cve.bz

CWE-862: Missing Authorization, page 39

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 3.3CVE-2026-0054EPSS 0.08%

    In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.…

  2. 7.8CVE-2026-83942EPSS 0.3%

    Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.

  3. 8.8CVE-2026-83941EPSS 0.8%

    Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.

  4. 6.9CVE-2026-81823EPSS 0.4%

    The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in information disclosure. Write operations are not impacted.

  5. 7.8CVE-2026-73014EPSS 0.3%

    Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally.

  6. 5.5CVE-2026-72966EPSS 0.3%

    Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally.

  7. 8.8CVE-2026-69724EPSS 0.8%

    Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  8. 9.1CVE-2026-69641EPSS 0.9%

    Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

  9. 7.5CVE-2026-69553EPSS 0.5%

    Missing authorization in Windows Hyper-V allows an authorized attacker to elevate privileges over a network.

  10. 8.8CVE-2026-69465EPSS 0.8%

    Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

  11. 5.5CVE-2026-69453EPSS 0.3%

    Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.

  12. 5.5CVE-2026-69403EPSS 0.4%

    Missing authorization in Windows SMB Server allows an authorized attacker to disclose information locally.

  13. 8.1CVE-2026-69380EPSS 0.7%

    Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

  14. 7.8CVE-2026-69377EPSS 0.3%

    Missing authorization in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.

  15. 7.5CVE-2026-47625EPSS 0.6%

    NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerability might lead to information disclosure, data tampering, and denial of service.

  16. 9.1CVE-2026-86840EPSS 0.4%

    The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supply an arbitrary registered `channel_id` when minting tokens without verifying th…

  17. 5.3CVE-2026-86737EPSS 0.3%

    snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asset IDs to retrieve barcodes and enumerate asset tags across tenants, including so…

  18. 7.1CVE-2026-86731EPSS 0.3%

    Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While the action requires the administrateUsers permission, it does not call requireAdm…

  19. 5.5CVE-2026-86665EPSS 0.5%

    A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The manipulation leads to missing authorization. Remote exploitation of the attack is p…

  20. 8.8CVE-2026-18851EPSS 1.2%

    Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate their privileges to admin.

  21. 8.8CVE-2026-12647EPSS 1.5%

    A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

  22. 8.8CVE-2026-12646EPSS 1.5%

    A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

  23. 8.8CVE-2026-12645EPSS 1.5%

    A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server.

  24. 7.7CVE-2026-77106EPSS 0.6%

    Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update all Commvault installations, including Commserve, Webserver, Command Center, Me…

  25. 7.5CVE-2026-3174EPSS 0.5%

    The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAuth return endpoint in all versions up to, and including, 5.27.4. This makes it po…

  26. 5.4CVE-2026-2520EPSS 0.4%

    The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'updateAddon' function in all versions up to, and including, 27.…

  27. 7.1CVE-2026-9331EPSS 0.4%

    The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the wpeddpcf_delete_feed function in all versio…

  28. 7.5CVE-2026-85400EPSS 0.5%

    Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show commands. This allowed them to modify arbitrary system configuration, which is norma…

  29. 5.3CVE-2026-77132EPSS 0.4%

    It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, low-privileged backend users to access information about records and content eleme…

  30. 7.5CVE-2026-81790EPSS 0.3%

    Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Csomagpontok és szállítási címkék WooCommerce…

  31. 7.1CVE-2026-81781EPSS 0.3%

    Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unbounce Landing Pages: from n/a through 1.1.4.

  32. 4.3CVE-2026-76963EPSS 0.3%

    Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to sensitive system configuration information. Successful exploitation could resul…

  33. 4.3CVE-2026-76962EPSS 0.3%

    SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functionality. An attacker with low privileges could send specially crafted requests to delete specific entries that should not b…

  34. 8.6CVE-2026-86438EPSS 1.1%

    Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install modules. Attackers can download and auto-activate arbitrary PHP modules from the m…

  35. 5.3CVE-2026-86436EPSS 0.5%

    Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content permissions to upload files. Attackers can upload polyglot files with attacker-chos…

  36. 4.3CVE-2026-86499EPSS 0.3%

    In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission

  37. 4.3CVE-2026-86496EPSS 0.3%

    In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses

  38. 6.5CVE-2026-86495EPSS 0.3%

    In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects

  39. 7.7CVE-2026-86494EPSS 0.3%

    In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues

  40. 8.1CVE-2026-86479EPSS 0.4%

    In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR

  41. 2.1CVE-2026-86307EPSS 0.2%

    A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerability affects unknown code. The manipulation leads to cross-site request forgery. I…

  42. 5.3CVE-2026-8279EPSS 0.4%

    The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' function in the CourseProgressItemsController in all versions up to, and including,…

  43. 5.3CVE-2026-86451EPSS 0.3%

    Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first checking whether the requester is authorized to view the object the reference belon…

  44. 2.3CVE-2026-86441EPSS 0.3%

    Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-related widgets did not honor Security.hide_organisation_index_from_users. As a resu…

  45. 2.3CVE-2026-86418EPSS 0.3%

    Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by the normal organisation index and per-organisation view. The affected endpoint …

  46. 5.3CVE-2026-86417EPSS 0.3%

    Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetched User.email, while redaction happened only inside the non-REST rendering branch. As a result, th…

  47. 5.3CVE-2026-86416EPSS 0.4%

    ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObject() perform state-changing operations without write permission checks. Authent…

  48. 7.1CVE-2026-86408EPSS 0.3%

    Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view(). The vulnerable handler queried CryptographicKey directly using the supplied key ID and selected…

  49. 9.4CVE-2026-61410EPSS 0.8%

    Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorization vulnerability. An unauthenticated attacker with remote access could potentially exploit this vu…

  50. 5.4CVE-2026-12853EPSS 0.4%

    The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible fo…