cve.bz

CWE-862: Missing Authorization, page 52

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-19350EPSS 0.3%

    A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performe…

  2. 5.5CVE-2026-19345EPSS 0.5%

    A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of the argument task_id/val results in missing authorization. It is possible to la…

  3. 6.5CVE-2026-18603EPSS 0.3%

    The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the contents of a previous order to the cart, allowing unauthenticated users to disclose t…

  4. 6.5CVE-2026-18037EPSS 0.3%

    The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauth…

  5. 6.5CVE-2026-16992EPSS 0.3%

    The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route additionally publishes the requested content as a side effect, allowing unauthenticat…

  6. 4.3CVE-2026-16965EPSS 0.1%

    The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as a subscriber (and, via CSRF, any logged-in user) to update post meta on arbitrar…

  7. 5.3CVE-2026-16608EPSS 0.3%

    The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject…

  8. 6.5CVE-2026-47127EPSS 0.3%

    Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at `GET /api/v1/subscription/stripe/callback?checkoutSessionId=<id>` retrieves the Stripe Checkout Session by…

  9. 5.7CVE-2026-64676EPSS 0.2%

    Kata Containers is an open source implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 4.0.0, the kata-agent is vulnerable to an authorization bypass in confidential-guest memory managemen…

  10. 8.8CVE-2026-48169EPSS 0.4%

    PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace isolation. The service layer for issues and projects performs global primary-key l…

  11. 7.1CVE-2026-66061EPSS 0.2%

    Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism such as iOS universal links…

  12. 7.1CVE-2026-66060EPSS 0.2%

    Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links (NFC or QR) delivered through an OS-level routing mechanism as if they were physically sca…

  13. 6.8CVE-2026-19017EPSS 0.5%

    Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect CA provider with JWT or AppRole authentication. A privileged attacker with `opera…

  14. 5.3CVE-2026-66058EPSS 0.4%

    Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for an authenticated user. This issue is fixed in versions 16.20.0 and 15.112.0.

  15. 8.9CVE-2026-17601EPSS 0.5%

    A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions than they were authorized to hold, including full administrative access, without …

  16. 6.9CVE-2026-54201EPSS 0.6%

    Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obtain sensitive error information or internal application details, potentially a…

  17. 7.5CVE-2026-16041EPSS 0.4%

    The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing an unauthenticated attacker to create WooCommerce product reviews with an attack…

  18. 9.1CVE-2026-16038EPSS 0.4%

    The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-completion endpoints, allowing an unauthenticated attacker to mark an arbitrary o…

  19. 6.5CVE-2026-15359EPSS 0.3%

    The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwrite the administrator's stored cloud service connection with an account under th…

  20. 9.8CVE-2026-14365EPSS 0.6%

    The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.3. This is due to the plugin not properly verifying that a user is authorized to…

  21. 6.5CVE-2026-11907EPSS 0.4%

    The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for …

  22. 10.0CVE-2026-65667EPSS 0.8%

    Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.

  23. 9.9CVE-2026-62830EPSS 0.8%

    Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.

  24. 8.7CVE-2026-70636EPSS 0.7%

    Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by exploiting prefix-based whitelist matching in the authentication middleware def…

  25. 7.2CVE-2026-67621EPSS 0.4%

    Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operations by accessing unprotected mutation endpoints. Attackers holding only view-lev…

  26. 4.3CVE-2026-64664EPSS 0.3%

    Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint intended for the user creation wizard to determine if a given email address belong…

  27. 6.5CVE-2026-64662EPSS 0.4%

    Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from entries they did not have permission to view, including entry content and custom…

  28. 9.4CVE-2026-48088EPSS 0.4%

    OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route `POST /api/tenants/{tenantId}/staff/{staffId}/crypto` accepts and stores attacker-controlled ML-K…

  29. 9.8CVE-2026-48085EPSS 0.6%

    OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenReception instance accepts unauthenticated POST requests to `/setup/create-admin-ac…

  30. 5.3CVE-2026-48077EPSS 0.4%

    OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at `/api/tenants/{id}/appointments/{appointmentId}` performs no authorization check before …

  31. 6.5CVE-2026-48075EPSS 0.4%

    OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the `add-to-tunnel` endpoint creates a new appointment row in any client tunnel without any caller authenti…

  32. 7.1CVE-2026-47765EPSS 0.4%

    Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document permission checks, allowing an authenticated user to restore deleted documents wi…

  33. 6.0CVE-2026-45415EPSS 0.4%

    Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csv_census/census_logs record-management endpoints do not enforce full administrator authorization …

  34. 7.5CVE-2026-13399EPSS 0.4%

    The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticated users to bypass payments

  35. 7.1CVE-2026-18277EPSS 0.4%

    Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselves access to another user's private OCR model and to revoke any user's OCR model…

  36. 4.3CVE-2026-18276EPSS 0.4%

    Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event stream and observe another user's segmentation, transcription, import, export a…

  37. 7.5CVE-2026-66712EPSS 0.3%

    Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions.

  38. 8.2CVE-2026-66708EPSS 0.4%

    Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions.

  39. 5.3CVE-2026-66701EPSS 0.3%

    Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions.

  40. 5.3CVE-2026-66699EPSS 0.3%

    Custom role Broken Access Control in Dokan <= 5.0.10 versions.

  41. 4.3CVE-2026-66678EPSS 0.3%

    Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions.

  42. 7.1CVE-2026-66470EPSS 0.3%

    Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions.

  43. 6.5CVE-2026-66452EPSS 0.3%

    Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions.

  44. 7.1CVE-2026-65554EPSS 0.3%

    Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions.

  45. 7.3CVE-2026-65541EPSS 0.3%

    Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions.

  46. 7.5CVE-2026-65504EPSS 0.4%

    Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions.

  47. 5.3CVE-2026-32548EPSS 0.3%

    Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions.

  48. 7.5CVE-2026-28140EPSS 0.3%

    Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions.

  49. 9.8CVE-2026-28005EPSS 0.5%

    Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions.

  50. 6.5CVE-2026-25403EPSS 0.3%

    Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions.