cve.bz

CWE-862: Missing Authorization, page 41

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.2CVE-2026-67398EPSS 0.5%

    Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL versions from 4.5.0. The vulnerability allows an unauthenticated user to get WH…

  2. 9.3CVE-2026-85433EPSS 0.8%

    MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners at runtime. Attackers can send crafted PSHARE_CMD messages with cmd=output or cmd…

  3. 8.8CVE-2026-70178EPSS 0.6%

    Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.

  4. 7.1CVE-2026-85395EPSS 0.4%

    UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks. Attackers with minimal admin privileges can create OAuth API integrations, mint …

  5. 7.1CVE-2026-85390EPSS 0.5%

    Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to perform administrative actions. Attackers with user-role sessions can create arb…

  6. 4.3CVE-2026-78596EPSS 0.3%

    Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification of data via Privilege Abuse (CAPEC-122). An authenticated user holding Security …

  7. 4.3CVE-2026-78595EPSS 0.3%

    Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclosure via Privilege Abuse (CAPEC-122). An authenticated user holding read-level Fl…

  8. 8.6CVE-2026-63219EPSS 0.5%

    GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is unprotected and allows the upload of external uncontrolled …

  9. 5.3CVE-2026-85309EPSS 0.3%

    Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ultimate Maps by Supsystic: from n/a through 1.5.3.

  10. 6.5CVE-2026-85306EPSS 0.3%

    Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MountDev AI MCP Connector for WordPress: from…

  11. 5.3CVE-2026-85304EPSS 0.3%

    Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Unlimited Elements Fo…

  12. 7.5CVE-2026-84847EPSS 0.3%

    Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions.

  13. 8.1CVE-2026-84779EPSS 0.4%

    Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt &amp; MCP for AI Agents <= 1.51.0 versions.

  14. 6.5CVE-2026-84758EPSS 0.3%

    Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions.

  15. 8.2CVE-2026-84757EPSS 0.4%

    Unauthenticated Settings Change in WP Compress <= 7.21.28 versions.

  16. 6.5CVE-2026-84755EPSS 0.3%

    Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions.

  17. 6.5CVE-2026-84754EPSS 0.3%

    Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions.

  18. 9.8CVE-2026-84238EPSS 0.5%

    Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions.

  19. 6.5CVE-2026-84215EPSS 0.3%

    Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions.

  20. 7.7CVE-2026-55658EPSS 0.3%

    Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting mechanisms. In 3e595f3 and prior, when a streaming proposal is funded, the cluster…

  21. 5.3CVE-2026-85226EPSS 0.3%

    MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applying the distribution, sharing group, organization, or other access-control restric…

  22. 7.2CVE-2026-85213EPSS 0.4%

    Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfRotation. Authenticated users with minimal account:read permissions can read inte…

  23. 8.7CVE-2026-85212EPSS 0.6%

    CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Sub-administrators and accounts with no roles can access restricted admin endpoint…

  24. 5.3CVE-2026-85210EPSS 0.3%

    Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts and roles. Attackers can query the endpoint with filter_criterion parameters to…

  25. 7.1CVE-2026-84989EPSS 0.4%

    ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge feature — `POST /lua/rest/v2/delete/tag/tag.lua` and `POST /lua/rest/v2/edit/tag/tag.l…

  26. 9.5CVE-2026-78069EPSS 0.4%

    Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `J2StoreControllerApps`'s `appTask` delegation path instantiates app-plugin controllers with…

  27. 7.6CVE-2026-53635EPSS 0.4%

    Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms/djangoapps/instructor/views/instructor_dashboard.py:430 is decorated only with …

  28. 8.3CVE-2026-45730EPSS 0.5%

    Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project management API, allowing any authenticated user (without membership in the target …

  29. 5.4CVE-2026-84674EPSS 0.2%

    Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credentials stored in Jenkins.

  30. 5.4CVE-2026-84661EPSS 0.4%

    A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `waitForBuild` step when the `propagateAbort` parameter is used to be canceled even when the build's…

  31. 5.4CVE-2026-84660EPSS 0.4%

    A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be canceled even when the build's authentication lacks Item/Cancel permission on t…

  32. 4.3CVE-2026-84659EPSS 0.3%

    Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbox globally in the system" setting, allowing attackers to disable it through Stap…

  33. 4.2CVE-2026-84657EPSS 0.4%

    In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build triggered to wait for completion, allowing attackers with Item/Build permission…

  34. 4.3CVE-2026-84656EPSS 0.5%

    A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build parameter names and values of jobs they have no access to.

  35. 3.5CVE-2026-84653EPSS 0.3%

    Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance configuration page, allowing attackers with Overall/Manage permission to modify Appea…

  36. 7.3CVE-2026-18058EPSS 0.1%

    The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in escalated privileges of an attacker within the system.

  37. 5.5CVE-2026-78601EPSS 0.3%

    Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with el…

  38. 5.3CVE-2026-17563EPSS 0.3%

    The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when rendering the form, allowing unauthenticated users to create and, depending on the…

  39. 8.2CVE-2025-15485EPSS 0.3%

    The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them and update the plugin settings, clear logs etc

  40. 5.3CVE-2026-81269EPSS 0.3%

    Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13.

  41. 5.3CVE-2026-81166EPSS 0.3%

    Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0.0.0 to 2.6.1.

  42. 5.4CVE-2026-81164EPSS 0.2%

    Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5.

  43. 5.3CVE-2026-84835EPSS 0.3%

    Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rentsyst: from n/a through 2.1.5.

  44. 5.3CVE-2026-84805EPSS 0.3%

    Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences endpoint. Although the web interface gates these employment-contract fields behi…

  45. 5.3CVE-2026-84802EPSS 0.3%

    Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume permissions. Authenticated control panel users can submit POST requests to the as…

  46. 8.7CVE-2026-84801EPSS 0.4%

    Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers permission to mint password reset URLs for administrator accounts. Attackers can gen…

  47. 7.1CVE-2026-84800EPSS 0.4%

    Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sourceAssetId and targetFilename but omits assetId, the target asset is resolved by…

  48. 7.1CVE-2026-84798EPSS 0.4%

    Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads an element with checkForProvisionalDraft enabled and runs the deletion authoriz…

  49. 5.3CVE-2026-84797EPSS 0.3%

    Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with createEntries permission to delete peer provisional drafts. Attackers can exploit…

  50. 7.1CVE-2026-84794EPSS 0.4%

    Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deleti…