cve.bz

CWE-862: Missing Authorization, page 24

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Ask an AI about CWE-862

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2026-102397EPSS 0.2%

    Unauthenticated Broken Access Control in Ultimate Maps by Supsystic <= 1.5.5 versions.

  2. 6.5CVE-2026-102375EPSS 0.3%

    Missing Authorization vulnerability in Optimole Optimole optimole-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimole: from n/a through 4.2.14.

  3. 5.5CVE-2026-47604EPSS 0.1%

    NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerab…

  4. 5.5CVE-2026-47603EPSS 0.1%

    NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerab…

  5. 7.3CVE-2026-47580EPSS 0.1%

    NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization issue. A successful exploit of this vulnerability might lead to information disclosure and data tampe…

  6. 7.8CVE-2026-47559EPSS 0.1%

    NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could access memory belonging to another user's process. A successful exploit of this vulnerability might lead to code executio…

  7. 7.8CVE-2026-47552EPSS 0.1%

    NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could bypass an authorization check and modify privileged configuration. A successful exploit of this vulnerability might lead…

  8. 7.8CVE-2026-47493EPSS 0.1%

    NVIDIA vGPU software for Windows and Linux contains a vulnerability in the GPU kernel driver where a guest may access privileged host GPU resources for which it is not authorized. A successful exploit of this vulnerability might lead to co…

  9. 5.5CVE-2026-47492EPSS 0.1%

    NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper access control. A successful exploit of this vulnerability might lead to denial of service.

  10. 4.3CVE-2026-100280EPSS 0.2%

    In JetBrains YouTrack before 2026.2.19197 creating a project from an unreadable custom template was possible

  11. 2.7CVE-2026-100271EPSS 0.2%

    In JetBrains YouTrack before 2026.2.19197 missing authorisation on several endpoints allowed authenticated users to access information from other projects

  12. 4.3CVE-2026-100269EPSS 0.2%

    In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed

  13. 6.5CVE-2026-100266EPSS 0.2%

    In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from the server's trusted address

  14. 5.4CVE-2026-97285EPSS 0.2%

    Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.

  15. 4.3CVE-2026-97267EPSS 0.2%

    Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.

  16. 6.5CVE-2026-97247EPSS 0.2%

    Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.

  17. 5.4CVE-2026-97243EPSS 0.2%

    Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.

  18. 6.5CVE-2026-97239EPSS 0.3%

    Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.

  19. 7.5CVE-2026-97197EPSS 0.3%

    Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.

  20. 6.5CVE-2026-96834EPSS 0.3%

    Subscriber Sensitive Data Exposure in GiveWP <= 4.16.9 versions.

  21. 7.5CVE-2026-96823EPSS 0.3%

    Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.

  22. 7.5CVE-2026-96818EPSS 0.2%

    Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.

  23. 8.2CVE-2026-96817EPSS 0.4%

    Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.

  24. 7.5CVE-2026-96348EPSS 0.3%

    Unauthenticated Broken Access Control in Bookly <= 28.2 versions.

  25. 7.5CVE-2026-95587EPSS 0.3%

    Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.

  26. 7.1CVE-2026-94499EPSS 0.3%

    Subscriber Broken Access Control in FormGent <= 1.12.2 versions.

  27. 7.5CVE-2026-94120EPSS 0.3%

    Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.

  28. 6.5CVE-2026-94074EPSS 0.2%

    Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.

  29. 6.9CVE-2026-96342EPSS 0.2%

    Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83.

  30. 8.6CVE-2026-103239EPSS 0.3%

    MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not o…

  31. 2.7CVE-2026-94297EPSS 0.2%

    The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to cre…

  32. 5.3CVE-2026-93580EPSS 0.2%

    The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a…

  33. 4.3CVE-2026-85576EPSS 0.2%

    The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change …

  34. 7.1CVE-2026-90441EPSS 0.2%

    A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and r…

  35. 7.1CVE-2026-86136EPSS 0.3%

    A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and r…

  36. 5.3CVE-2026-81841EPSS 0.4%

    Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration …

  37. 6.5CVE-2026-102320EPSS 0.2%

    Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  38. 6.5CVE-2026-102310EPSS 0.2%

    Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  39. 5.4CVE-2026-95371EPSS 0.2%

    Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process and leveraged social engineering to spoof UI elements via a crafted HTML page. (Chromium se…

  40. 4.3CVE-2026-95342EPSS 0.2%

    Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  41. 5.4CVE-2026-95320EPSS 0.2%

    Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to spoof address bar via a crafted HTML page. (Chromium security severity: Medium)

  42. 8.1CVE-2026-95301EPSS 0.3%

    Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: High)

  43. 4.8CVE-2026-95300EPSS 0.2%

    Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to bypass system access restrictions via crafted network traffic. (Chromium security severity: Medium)

  44. 6.5CVE-2026-95297EPSS 0.2%

    Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  45. 4.3CVE-2026-95296EPSS 0.2%

    Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging social engineering to obtain cross-origin data via a crafted HTML page. (Chromium security severity: Low)

  46. 5.4CVE-2026-95290EPSS 0.2%

    Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Medium)

  47. 5.4CVE-2026-95287EPSS 0.2%

    Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

  48. 8.4CVE-2026-95285EPSS 0.3%

    Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass web origin policy via a crafted HTML page. (Chromium security severity: Low)

  49. 8.4CVE-2026-95278EPSS 0.2%

    Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the renderer process to bypass system access restrictions via a crafted HTML page. (Chromium security severity: Low)

  50. 9.1CVE-2026-100240EPSS 0.3%

    Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.4…