cve.bz

CWE-862: Missing Authorization, page 27

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Ask an AI about CWE-862

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.0CVE-2026-67233EPSS 0.3%

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, The shovel management resource's is_authorized/2 delegates to rabbit_mgmt_util:is_authorized_monitor/2, which accepts the monitoring…

  2. 7.6CVE-2026-63203EPSS 0.3%

    Logto is the modern, open-source auth infrastructure for SaaS and AI apps. From 1.31.0 until 1.42.0, the Account API handlers in packages/core/src/routes/account/third-party-tokens.ts allow a caller holding a same-user access token with on…

  3. 6.5CVE-2026-65422EPSS 0.2%

    A flaw in the authorization mechanism for Media Gateway API in Genetec Security Center may allow a user with no playback privileges to generate video thumbnails.

  4. 10.0CVE-2026-97360EPSS 0.4%

    HFS2 version 2.4.0 and earlier contains an unauthenticated arbitrary file access vulnerability that allows unauthenticated attackers to read, write, append, and delete files anywhere the HFS service account has filesystem access outside th…

  5. 5.3CVE-2026-97061EPSS 0.2%

    Black Candy through 3.2.1 fails to scope playlist search queries to the authenticated session user, allowing any authenticated user to enumerate all playlists on the instance. Attackers can query the SearchController or Search::PlaylistsCo…

  6. 8.6CVE-2026-96515EPSS 0.3%

    This vulnerability exists in the Netlink ICT HG323RW router due to insufficient authorization and input validation controls in the diagnostic script import functionality. An authenticated attacker could exploit this vulnerability by upload…

  7. 4.3CVE-2026-97311EPSS 0.3%

    A flaw was found in the Admin REST API of Keycloak, an identity and access management solution. The endpoints used to retrieve groups associated with a specific role do not properly check for individual group visibility permissions. This a…

  8. 6.5CVE-2026-4806EPSS 0.2%

    The Custom Thank You Page for WooCommerce plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the save_option() function in all versions up to, and including, 1.1.2. This makes it…

  9. 4.3CVE-2026-3253EPSS 0.2%

    The MailerLite – Signup forms (official) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the forms() method of the AdminController class in all versions up to, and including, 1.7…

  10. 6.6CVE-2026-97177EPSS 0.2%

    A flaw was found in the user update mechanism of the Keycloak Admin REST API. When Fine-Grained Admin Permissions are enabled, the system fails to check for specific password reset authorizations during a general user profile update. This …

  11. 4.2CVE-2026-97176EPSS 0.2%

    A flaw was found in the Level of Authentication enforcement mechanism of Keycloak, an identity and access management solution. The issue occurs when a client specifically requires a higher security level for a user who already has an activ…

  12. 4.3CVE-2026-88847EPSS 0.1%

    The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not verify that a user is enrolled in a course before recording lesson completions against it, allowing any authenticated user, such as a subscriber, to create cours…

  13. 5.3CVE-2026-88846EPSS 0.2%

    The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not check whether user registration is enabled on the site before creating an account through one of its front-end registration flows, allowing unauthenticated users…

  14. 4.3CVE-2026-88845EPSS 0.1%

    The MasterStudy LMS WordPress Plugin WordPress plugin before 3.7.50 does not perform any capability or nonce checks on an administrative maintenance action, allowing any authenticated user, such as a subscriber, to trigger it and create p…

  15. 6.5CVE-2026-82195EPSS 0.3%

    The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it…

  16. 6.8CVE-2026-80338EPSS 0.2%

    The CMB2 WordPress plugin before 2.13.0 does not perform any capability check on one of its AJAX actions, allowing users with a role as low as Subscriber to create arbitrary WordPress options and corrupt existing ones, which can break core…

  17. 7.7CVE-2026-92470EPSS 0.2%

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 19.2.7, 19.3 before 19.3.3, and 19.4 before 19.4.1 that under certain conditions could have allowed an authenticated user to access sensitive CI/CD variabl…

  18. 2.1CVE-2026-96680EPSS 0.4%

    A vulnerability was detected in ByteDance Coze Scraper Extension up to 2.0.2. Affected by this vulnerability is the function chrome.runtime.onMessageExternal.addListener of the file static/background/index.js of the component External Mess…

  19. 5.5CVE-2026-96603EPSS 0.5%

    A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_logged_in/confirm_user of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing a…

  20. 2.1CVE-2026-67218EPSS 0.4%

    RabbitMQ is a messaging and streaming broker. Prior to versions 4.0.22, 4.1.11, 4.2.6, and 4.3.0, accept_content/2 at line 56 calls rabbit_stream_manager:create_super_stream/... directly after is_authorized (which only checks the managemen…

  21. 2.3CVE-2026-66075EPSS 0.2%

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.1, is_authorized/2 for the /federation-links/.../restart route uses is_authorized_monitor (accepts the monitoring tag), while allowed_m…

  22. 2.3CVE-2026-66069EPSS 0.3%

    RabbitMQ is a messaging and streaming broker. Prior to versions 4.1.13, 4.2.7, and 4.3.0, is_authorized/2 uses is_authorized_monitor for all methods. DELETE resets rabbit_core_metrics:reset_auth_attempt_metrics(). Impact is cosmetic (count…

  23. 2.1CVE-2026-96551EPSS 0.2%

    A vulnerability was determined in sfturing hosp_order up to 627f426331da8086ce8fff2017d65b1ddef384f8. Impacted is an unknown function of the file ssm_pro/src/main/java/cn/sfturing/web/CommonUserController.java. Executing a manipulation can…

  24. 9.9CVE-2026-84719EPSS 0.5%

    A flaw was found in the Ansible Automation Platform automation-controller. When a WorkflowJobTemplate is copied, the deep-copy permission sanitizer validates only the inventory, unified_job_template, and credentials of each cloned node and…

  25. 2.3CVE-2026-66076EPSS 0.3%

    RabbitMQ is a messaging and streaming broker. Prior to versions 3.13.15, 4.0.20, 4.1.11, 4.2.6, and 4.3.0, is_authorized/2 calls rabbit_mgmt_util:is_authorized/2, which checks only the management tag, instead of is_authorized_vhost/2. The …

  26. 7.5CVE-2026-95604EPSS 0.4%

    Unauthenticated Broken Access Control in Loops & Logic <= 4.2.4 versions.

  27. 6.5CVE-2026-95527EPSS 0.3%

    Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.

  28. 7.5CVE-2026-95513EPSS 0.3%

    Unauthenticated Broken Access Control in Online Booking & Scheduling Calendar for WordPress by vcita <= 4.6.0 versions.

  29. 5.4CVE-2026-94679EPSS 0.2%

    Subscriber Broken Access Control in Fluent Support <= 2.3.2 versions.

  30. 6.5CVE-2026-94498EPSS 0.3%

    Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.

  31. 5.3CVE-2026-94080EPSS 0.3%

    Unauthenticated Broken Access Control in MarketKing <= 2.1.70 versions.

  32. 5.3CVE-2026-94079EPSS 0.3%

    Unauthenticated Broken Access Control in WP User Manager <= 2.9.19 versions.

  33. 6.5CVE-2026-93620EPSS 0.3%

    Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.

  34. 6.5CVE-2026-93529EPSS 0.3%

    Contributor Broken Access Control in WSP MCP &#8211; AI Agents Connector <= 2.7.0 versions.

  35. 8.5CVE-2026-76648EPSS 0.4%

    CopyAPIView (awx/awx/api/generics.py:873) sets permission_classes = (IsAuthenticated,), so DRF's get_object() performs no object-level RBAC. The get() handler (lines 988–991) explicitly guards with request.user.can_access(obj._class_, 'rea…

  36. 7.7CVE-2026-76089EPSS 0.4%

    Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/sent-notifications/get-resend-modal-content control panel action in SentNotificationsController::actionGetResendModalContent accepts a request-sup…

  37. 8.2CVE-2026-76087EPSS 0.4%

    Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's anonymous formie/submissions/submit action in SubmissionsController::actionSubmit trusts a client-supplied submissionId when loading an incomplete submis…

  38. 8.5CVE-2026-76086EPSS 0.5%

    Formie is a Craft CMS plugin for creating forms. Prior to 2.2.23 and 3.1.31, Formie's formie/integrations/form-settings control panel action in IntegrationsController::actionFormSettings is reachable without the required form integration p…

  39. 4.3CVE-2026-71460EPSS 0.2%

    /api/v2/config/ is protected only by IsAuthenticated. license_info (account_number, subscription_id, pool_id, sku, support_level, instance counts) returned to any authenticated user. The superuser/…

  40. 5.0CVE-2026-71459EPSS 0.3%

    JobJobEventsChildrenSummary view has no model/parent_model. ModelAccessPermission.check_get_permissions() falls through (returns True) for any authenticated user. The view uses raw get_object_or_40…

  41. 5.3CVE-2026-52744EPSS 0.6%

    GoCD is a continuous deliver server. From 20.2.0 until 26.1.0, the internal GoCD UI fetch-artifact auto-suggestion API at /go/api/internal/pipelines/**/upstream does not adequately authorize access to upstream dependency data. An authentic…

  42. 6.5CVE-2026-86867EPSS 0.2%

    Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in `libs/ktem/ktem/pages…

  43. 8.7CVE-2026-95846EPSS 0.3%

    Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can config…

  44. 6.5CVE-2026-18179EPSS 0.4%

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization.

  45. 7.1CVE-2026-18177EPSS 0.3%

    IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to execute unauthorized payment actions due to missing authorization checks.

  46. 4.2CVE-2026-96446EPSS 0.3%

    A flaw was found in the Pushed Authorization Request PAR implementation of Keycloak. The issue occurs when the silent authentication path prompt=none is used, which allows the authorization process to skip certain steps if a user is alread…

  47. 3.7CVE-2026-87848EPSS 0.3%

    The MPCX Lightbox WordPress plugin 1.2.2 through 1.2.5 does not have any authorisation or authentication on one of its AJAX actions available to unauthenticated users, nor does it check the status of the requested post, allowing unauthenti…

  48. 8.2CVE-2026-96454EPSS 0.5%

    Pake turns a website into a desktop application built on Tauri. Every application it generates inherits two settings from the upstream template, and together they hand native functionality to untrusted web content. The first is in src-t…

  49. 6.5CVE-2026-6831EPSS 0.4%

    The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This m…

  50. 4.3CVE-2026-93510EPSS 0.3%

    The Points and Rewards for WooCommerce WordPress plugin before 2.10.4 does not validate the claimed reward amount or restrict who can call its Win Wheel claim handler, allowing authenticated users, Subscriber and above, to credit their own…