cve.bz

CWE-862: Missing Authorization, page 43

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.6CVE-2026-56100EPSS 0.5%

    SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system administrator accounts by sending crafted POST requests to an unprotected inter…

  2. 4.3CVE-2026-55547EPSS 0.3%

    Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java.…

  3. 6.5CVE-2026-55545EPSS 0.5%

    Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic w…

  4. 8.8CVE-2026-55521EPSS 0.5%

    Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Cop1Api.disable, Cop1Api.resume, Cop1Api.initialize, Cop1Api.updateConfig, and Tim…

  5. 4.3CVE-2026-55064EPSS 0.4%

    Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to 0…

  6. 6.4CVE-2026-54746EPSS 0.4%

    Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the b…

  7. 7.5CVE-2026-81767EPSS 0.3%

    Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.

  8. 4.3CVE-2026-81761EPSS 0.3%

    Subscriber Broken Access Control in WpEvently <= 5.5.0 versions.

  9. 5.4CVE-2026-81759EPSS 0.3%

    Contributor Broken Access Control in WpEvently <= 5.5.0 versions.

  10. 4.3CVE-2026-81284EPSS 0.3%

    Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.

  11. 7.2CVE-2026-82245EPSS 0.4%

    Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or manipulate offline tokens. Attackers with basic user privileges can access /api/glo…

  12. 8.3CVE-2026-82242EPSS 0.4%

    Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders to inject tables, automations, queries, and screens into any other application w…

  13. 8.6CVE-2026-82240EPSS 0.4%

    Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scoped builder to grant builder access to unrelated apps. Attackers can submit craft…

  14. 8.6CVE-2026-82239EPSS 0.3%

    Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, create, update, or delete rows in any table regardless of configured permissions. …

  15. 5.3CVE-2026-77701EPSS 0.3%

    The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site.

  16. 5.3CVE-2026-12514EPSS 0.3%

    The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce t…

  17. 8.7CVE-2026-75813EPSS 0.4%

    Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality.

  18. 8.8CVE-2026-75339EPSS 0.4%

    The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous attacker can download them.

  19. 9.3CVE-2026-68929EPSS 0.4%

    FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat (iLink) share-channel endpoints authorize requests using only the public shareId, with no authenticated identi…

  20. 8.7CVE-2026-18965EPSS 0.4%

    PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly accessible, with or without an account.

  21. 5.1CVE-2026-65931EPSS 0.4%

    LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /…

  22. 5.3CVE-2026-81819EPSS 0.5%

    Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying the user whose assignments should be returned, but previously had no role restri…

  23. 8.7CVE-2026-81335EPSS 0.6%

    Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/baserow/contrib/builder/api/data_sources/views.py are declared with a permission …

  24. 5.4CVE-2026-81279EPSS 0.2%

    Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions.

  25. 5.3CVE-2026-81276EPSS 0.3%

    Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions.

  26. 5.3CVE-2026-81274EPSS 0.3%

    Subscriber Broken Access Control in Ditty <= 3.1.67 versions.

  27. 4.9CVE-2026-81272EPSS 0.3%

    Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions.

  28. 7.5CVE-2026-80433EPSS 0.4%

    Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.

  29. 8.6CVE-2026-27330EPSS 0.4%

    Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions.

  30. 7.5CVE-2026-78137EPSS 0.4%

    The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price…

  31. 4.8CVE-2026-13414EPSS 0.2%

    The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (and exposed to anonymous visitors on others), allowing unauthenticated attackers t…

  32. 5.3CVE-2026-77507EPSS 0.4%

    Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do not apply the permission checks used elsewhere, allowing unauthorized users to …

  33. 7.2CVE-2026-81035EPSS 0.3%

    Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, which returns true for every row in the team-membership table irrespective of the…

  34. 8.4CVE-2026-81027EPSS 0.3%

    one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix on the API key or through a URL path parameter. The suffix path is reached only a…

  35. 9.8CVE-2026-54569EPSS 1.2%

    SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthenticated remote code execution through a two-request chain involving missing authori…

  36. 9.6CVE-2026-54523EPSS 0.5%

    Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes the generator library to matchConditions, allowing a namespace-scoped policy to in…

  37. 8.7CVE-2026-80348EPSS 0.6%

    TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController.js make no such call. uploadAndPublish accepts a package upload and then builds …

  38. 7.1CVE-2026-80346EPSS 0.5%

    StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor calls into Authorizer before execution, but visitDropMaterializedViewStatement re…

  39. 6.3CVE-2026-19197EPSS 0.2%

    A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recover a snapshot's secret delete key using only its public share key (broken access …

  40. 9.8CVE-2026-18431EPSS 0.9%

    The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and active in versions up to, and including, 3.16. This is due to a chain of authori…

  41. 5.3CVE-2026-77694EPSS 0.3%

    The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unauthenticated users to mark their own unpaid order as completed and be issued a val…

  42. 5.3CVE-2026-75798EPSS 0.3%

    The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it hands out to anonymous visitors, allowing unauthenticated attackers to run AI qu…

  43. 7.5CVE-2026-74928EPSS 0.4%

    The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own…

  44. 5.3CVE-2026-14550EPSS 0.3%

    The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly available nonce, allowing unauthenticated users to submit reservations with an a…

  45. 5.3CVE-2026-13406EPSS 0.3%

    The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbitrary, caller-supplied taxonomy, allowing unauthenticated users to disclose the …

  46. 5.3CVE-2026-13172EPSS 0.3%

    The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowing unauthenticated users to retrieve draft, pending and private posts belonging t…

  47. 8.7CVE-2026-80193EPSS 0.5%

    Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with view_other_timesheet and edit_other_timesheet permissions can create timesheet reco…

  48. 8.7CVE-2026-80191EPSS 0.5%

    GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in apps/app/src/server/routes/attachment/get.ts guards the check with a condition requ…

  49. 9.1CVE-2026-16645EPSS 0.4%

    Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe - Responsive JavaScript Modal Image Gallery versions: from 0.0.0 to 3.2.0.

  50. 4.2CVE-2026-15916EPSS 0.2%

    Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0 to 11.3.14, from 11.4.0 to 11.4.4, from 0.0.0 to 11.0.*, from 0.0.0 to 11.1.*, …