cve.bz

CWE-862: Missing Authorization, page 49

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.1CVE-2026-59714EPSS 0.5%

    Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM chan…

  2. 9.4CVE-2026-73653EPSS 0.8%

    Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept …

  3. 7.5CVE-2026-58438EPSS 0.5%

    Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access

  4. 7.5CVE-2026-58434EPSS 0.5%

    Private Repository Metadata Remains Accessible After Access Revocation

  5. 9.1CVE-2026-58433EPSS 0.5%

    Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting

  6. 5.9CVE-2026-58432EPSS 0.4%

    Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea

  7. 5.9CVE-2026-57886EPSS 0.3%

    Cross-repository issue/comment attachment re-linking can expose private attachment content

  8. 4.3CVE-2026-50105EPSS 0.4%

    RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)

  9. 5.3CVE-2026-73403EPSS 0.3%

    Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.

  10. 5.3CVE-2026-73401EPSS 0.3%

    Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.

  11. 5.3CVE-2026-73353EPSS 0.3%

    Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.

  12. 5.3CVE-2026-73349EPSS 0.3%

    Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.

  13. 6.5CVE-2026-66693EPSS 0.3%

    Subscriber Broken Access Control in Motors <= 1.4.113 versions.

  14. 6.3CVE-2026-66689EPSS 0.3%

    Unauthenticated Broken Access Control in Anti Spam and list cleaner &#8211; AcyChecker <= 2.0.0 versions.

  15. 6.5CVE-2026-66660EPSS 0.3%

    Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.

  16. 7.5CVE-2026-66469EPSS 0.3%

    Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.

  17. 7.5CVE-2026-66466EPSS 0.3%

    Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.

  18. 6.5CVE-2026-66464EPSS 0.3%

    Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.

  19. 7.5CVE-2026-66461EPSS 0.3%

    Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.

  20. 6.5CVE-2026-66459EPSS 0.3%

    Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.

  21. 6.0CVE-2026-66455EPSS 0.2%

    Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.

  22. 6.5CVE-2026-66454EPSS 0.3%

    Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.

  23. 7.5CVE-2026-66441EPSS 0.4%

    Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.

  24. 7.5CVE-2026-66431EPSS 0.3%

    Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.

  25. 7.5CVE-2026-61984EPSS 0.4%

    Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.

  26. 6.5CVE-2026-61978EPSS 0.3%

    Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.

  27. 7.3CVE-2026-28188EPSS 0.3%

    Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.

  28. 8.1CVE-2026-28186EPSS 0.4%

    Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.

  29. 6.5CVE-2026-28181EPSS 0.3%

    Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.

  30. 7.1CVE-2026-28173EPSS 0.3%

    Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.

  31. 6.5CVE-2026-28159EPSS 0.4%

    Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.

  32. 6.5CVE-2026-27999EPSS 0.3%

    Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.

  33. 7.1CVE-2026-27535EPSS 0.3%

    Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.

  34. 7.5CVE-2026-27345EPSS 0.3%

    Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.

  35. 7.2CVE-2026-6471EPSS 0.5%

    Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in tu…

  36. 4.3CVE-2026-6470EPSS 0.3%

    Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a…

  37. 6.9CVE-2026-73609EPSS 0.3%

    SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getBookmarkLabels endpoint that returns all bookmark labels in the workspace without publish-access filtering. Anonymous readers and publish-mode readers …

  38. 9.2CVE-2026-73608EPSS 0.3%

    SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4-alpha.3) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The rout…

  39. 6.9CVE-2026-73607EPSS 0.3%

    SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the /api/storage/getOutlineStorage endpoint that performs no authorization checks. Attackers can retrieve outline state including heading identifiers for any …

  40. 6.9CVE-2026-73605EPSS 0.3%

    SiYuan versions before v3.7.4 contain a path traversal vulnerability in the getUniqueFilename endpoint that allows anonymous readers to probe filesystem existence without validation or confinement. Attackers can supply arbitrary absolute p…

  41. 6.3CVE-2026-73603EPSS 0.3%

    Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio …

  42. 5.4CVE-2026-14332EPSS 0.3%

    The Ecwid by Lightspeed Ecommerce Shopping Cart WordPress plugin before 7.0.9 does not perform a capability check or nonce verification on one of its store-management actions, allowing any authenticated user, such as a subscriber, to disco…

  43. 9.8CVE-2026-49819EPSS 1.1%

    UpSnap is a wake on lan web app. Versions 4.4.1 through 5.3.5 are vulnerable to a missing-authentication / privilege-escalation chain in `pb.HandlerInitSuperuser` (`backend/pb/handlers.go:249`), reachable as `POST /api/upsnap/init-superuse…

  44. 5.5CVE-2026-47718EPSS 0.5%

    FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issu…

  45. 7.2CVE-2026-73326EPSS 0.4%

    CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level auth…

  46. 6.9CVE-2026-72808EPSS 0.4%

    SiYuan versions up to and including v3.7.2 (fixed in v3.7.4) contain an information disclosure vulnerability in the /api/asset/getFileAnnotation endpoint, which returns .sya PDF-annotation file content without a publish-access check. Becau…

  47. 6.9CVE-2026-72806EPSS 0.4%

    SiYuan versions before v3.7.4 contain an authentication bypass vulnerability in the FilterViewByPublishAccess filter that fails to check publish password protection when rendering attribute views and database rows. Unauthenticated readers …

  48. 6.9CVE-2026-72805EPSS 0.3%

    SiYuan versions before v3.7.4 fail to enforce publish-access checks on getBlockBreadcrumb, getRefText, and getBlockTreeInfos endpoints, allowing disclosure of protected document content and metadata. Anonymous readers or publish RoleReader…

  49. 6.9CVE-2026-72803EPSS 0.3%

    SiYuan versions before v3.7.4 fail to enforce publish-access checks in the getBlockAttrs and batchGetBlockAttrs endpoints. Attackers can retrieve block attributes including names, aliases, memos, and custom fields from protected documents …

  50. 6.9CVE-2026-72800EPSS 0.3%

    SiYuan versions before v3.7.4 fail to apply publish-access filtering to the getAttributeViewKeysByID endpoint, allowing authenticated readers to retrieve complete database column schemas including descriptions, select vocabularies, and tem…