cve.bz

CWE-862: Missing Authorization, page 21

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Ask an AI about CWE-862

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.4CVE-2026-106250EPSS 0.2%

    Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

  2. 8.8CVE-2026-106225EPSS 0.3%

    Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted HTML page. (Chromium security severity: Medium)

  3. 3.1CVE-2026-106224EPSS 0.2%

    Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

  4. 4.3CVE-2026-106217EPSS 0.2%

    Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)

  5. 6.1CVE-2026-106208EPSS 0.2%

    Missing authorization in API in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to leak sensitive information via a crafted Chrome extension. (Chromium security severity: Medium)

  6. 8.1CVE-2026-106205EPSS 0.3%

    Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medi…

  7. 8.2CVE-2026-106198EPSS 0.3%

    Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  8. 7.6CVE-2026-106196EPSS 0.3%

    Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy into a privileged page via a crafted HTML page. (Chromium security severity: Medium)

  9. 8.3CVE-2026-106194EPSS 0.4%

    Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to potentially execute arbitrary code outside the sandbox v…

  10. 8.3CVE-2026-106191EPSS 0.4%

    Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security…

  11. 4.2CVE-2026-106187EPSS 0.2%

    Missing authorization in Permissions in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to spoof UI elements via a crafted HTML page. (Chromium security severity: Low)

  12. 5.9CVE-2026-106183EPSS 0.3%

    Missing authorization in Chromoting in Google Chrome on on Windows prior to 155.0.8059.39 allowed a remote attacker to obtain sensitive information via crafted network traffic. (Chromium security severity: Medium)

  13. 7.1CVE-2026-105488EPSS 0.3%

    Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user with only the global vault view permission to modify and delete global contact and folder entries.

  14. 6.0CVE-2026-103620EPSS 0.5%

    A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed a repository collaborator with write access to delete the current default branch through the GraphQL API and cause an attacker-controlled branch …

  15. 4.4CVE-2026-0198EPSS 0.09%

    In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitatio…

  16. 7.1CVE-2026-105860EPSS 0.2%

    Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user …

  17. 9.8CVE-2026-105859EPSS 0.3%

    Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, an attacker can submit a request to a specific update endpoint that modifies collection documents w…

  18. 6.9CVE-2026-105852EPSS 0.3%

    Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information abo…

  19. 7.7CVE-2026-105849EPSS 0.3%

    Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with u…

  20. 6.4CVE-2026-105848EPSS 0.2%

    Payload is a free and open source headless content management system. In @payloadcms/plugin-stripe versions before 3.90.0 and canary versions before 4.0.0-canary.34, an authenticated user who can reach the enabled optional Stripe REST prox…

  21. 9.3CVE-2026-104070EPSS 0.6%

    The Crayons plugin for SPIP before 3.5.0 contains a missing authorization vulnerability that allows unauthenticated attackers to modify arbitrary editable object fields by omitting the secu_ anti-forgery parameter in crayons_store.php, cau…

  22. 9.6CVE-2026-63691EPSS 0.2%

    Dell Container Storage Modules, versions prior to 1.18.0, contain(s) a Missing Authorization vulnerability in the Dell CSI Driver for PowerMax - csireverseproxy . An unauthenticated attacker with adjacent network access could potentially e…

  23. 8.6CVE-2026-105806EPSS 0.3%

    Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation th…

  24. 6.9CVE-2026-106041EPSS 0.3%

    Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to inject completed LOCAL_DISK replicas through the NotifyOffloadSuccess RPC. Attackers can mount a local disk …

  25. 8.8CVE-2026-106040EPSS 0.4%

    Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the coro_…

  26. 6.9CVE-2026-106039EPSS 0.3%

    Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to create, steal, and falsely complete replication tasks via the coro_rpc port. Attackers can invoke CreateCopy…

  27. 7.3CVE-2026-95526EPSS 0.2%

    Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.

  28. 8.8CVE-2026-62072EPSS 0.3%

    Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.

  29. 7.5CVE-2026-48199EPSS 0.4%

    Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.

  30. 7.5CVE-2026-42638EPSS 0.2%

    Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.

  31. 6.5CVE-2026-42637EPSS 0.3%

    Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

  32. 7.5CVE-2026-41560EPSS 0.3%

    Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.

  33. 6.5CVE-2026-39798EPSS 0.2%

    Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.

  34. 7.5CVE-2026-39796EPSS 0.3%

    Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.

  35. 7.5CVE-2026-39794EPSS 0.4%

    Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.

  36. 6.5CVE-2026-39787EPSS 0.3%

    Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.

  37. 6.5CVE-2026-39762EPSS 0.3%

    Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for …

  38. 7.5CVE-2026-39751EPSS 0.3%

    Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.

  39. 6.5CVE-2026-39749EPSS 0.2%

    Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.

  40. 7.1CVE-2026-39730EPSS 0.3%

    Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.

  41. 7.1CVE-2026-32578EPSS 0.3%

    Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.

  42. 7.1CVE-2026-25433EPSS 0.3%

    Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.

  43. 6.5CVE-2026-105059EPSS 0.4%

    Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress…

  44. 7.3CVE-2026-104406EPSS 0.3%

    Unauthenticated Broken Access Control in picu <= 3.10.1 versions.

  45. 7.2CVE-2026-104387EPSS 0.3%

    Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.

  46. 8.5CVE-2026-102915EPSS 0.2%

    Subscriber Broken Access Control in WPO365 <= 44.1 versions.

  47. 5.3CVE-2026-89289EPSS 0.2%

    The Fast Courier WordPress plugin through 5.2.3 does not restrict an unauthenticated REST route that writes order fulfillment data, allowing unauthenticated attackers to overwrite the courier status and customer-facing tracking details of…

  48. 7.8CVE-2026-25267EPSS 0.06%

    Memory corruption when non-secure loader rewrites page tables before secure memory initialization.

  49. 7.5CVE-2026-39789EPSS 0.2%

    Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.

  50. 7.5CVE-2026-39723EPSS 0.2%

    Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Morning for WooCommerce: from n/a through 2.4.1.