CWE-862: Missing Authorization, page 2

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

1. 5.3CVE-2026-61805EPSS 0.2%2026-10-30

   Frappe Learning Management System (LMS) is a learning system that helps users structure their content. Prior to version 2.54.0, quiz submission records are not adequately authorized on the server. Through a `REST` bypass, an authenticated …

2. 5.4CVE-2026-119367EPSS 0.2%2026-10-30

   Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.18.2.

3. 5.4CVE-2026-62141EPSS 0.2%2026-10-30

   Missing Authorization vulnerability in WP ManageNinja LLC Fluent CRM fluent-crm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fluent CRM: from n/a through 3.2.6.

4. 7.1CVE-2026-119710EPSS 0.4%2026-10-30

   PipesHub 0.3.0 before 0.10.0 contains an event type injection vulnerability that allows authenticated users with only the crawl:write scope to delete connectors by injecting into the :connector path segment. Attackers can send a :connector…

5. 7.1CVE-2026-119707EPSS 0.3%2026-10-30

   SonicJS through 3.0.0 contains a missing authorization vulnerability in the /api/:collection and /api/content write routes that only check coarse role labels. Authenticated authors or editors can use a bearer JWT or API key to create, modi…

6. 6.9CVE-2026-119702EPSS 0.4%2026-10-30

   WPGraphQL before 2.24.1 contains a missing authorization vulnerability in the createComment mutation that allows unauthenticated attackers to comment on non-public posts by bypassing post status checks. Attackers can attach comments to dra…

7. 8.0CVE-2026-119287EPSS 0.2%2026-10-30

   Zuke is a code-first, strongly typed build automation system for Deno. Prior to 1.51.0, the @zuke/core MCP registry mode accepts command-form registry descriptors without applying the ZUKE_REGISTRY_LAUNCH_HOSTS authorization enforced for r…

8. 5.4CVE-2026-116407EPSS 0.2%2026-10-30

   Missing Authorization vulnerability in Webba Plugins Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Webba Booking: from n/a through 6.5.4.

9. 7.5CVE-2026-61739EPSS 0.4%2026-10-30

   SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.77, the Velociraptor Sigma exclusion-management endpoints in `backend/app/incidents/routes/incident_alert.py` omit role an…

10. 8.5CVE-2026-61708EPSS 0.4%2026-10-30

    SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, `POST /api/agent_data_store/upload` in `backend/app/data_store/data_store_routes.py` permits `customer_user` callers t…

11. 7.9CVE-2026-119682EPSS 0.3%2026-10-30

    An improper access control vulnerability exists in the multi-factor authentication (MFA) functionality of ManageEngine SharePoint Manager Plus (SPMP). A low-privileged authenticated user can bypass authorization checks to read and modify M…

12. 5.3CVE-2026-119665EPSS 0.4%2026-10-30

    WHartTest 2.2.0 through 2.8.1 contains a missing authorization vulnerability in ScheduledTaskViewSet and TaskExecutionViewSet that allows authenticated users to access other projects' tasks. Attackers can set project_pk to another project'…

13. 8.7CVE-2026-119654EPSS 0.5%2026-10-30

    DataCap through 2025.1.1 contains a missing authorization vulnerability that allows any authenticated user to escalate privileges by calling administrative role and menu management APIs. Attackers, including self-registered accounts, can s…

14. 5.3CVE-2026-119653EPSS 0.4%2026-10-30

    Nging through 5.3.5 contains an information disclosure vulnerability that allows any authenticated backend user to list host directories by abusing the public-tagged /user/autocomplete_path endpoint. Low-privileged users without file-manag…

15. 5.3CVE-2026-119648EPSS 0.3%2026-10-30

    Tencent BlueKing CMDB (bk-cmdb) through 3.14.6 contains a missing authorization vulnerability that allows authenticated users to view hosts of other businesses via POST /api/v3/hosts/search/asstdetail. Attackers can submit host search cond…

16. 5.3CVE-2026-119482EPSS 0.3%2026-10-30

    Missing Authorization vulnerability in Crocoblock JetFormBuilder jetformbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetFormBuilder: from n/a through 3.6.7.1.

17. 5.3CVE-2026-119368EPSS 0.3%2026-10-30

    Missing Authorization vulnerability in Liquid Web / StellarWP The Events Calendar the-events-calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects The Events Calendar: from n/a through 6.18.2.

18. 5.3CVE-2026-116860EPSS 0.2%2026-10-30

    Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.65.

19. 5.3CVE-2026-119576EPSS 0.2%2026-10-30

    ArcadeDB from 21.12.1 before 26.10.2 contains an authorization bypass vulnerability that allows users with only readRecord to replace the shared GraphQL schema via the read-only query endpoint. Attackers can send a GraphQL type definition …

20. 7.2CVE-2026-112347EPSS 0.3%2026-10-30

    Kirki plugin for WordPress before 6.4.1 contains a broken object-level access control vulnerability in its page REST API, where the PUT /wp-json/kirki/v1/pages/{page_id} route and the save_page_data, duplicate, and delete handlers in PageC…

21. 5.3CVE-2026-119556EPSS 0.3%2026-10-30

    Moodle 4.2.0 through 4.5.15, 5.0.0 through 5.0.11, 5.1.0 through 5.1.8, 5.2.0 through 5.2.4, and 5.3.0 contain a missing capability check in the core_grades_get_gradeitems web service that allows enrolled students to view hidden grade item…

22. 7.1CVE-2026-119551EPSS 0.3%2026-10-30

    Jellyfin through 12.4 contains an authorization bypass vulnerability in SuggestionsController.GetSuggestions that allows authenticated non-administrator users to bypass library and parental restrictions by omitting the userId parameter. At…

23. 5.1CVE-2026-119550EPSS 0.2%2026-10-30

    Jellyfin through 12.4 contains an information disclosure vulnerability in PlaylistsController.GetPlaylist that allows authenticated users to read hidden item IDs by requesting public or shared playlists. Restricted or parental-controlled u…

24. 7.5CVE-2026-110732EPSS 0.3%2026-10-30

    The AI Engine – The Chatbot, AI Framework & MCP for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.8.6 This is due to the MCP module's OAuth 2.1 Dynamic Client Registration end…

25. 4.3CVE-2026-119087EPSS 0.2%2026-10-30

    The Content Egg – Affiliate Product Importer & Price Comparison plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.0.0 This is due to the plugin not properly verifying that a user is authori…

26. 4.3CVE-2026-119059EPSS 0.2%2026-10-30

    The Content Egg plugin for WordPress is vulnerable to unauthorized modification of data due to a missing per-post capability check on the ajaxUpdateProducts() function in versions up to, and including, 12.0.0. The handler verifies a static…

27. 5.3CVE-2026-118101EPSS 0.2%2026-10-30

    The BuddyForms WordPress plugin before 2.10.1 does not verify that a user editing an existing entry is the author of the target post, allowing users who have been granted edit access to a form, as low as Subscriber, to overwrite the title,…

28. 5.4CVE-2026-118072EPSS 0.2%2026-10-30

    The Fraud Prevention For WooCommerce and EDD WordPress plugin before 2.3.6 does not check that a user is allowed to manage orders before letting them add an order's customer details to the store's fraud blacklist, which could allow users w…

29. 6.5CVE-2026-96389EPSS 0.2%2026-10-30

    Missing Authorization vulnerability in Drupal Xray Audit allows Forceful Browsing. This issue affects Xray Audit versions: from 0.0.0 to 1.6.3, from 2.0.0 to 2.0.4, from 3.0.0 to 3.1.1.

30. –CVE-2026-118573EPSS 0.1%2026-10-30

    Missing Authorization vulnerability in Drupal OAuth2 Token Manager allows Forceful Browsing. This issue affects OAuth2 Token Manager versions: from 0.0.0 to 1.2.0.

31. 6.5CVE-2026-118539EPSS 0.3%2026-10-30

    Missing Authorization vulnerability in Drupal Commerce Core allows Forceful Browsing. This issue affects Commerce Core versions: from 0.0.0 to 2.41, from 3.0.0 to 3.3.13.

32. –CVE-2026-114547EPSS 0.1%2026-10-30

    Missing Authorization vulnerability in Drupal TinyPNG allows Forceful Browsing. This issue affects TinyPNG versions: from 0.0.0 to 2.0.2.

33. –CVE-2026-114535EPSS 0.1%2026-10-30

    Missing Authorization vulnerability in Drupal Swiper formatter allows Forceful Browsing. This issue affects Swiper formatter versions: from 0.0.0 to 2.1.2, from 3.0.1 to 3.1.0.

34. –CVE-2026-114533EPSS 0.1%2026-10-30

    Missing Authorization vulnerability in Drupal Ágora Transparency Theme allows Forceful Browsing. This issue affects Ágora Transparency Theme versions: from 0.0.0 to 1.2.3.

35. 3.7CVE-2026-107309EPSS 0.2%2026-10-30

    Missing Authorization vulnerability in Drupal Easy Breadcrumb allows Forceful Browsing. This issue affects Easy Breadcrumb versions: from 0.0.0 to 2.0.11.

36. 5.3CVE-2026-107267EPSS 0.2%2026-10-30

    Missing Authorization vulnerability in Drupal DKAN allows Forceful Browsing. This issue affects DKAN versions: from 0.0.0 to 4.0.4, from 4.1.0 to 4.1.5.

37. –CVE-2026-107266EPSS 0.1%2026-10-30

    Missing Authorization vulnerability in Drupal Views Share allows Forceful Browsing. This issue affects Views Share versions: from 0.0.0 to 2.0.1.

38. 9.0CVE-2026-61707EPSS 0.2%2026-10-29

    SOCFortress CoPilot focuses on providing a single pane of glass for all your security operations needs. Prior to 0.1.76, in the reported deployment, case-report templates uploaded by `customer_user`, the lowest-privilege portal role, are l…

39. 6.5CVE-2026-118760EPSS 0.4%2026-10-29

    Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. From 0.5.1 until 2.17.0, the frontend artifact routes did not check whether an authenticated user was authorized to access the requested na…

40. 7.5CVE-2026-118759EPSS 0.3%2026-10-29

    Kubeflow Pipelines enables users to build and deploy portable, scalable machine learning workflows. Prior to 2.18.0, the API server's GET /apis/v1alpha1/runs/{run_id}/nodes/{node_id}/log handler retrieved logs without authorizing the calle…

41. 6.5CVE-2025-12523EPSS 0.2%2026-10-29

    Broken Object Level Authorization in Users Configuration Endpoint allows Information Disclosure to authenticated user

42. 9.1CVE-2026-90863EPSS 0.7%2026-10-29

    Missing authorization in the administrative interface of Progress Software WS_FTP Server versions prior to 2024.0.7 and 2025.0.4 on Windows could allow a delegated Host Administrator to exceed their authorized scope, potentially enabling a…

43. 5.4CVE-2026-42690EPSS 0.2%2026-10-29

    Subscriber Broken Access Control in LearnPress <= 4.4.10 versions.

44. 8.6CVE-2026-119129EPSS 0.3%2026-10-29

    ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 contains a missing authorization vulnerability in Login V2 that allows attackers to approve OAuth 2.0 device authorizations using a victim's existing session without consent. Attackers c…

45. 8.8CVE-2026-110196EPSS 0.5%2026-10-29

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote attacker with a low-privileged authenticated account to bypass the administrator-only restriction and execute arbitrary code on the server by configuring a built-in code-execution …

46. 6.4CVE-2026-109891EPSS 0.1%2026-10-29

    Missing Authorization vulnerability in weDevs Happy Addons for Elementor happy-elementor-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Happy Addons for Elementor: from n/a through 3.50.1.

47. 8.8CVE-2026-107327EPSS 0.7%2026-10-29

    IBM Langflow OSS 1.0.0 through 1.12.4 could allow a remote authenticated attacker to execute arbitrary code due to missing authorization.

48. 5.3CVE-2026-97073EPSS 0.3%2026-10-29

    Missing Authorization vulnerability in myCred myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCred: from n/a through 4.0.2.

49. 5.3CVE-2026-54871EPSS 0.3%2026-10-29

    Missing Authorization vulnerability in Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons shopbuilder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopBuilder – Elementor WooComm…

50. 5.3CVE-2026-54853EPSS 0.2%2026-10-29

    Missing Authorization vulnerability in Cozmoslabs Profile Builder profile-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Profile Builder: from n/a through 4.0.5.