cve.bz

CWE-862: Missing Authorization, page 23

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Ask an AI about CWE-862

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2026-96613EPSS 0.2%

    The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive inform…

  2. 5.3CVE-2026-104914EPSS 0.2%

    MISP contains an improper access control vulnerability in its attribute search and paginated attribute view endpoints. When a user queries for soft-deleted attributes (e.g., via the deleted-attributes search or the paginated attribute lis…

  3. 7.1CVE-2026-104912EPSS 0.2%

    MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based o…

  4. 5.3CVE-2026-104910EPSS 0.3%

    MISP contains an authorization bypass in the related events listing functionality. When a user requests the list of events correlated to a given event, the system retrieved related event metadata directly from the correlation table without…

  5. 6.3CVE-2026-101104EPSS 0.3%

    The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized a…

  6. 4.3CVE-2026-39717EPSS 0.2%

    Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.

  7. 6.5CVE-2026-39439EPSS 0.2%

    Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebSamurai: from n/a through 1.0.7.

  8. 6.5CVE-2026-32585EPSS 0.2%

    Missing Authorization vulnerability in airano Airano MCP Bridge airano-mcp-bridge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Airano MCP Bridge: from n/a through 2.11.0.

  9. 6.5CVE-2026-85209EPSS 0.2%

    Missing Authorization vulnerability in AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Learnin…

  10. 8.7CVE-2026-104472EPSS 0.3%

    YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and fil…

  11. 9.2CVE-2026-104467EPSS 0.4%

    YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints…

  12. 8.7CVE-2026-104438EPSS 0.3%

    YesWiki before 4.6.7 contains a missing authorization vulnerability in the listpagestag and includepages actions of the tags tool, which enumerate pages without applying read-ACL filtering. Unauthenticated or unprivileged attackers can emb…

  13. 8.7CVE-2026-104410EPSS 0.4%

    SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of…

  14. 6.9CVE-2026-103762EPSS 0.3%

    SiYuan before v3.8.5 contains a missing authorization vulnerability in the getRefCreateSavePath, getShorthandSavePath, and getDocCreateSavePath endpoints that allows read-only publish visitors to learn unpublished notebook box IDs. Attacke…

  15. 9.8CVE-2026-94541EPSS 0.5%

    The WPMobile.App – Android and iOS App Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.82 This is due to the plugin not properly verifying that a user is authorized to perform an …

  16. 5.3CVE-2026-80337EPSS 0.2%

    Missing Authorization vulnerability in HAVELSAN Inc. Sef - AI Chatbot Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Sef - AI Chatbot Platform: before 2.1. NOTE: The vendor was contacted and i…

  17. 4.3CVE-2026-97219EPSS 0.2%

    The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fu…

  18. 5.3CVE-2026-90952EPSS 0.2%

    The WP Edit Password Protected WordPress plugin before 2.0.7 does not enforce its site-wide access restriction on the WordPress REST API, allowing unauthenticated users to read the content of published posts and pages that the site's acces…

  19. 5.4CVE-2026-85005EPSS 0.2%

    The Popup Maker WP WordPress plugin through 1.4.5 does not perform authorization checks on several of its actions and exposes its management page to any logged-in user, allowing users with a low-privileged role such as Subscriber to store …

  20. 4.3CVE-2026-79618EPSS 0.2%

    The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending o…

  21. 3.1CVE-2026-91023EPSS 0.1%

    The Motors WordPress plugin before 1.4.124 does not properly verify that a user is authorised to modify a listing before processing one of its listing management actions, allowing authenticated attackers with subscriber-level access and a…

  22. 2.1CVE-2026-104054EPSS 0.2%

    A security flaw has been discovered in calcom cal.diy up to 6.2.0. This affects the function doesUserIdHaveAccessToBooking of the file BookingAccessService.ts of the component PBAC Permission Engine. Performing a manipulation results in mi…

  23. 4.8CVE-2026-93832EPSS 0.09%

    A component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions from other apps.

  24. 4.4CVE-2026-17053EPSS 0.09%

    The SMBus driver API exposed smbus_smbalert_remove_cb() and smbus_host_notify_remove_cb() as Zephyr syscalls. Their verifiers in drivers/smbus/smbus_handlers.c validated only the dev argument with K_SYSCALL_OBJ(dev, K_OBJ_DRIVER_SMBUS) and…

  25. 7.6CVE-2026-97297EPSS 0.3%

    Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.

  26. 6.3CVE-2026-97281EPSS 0.2%

    Subscriber Broken Access Control in WP Project Manager <= 4.0.7 versions.

  27. 6.5CVE-2026-97280EPSS 0.2%

    Missing Authorization vulnerability in Mamunur Rashid Review Schema review-schema allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Review Schema: 3.1.0.

  28. 7.6CVE-2026-97277EPSS 0.3%

    Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.

  29. 6.5CVE-2026-97258EPSS 0.3%

    Subscriber Broken Access Control in Aruba Migration Tool <= 1.0.4 versions.

  30. 7.5CVE-2026-62073EPSS 0.2%

    Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.

  31. 5.4CVE-2026-62063EPSS 0.2%

    Missing Authorization vulnerability in Magepeople inc. WpTravelly tour-booking-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WpTravelly: from n/a through 2.3.1.

  32. 5.3CVE-2026-103341EPSS 0.2%

    Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) unlimited-elements-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issu…

  33. 5.3CVE-2026-103340EPSS 0.2%

    Missing Authorization vulnerability in Gemini Labs Site Reviews site-reviews allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Site Reviews: from n/a through 8.3.2.

  34. 5.3CVE-2026-102390EPSS 0.2%

    Missing Authorization vulnerability in VillaTheme AFFI – Affiliate Marketing for WooCommerce affi-affiliate-marketing-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AFFI – Affiliate Marke…

  35. 5.3CVE-2026-102381EPSS 0.2%

    Missing Authorization vulnerability in Ahmad Majestic Support majestic-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Majestic Support: from n/a through 1.2.0.

  36. 6.9CVE-2026-103274EPSS 0.2%

    Ghost versions 5.3.0 before 6.58.0 fail to properly enforce access controls on comments in private mode. Unauthenticated visitors can read comments that should be restricted, bypassing privacy settings.

  37. 6.9CVE-2026-103269EPSS 0.2%

    Ghost versions 5.3.0 before 6.62.0 contain a missing authorization vulnerability that allows an authenticated site member to read the excerpts of posts they do not have access to (gated content).

  38. 8.7CVE-2026-103268EPSS 0.3%

    Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password…

  39. 6.3CVE-2026-103260EPSS 0.3%

    n8n versions before 2.39.6 and 2.40.0 before 2.40.1 contain an approval bypass vulnerability in the Send and Wait node's Approve Within Chat mode. Attackers can submit resume requests without verification of the requester's identity or app…

  40. 7.5CVE-2026-103251EPSS 0.2%

    n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can…

  41. 4.3CVE-2026-103495EPSS 0.2%

    In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs

  42. 7.2CVE-2026-103490EPSS 0.3%

    In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links

  43. 7.1CVE-2026-103659EPSS 0.2%

    MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level …

  44. 5.3CVE-2026-96200EPSS 0.2%

    The Payments for Hubtel WordPress plugin before 1.0.2 does not verify that payment notifications received by its payment callback come from the payment provider, allowing unauthenticated attackers to mark arbitrary orders as paid without p…

  45. 6.5CVE-2026-90974EPSS 0.2%

    The WP Fusion Lite WordPress plugin before 3.48.0 does not require authentication on a settings handler that runs during admin initialization, allowing unauthenticated users to overwrite the site's CRM integration endpoint and credentials…

  46. 4.3CVE-2026-88999EPSS 0.3%

    The Redux Framework plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.14 This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it poss…

  47. 5.9CVE-2026-76147EPSS 0.4%

    A path traversal (ZIP Slip) vulnerability caused by insufficient authorization and integrity verification in the agent upgrade feature of Genian NAC/ZTNA allows a remote attacker to execute arbitrary code

  48. 7.3CVE-2026-76143EPSS 0.3%

    A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter.

  49. 7.5CVE-2026-92245EPSS 0.4%

    The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to ex…

  50. 7.1CVE-2026-101879EPSS 0.4%

    OpenClaw Windows Node before 2026.7.1-3 contains a missing authorization vulnerability in NodeService capture handlers that allows connected gateways or agents to perform screen snapshots, camera snaps, and location captures without consen…