022-48378EPSS 0.08%

    In engineermode service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  30. 5.5CVE-2022-48377EPSS 0.09%

    In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  31. 5.5CVE-2022-48376EPSS 0.09%

    In dialer service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  32. 5.5CVE-2022-48375EPSS 0.09%

    In contacts service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  33. 5.5CVE-2022-48371EPSS 0.09%

    In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.

  34. 5.5CVE-2022-48370EPSS 0.09%

    In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.

  35. 7.8CVE-2022-48369EPSS 0.09%

    In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  36. 7.8CVE-2022-48368EPSS 0.09%

    In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  37. 7.8CVE-2022-48250EPSS 0.09%

    In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  38. 7.8CVE-2022-48249EPSS 0.09%

    In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  39. 7.8CVE-2022-48248EPSS 0.09%

    In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  40. 7.8CVE-2022-48247EPSS 0.09%

    In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  41. 7.8CVE-2022-48246EPSS 0.09%

    In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  42. 7.8CVE-2022-48245EPSS 0.09%

    In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  43. 7.8CVE-2022-48244EPSS 0.09%

    In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  44. 7.8CVE-2022-48243EPSS 0.09%

    In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  45. 5.5CVE-2022-48242EPSS 0.09%

    In telephony service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.

  46. 5.5CVE-2022-47493EPSS 0.09%

    In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  47. 5.5CVE-2022-47492EPSS 0.09%

    In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  48. 5.5CVE-2022-47490EPSS 0.09%

    In soter service, there is a possible missing permission check. This could lead to local denial of service with no additional execution privileges.

  49. 7.8CVE-2022-44433EPSS 0.09%

    In phoneEx service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.

  50. 5.5CVE-2022-38685EPSS 0.09%

    In bluetooth service, there is a possible missing permission check. This could lead to local denial of service in bluetooth service with no additional execution privileges needed.