cve.bz

CWE-862: Missing Authorization, page 45

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2026-19801EPSS 0.4%

    The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.0. This is due to the plugin not properly verifyi…

  2. 6.5CVE-2026-78266EPSS 0.3%

    Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions.

  3. 6.5CVE-2026-27364EPSS 0.3%

    Subscriber Broken Access Control in Style Kits <= 2.6.5 versions.

  4. 7.1CVE-2026-71509EPSS 0.4%

    Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with expense-creation rights to bypass the approval workflow by directly setting app…

  5. 7.1CVE-2026-71508EPSS 0.4%

    Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to modify payroll fields by exploiting an incomplete credential denylist that omits p…

  6. 8.6CVE-2026-71504EPSS 0.5%

    Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset the password of any user account, including the system administrator, without v…

  7. 8.8CVE-2026-71933EPSS 0.6%

    Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authorization checks. A remote attacker can trigger these vulnerabilities via crafted r…

  8. 9.4CVE-2026-78387EPSS 0.6%

    RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authenticated session but does not perform an explicit privilege or administrator auth…

  9. 7.1CVE-2026-39914EPSS 0.4%

    TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dashboard Excel export endpoint intended for administrative use only. Attackers can …

  10. 8.7CVE-2026-78380EPSS 0.4%

    RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channels. The post-processing logic checks whether an individual post is marked private…

  11. 9.2CVE-2026-78372EPSS 0.7%

    RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or otherwise unauthorized remote attacker can access information associated with privat…

  12. 9.2CVE-2026-78370EPSS 0.7%

    RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information intended to remain private. The /export/<database> endpoint permits selected interna…

  13. 8.7CVE-2026-76847EPSS 0.4%

    act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that backend, including CreateArtifact, GetSignedArtifactURL, ListArtifacts, FinalizeArt…

  14. 9.3CVE-2026-78365EPSS 0.5%

    Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and modify another company's supplier record, and to reassign it to their own compan…

  15. 5.3CVE-2026-78291EPSS 0.3%

    Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions.

  16. 5.4CVE-2026-78272EPSS 0.2%

    Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions.

  17. 5.3CVE-2026-78258EPSS 0.3%

    Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions.

  18. 7.1CVE-2026-28190EPSS 0.3%

    Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions.

  19. 7.5CVE-2026-28153EPSS 0.4%

    Unauthenticated Broken Access Control in Notification Master &#8211; Real-Time WordPress Notifications With Email, SMS, Webhooks &amp; More <= 1.7.1 versions.

  20. 8.9CVE-2026-19200EPSS 0.3%

    The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function, the global artifact repository is used which allows callers to overwrite existin…

  21. 5.3CVE-2026-78204EPSS 0.3%

    Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only request.user.is_active unless a view overrides it, and neither the endpoint that li…

  22. 4.3CVE-2026-14853EPSS 0.3%

    The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by omitting the token, allowing users with Subscriber-level access and above to crea…

  23. 9.1CVE-2026-75866EPSS 0.5%

    Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path reads them. Punk::OAuth2::Server::Store registers scopes and grant_types per client…

  24. 4.3CVE-2026-5093EPSS 0.4%

    The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12.8.9. This is due to a missing capability check on the 'gspb_update_global_wp_se…

  25. 4.3CVE-2026-4244EPSS 0.3%

    The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `duplicate_post()` function in all versions up to, and including, 3.0.11. This is due to the function not …

  26. 9.3CVE-2026-12710EPSS 0.4%

    A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration (versions from 2025-04-28 to 2026-04-04) allows an external attacker to access sensitive internal data. The issue was patched on April…

  27. 4.3CVE-2026-76074EPSS 0.4%

    The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not p…

  28. 4.3CVE-2026-76057EPSS 0.4%

    The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.8.4. This is due to the plugin not p…

  29. 5.3CVE-2026-75027EPSS 0.6%

    The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it poss…

  30. 4.3CVE-2026-53487EPSS 0.3%

    Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles do not permit by selecting that cluster with `x-cluster-name`. The overview route…

  31. 6.5CVE-2026-34836EPSS 0.4%

    Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document access without checking on user permissions. This issue has been fixed in version …

  32. 4.3CVE-2026-33047EPSS 0.4%

    Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has been fixed in version 3.2.3.

  33. 8.8CVE-2026-31936EPSS 0.5%

    Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This issue has been fixed in version 3.2.3.

  34. 9.9CVE-2026-62283EPSS 0.6%

    Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9 do not bind stream identifiers created by CreateStream in service/rpc/io_stream.…

  35. 8.2CVE-2026-76876EPSS 0.4%

    Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unconditional authorization policy on the Settings resource. Attackers can send a GE…

  36. 9.2CVE-2026-75932EPSS 0.6%

    Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traffic to the attacker-controlled app. Once connected to the target domain, the att…

  37. 9.4CVE-2026-77087EPSS 0.5%

    Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An attacker can craft a malicious webpage that, when visited by a developer running Pa…

  38. 9.9CVE-2026-62940EPSS 0.4%

    Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configuration overrides (including security-critical keys like `security.privileged` and `…

  39. 9.9CVE-2026-48751EPSS 0.6%

    Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting; allowing for arbitrary command execution on the Incus server by abusing lowlevel…

  40. 8.7CVE-2026-77767EPSS 0.5%

    Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview a…

  41. 2.7CVE-2026-66721EPSS 0.5%

    Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listHostTags API, but the API returns host tags for every host in the environment wit…

  42. 7.5CVE-2026-50222EPSS 0.5%

    Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTe…

  43. 5.3CVE-2026-16962EPSS 0.3%

    The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs, changing a WooCommerce order's status based solely on an attacker-supplied numer…

  44. 2.1CVE-2026-77391EPSS 0.2%

    A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipulation results in cross-site request forgery. The attack can be launched remotely…

  45. 9.3CVE-2026-72843EPSS 0.8%

    The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes the admin authentication middleware to call next() without checking the caller,…

  46. 6.5CVE-2026-54509EPSS 0.4%

    TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result of getJourneyShareLink() from server/src/services/journeyShareService.ts without …

  47. 6.9CVE-2026-19755EPSS 0.1%

    NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values.This issue affects NoSleep: 1.5.1.

  48. 6.5CVE-2026-63003EPSS 0.4%

    django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-level authorization check on the source page. In cms/admin/forms.py, DuplicatePage…

  49. 4.3CVE-2026-61663EPSS 0.3%

    django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to authorize non-PageContent objects that use PlaceholderRelationField. An active sta…

  50. 6.5CVE-2026-54624EPSS 0.4%

    django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/views.py renders cms/toolbar/structure.html for a PageContent object without calling…