CWE-862: Missing Authorization, page 50
Filter
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
What the weakness is: CWE-862 at MITRE
Related attack patterns (CAPEC): 1
- CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High
The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.
Ask an AI about CWE-862
Show the prompt
Explain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.
- 6.9CVE-2026-72799EPSS 0.3%
SiYuan before v3.7.4 (affected <=v3.7.2) fails to enforce publish-access filters on five filetree path-resolution endpoints (getFullHPathByID, getHPathByID, getPathByID, getIDsByHPath, and getHPathByPath). In publish mode, when Publish.Aut…
- 9.2CVE-2026-72798EPSS 0.4%
SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can reques…
- 6.9CVE-2026-72797EPSS 0.3%
SiYuan versions before v3.7.4 contain an information disclosure vulnerability in the getEncryptedNotebookStatus endpoint that returns encrypted notebook identifiers, names, and lock states without publish-access filtering. Anonymous reader…
- 6.9CVE-2026-72796EPSS 0.4%
SiYuan before v3.7.4 contains an access control bypass vulnerability where static-file routes in the server mux bypass publish-access controls enforced on the REST API. Attackers with publish reader tokens or anonymous access in disabled-a…
- 9.2CVE-2026-72795EPSS 0.3%
SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from pas…
- 6.9CVE-2026-72791EPSS 0.3%
SiYuan v3.7.4-alpha.1 (a pre-release; the endpoint does not exist in stable v3.7.3 or earlier) contains an information disclosure vulnerability in the /api/av/getAttributeViewFieldViews endpoint. The route is registered with CheckAuth only…
- 6.9CVE-2026-72790EPSS 0.3%
SiYuan before v3.7.4 contains an information disclosure vulnerability in the /api/notebook/getNotebookInfo endpoint that returns notebook metadata without authorization checks. Attackers can read notebook names, document counts, sizes, and…
- 9.2CVE-2026-72789EPSS 0.4%
SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted …
- 4.3CVE-2026-6821EPSS 0.4%
GitLab has remediated an issue in GitLab EE affecting all versions from 12.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to bypass IP-based access restric…
- 9.9CVE-2026-63300EPSS 0.5%
An improper validation vulnerability in the instancePostMigration function in lxd/instance_post.go of LXD allows an authenticated attacker with can_create_instances permissions on a restricted project to bypass project-level security restr…
- 4.3CVE-2026-4879EPSS 0.3%
GitLab has remediated an issue in GitLab EE affecting all versions from 16.0 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer-role permissions t…
- 9.9CVE-2026-19656EPSS 0.5%
ScadaLTS 2.7.8.1 exposes a server-side method that lacks authorization checks, allowing any authenticated user (including one holding only low-privilege, read-only permissions) to execute arbitrary operating system commands on the host. Su…
- 7.1CVE-2026-16494EPSS 0.4%
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privil…
- 4.3CVE-2026-73301EPSS 0.3%
Budibase is an open-source low-code platform. Prior to 3.39.25, the GET /api/global/groups endpoint in packages/worker/src/api/routes/global/groups.ts omitted auth.builderOrAdmin, allowing an authenticated BASIC role user to enumerate tena…
- 4.3CVE-2026-18244EPSS 0.3%
GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration …
- 9.4CVE-2026-73296EPSS 3.7%
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.8, create_mobile_data_collection_server and create_mobile_action_server in ufo/client/mcp/http_servers/mobile_mcp_server.py exposed S…
- 4.3CVE-2026-70547EPSS 0.3%
An authenticated user without repository read permission may access package metadata under specific conditions.
- 5.9CVE-2026-69107EPSS 0.4%
An unauthenticated user may access restricted artifacts in JFrog Artifactory under specific conditions.
- 6.5CVE-2026-68971EPSS 0.3%
Apache Airflow's asset materialization endpoint (`POST /api/v2/assets/{asset_id}/materialize`) and the XCom result check on `wait_dag_run_until_finished` authorized the target Dag without its team, unlike every other authorization site. A …
- 6.5CVE-2026-68758EPSS 0.4%
A low-privileged authenticated user may access restricted support information under specific conditions.
- 4.3CVE-2026-65938EPSS 0.3%
In WhatsUp Gold versions released before 2026.0.2, an improper authorization vulnerability in the Scheduled Reports API allows any authenticated user to invoke restricted actions.
- 3.1CVE-2026-65926EPSS 0.2%
An anonymous caller when anonymous access is enabled, or a low-privilege authenticated user, may learn private Release Bundle names and versions when the bundle name is known.
- 5.3CVE-2026-73405EPSS 0.5%
An authorization bypass vulnerability in Vulnerability-Lookup allowed inactive or unconfirmed accounts to subscribe to Server-Sent Events (SSE) streams through the /pubsub/subscribe/<topic> endpoint. The token_required decorator used by …
- 5.4CVE-2026-73287EPSS 0.4%
RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-beta.12, RustFS handles FTPS MKD in FtpsDriver::mkd in crates/protocols/src/ftps/driver.rs by calling storage.create_bucket without authorize_operation for S3Actio…
- 6.5CVE-2026-73265EPSS 0.4%
RustFS is a distributed object storage system built in Rust. RustFS authorizes explicit versionId reads in GetObject, CopyObject sources, and UploadPartCopy sources with s3:GetObject instead of s3:GetObjectVersion, allowing principals with…
- 6.5CVE-2026-68754EPSS 0.3%
A repository publisher without delete permission may modify protected package content under specific conditions.
- 5.3CVE-2026-68753EPSS 0.3%
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
- 4.3CVE-2026-66380EPSS 0.3%
An authenticated user without repository read permission may access private OCI referrer metadata under specific conditions.
- 4.3CVE-2026-66379EPSS 0.3%
An authenticated user may view private Puppet module metadata without repository read access.
- 4.3CVE-2026-66378EPSS 0.3%
An authenticated user without repository read permission may access private NuGet metadata under specific conditions.
- 5.3CVE-2026-66377EPSS 0.4%
An unauthenticated user may access restricted repository information under specific conditions.
- 8.1CVE-2026-66375EPSS 0.4%
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
- 6.5CVE-2026-47233EPSS 0.3%
Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/inventory.php`. The same fix was not applied to the sibling `case 'field_delete':` han…
- 7.3CVE-2026-53996EPSS 0.1%
NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIO_FGRP_SETCONFIG ioctl without elevated permissions by exploiting the abse…
- 6.5CVE-2026-47226EPSS 0.3%
Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanently delete files from folders where they have only view access. The authorization…
- 6.5CVE-2026-18652EPSS 0.3%
Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing…
- 4.3CVE-2026-19052EPSS 0.3%
The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is published on its public frontend, allowing any authenticated user, such as a subsc…
- 7.5CVE-2026-18789EPSS 0.4%
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hash…
- 5.3CVE-2026-18035EPSS 0.3%
The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to s…
- 8.2CVE-2026-64954EPSS 0.3%
Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets …
- 7.5CVE-2026-73249EPSS 0.4%
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.chec…
- 8.2CVE-2026-48763EPSS 0.5%
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url` that accepts an attacker-controlled `filePath` and returns a p…
- 8.8CVE-2026-15606EPSS 0.6%
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This…
- 7.1CVE-2026-69115EPSS 0.3%
OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitting POST requests with a regular user bearer token to /user/get_users, /user/get…
- 5.9CVE-2026-18709EPSS 0.2%
An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transaction, bypassing the intended transaction coordination process. This could resul…
- 7.1CVE-2026-18704EPSS 0.3%
An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections they should not be able to modify. This is due to an internal-use aggregation st…
- 5.3CVE-2026-69113EPSS 0.3%
Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any private video without permission by supplying an arbitrary videoId in the request bod…
- 8.8CVE-2026-70340EPSS 0.8%
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
- 6.5CVE-2026-65806EPSS 0.8%
Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network.
- 6.5CVE-2026-65675EPSS 0.6%
No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network.