cve.bz

CWE-862: Missing Authorization, page 55

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-14317EPSS 0.3%

    The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part from request input, which allows unauthenticated users to complete donations thro…

  2. 4.3CVE-2026-67529EPSS 0.4%

    OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workPackage.title and _links.workPackage.href through associated_resource in modules/…

  3. 7.6CVE-2026-67527EPSS 0.4%

    OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and allowed authenticated users with edit_work_packages but without manage_file_links to resolve…

  4. 7.2CVE-2026-15397EPSS 0.6%

    The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the plugin not properly verifying that a user is authorized to perform an action via …

  5. 5.4CVE-2026-15252EPSS 0.3%

    The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user such as a Subscriber to invoke the site's Google Indexing API integration, submi…

  6. 3.7CVE-2026-15054EPSS 0.2%

    The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated users to submit entries to, and fire the configured workflows (such as email not…

  7. 7.5CVE-2026-12500EPSS 0.4%

    The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin before 6.8.2 option, allowing unauthenticated users to overwrite a site-wide WP Tra…

  8. 6.5CVE-2026-11867EPSS 0.3%

    The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion operations, allowing authenticated users with low privileges (such as Subscribers)…

  9. 8.8CVE-2026-14356EPSS 0.5%

    The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possi…

  10. 4.3CVE-2026-4672EPSS 0.4%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with guest-role permissions to…

  11. 4.9CVE-2026-14341EPSS 0.5%

    GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain conditions could have allowed an authenticated user with Maintainer role to modify…

  12. 7.1CVE-2026-16543EPSS 0.2%

    Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. The embedded KIC collects CA-certificate Secr…

  13. 7.1CVE-2026-15228EPSS 0.2%

    Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of service. KIC collects CA-certificate Secrets across all watched namespaces usin…

  14. 5.3CVE-2026-66724EPSS 0.4%

    MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept the undocumented POST method, which bypasses the capability checks applied to t…

  15. 7.0CVE-2026-66723EPSS 0.8%

    MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentication for incoming requests, allowing an unauthenticated remote attacker to send…

  16. 5.3CVE-2026-4604EPSS 0.4%

    The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `kr_mr_store_settings()` function in all versions up to, and including, 1.1.0. This makes it p…

  17. 9.1CVE-2026-14488EPSS 0.5%

    The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in versions up to, and including, 3.8.0. This is due to the handle_request() function…

  18. 8.8CVE-2026-50622EPSS 0.6%

    Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, regardless of their assigned role, to perform administrative operations. Affect …

  19. 5.5CVE-2026-18201EPSS 0.4%

    Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization w…

  20. 5.3CVE-2026-13692EPSS 0.3%

    The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthenticated attackers to tamper with the totals, shipping and metadata of arbitrary W…

  21. 4.3CVE-2026-5626EPSS 0.3%

    The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_data() function in all versions up to, and including, 1.0.1. This makes it possible for authenticated …

  22. 4.3CVE-2026-17166EPSS 0.4%

    The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.3.7. This is due to the plugin not prope…

  23. 7.5CVE-2026-54719EPSS 0.4%

    goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file= ZIP downloads did not call findEffectiveACL or applyCustomAuth, allowing unauth…

  24. 9.8CVE-2026-16184EPSS 0.5%

    IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request.

  25. 8.8CVE-2026-49258EPSS 0.5%

    Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA scoping employed by the JSON API. This was partially addressed by GHSA-598g-h2vc-h…

  26. 5.3CVE-2026-66751EPSS 0.3%

    Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending a DELETE request to the rooms handler without ownership verification. Attackers…

  27. 5.3CVE-2026-66750EPSS 0.3%

    Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and password-protected rooms they are not a member of by exploiting missing room me…

  28. 5.3CVE-2026-16774EPSS 0.4%

    The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is due to the wpcs_send_email() function being registered on both wp_ajax_wpcs_sen…

  29. 5.3CVE-2026-15411EPSS 0.5%

    The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.0. This is due to the plugin …

  30. 7.5CVE-2026-15025EPSS 0.7%

    The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.3.2 via the automator_google_contacts_fetch_labels, automator…

  31. 5.3CVE-2026-13110EPSS 0.4%

    The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capability check on the bogo_category_msg_create() AJAX handler, which is registered …

  32. 8.8CVE-2026-14168EPSS 0.5%

    A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gaining full system access.

  33. 4.3CVE-2026-16587EPSS 0.4%

    The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.0. This is due to the plugin not properly verifying that a user is authorized t…

  34. 7.5CVE-2026-14924EPSS 0.4%

    The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unauthenticated users to create new published posts and to overwrite arbitrary existi…

  35. 2.7CVE-2026-14821EPSS 0.3%

    The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with contributor-level access and above to delete arbitrary templates.

  36. 5.3CVE-2026-12124EPSS 0.4%

    The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the serveTemplatePdfAjax() func…

  37. 7.5CVE-2026-66473EPSS 0.3%

    Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions.

  38. 6.5CVE-2026-65445EPSS 0.3%

    Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions.

  39. 9.8CVE-2026-64746EPSS 0.6%

    An authorization issue was addressed with improved validation. This issue is fixed in iOS 18.7.10 and iPadOS 18.7.10, iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6. An app may be able to add contacts without user …

  40. 5.5CVE-2026-43665EPSS 0.1%

    This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A local attacker may be able to determine the legacy VNC password configured for Screen Sharing.

  41. 5.4CVE-2026-65922EPSS 0.3%

    An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity …

  42. 5.3CVE-2026-66477EPSS 0.3%

    Unauthenticated Broken Access Control in Gillion <= 4.13 versions.

  43. 5.4CVE-2026-66442EPSS 0.3%

    Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.

  44. 5.0CVE-2026-65568EPSS 0.3%

    Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.

  45. 5.3CVE-2026-65567EPSS 0.3%

    Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.

  46. 6.5CVE-2026-65435EPSS 0.3%

    Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.

  47. 6.5CVE-2026-65433EPSS 0.3%

    Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor &amp; Gutenberg <= 1.5.1 versions.

  48. 6.5CVE-2026-59560EPSS 0.4%

    Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.

  49. 6.5CVE-2026-59557EPSS 0.3%

    Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.

  50. 7.5CVE-2026-59536EPSS 0.3%

    Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions.