cve.bz

CWE-862: Missing Authorization, page 56

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.3CVE-2026-59535EPSS 0.3%

    Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions.

  2. 7.5CVE-2026-59534EPSS 0.3%

    Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions.

  3. 7.5CVE-2026-59530EPSS 0.3%

    Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions.

  4. 7.5CVE-2026-59529EPSS 0.4%

    Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions.

  5. 8.0CVE-2026-59690EPSS 0.3%

    A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged adminis…

  6. 5.3CVE-2026-13390EPSS 0.3%

    The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attacke…

  7. 10.0CVE-2026-66012EPSS 0.8%

    SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement. This exposes 31 MCP tools, inc…

  8. 7.1CVE-2026-64298EPSS 0.1%

    In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized f…

  9. 8.7CVE-2026-66027EPSS 0.5%

    Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account i…

  10. 6.5CVE-2026-49326EPSS 0.5%

    Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open step will return an id which will be passed…

  11. 5.0CVE-2026-16799EPSS 0.3%

    Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properti…

  12. 7.3CVE-2026-10033EPSS 0.3%

    The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it…

  13. 5.3CVE-2026-12654EPSS 0.6%

    The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an act…

  14. 3.8CVE-2026-12690EPSS 0.3%

    The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level acces…

  15. 5.4CVE-2026-12689EPSS 0.2%

    The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tampe…

  16. 5.3CVE-2026-11354EPSS 0.4%

    The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrar…

  17. 9.8CVE-2026-58275EPSS 0.9%

    Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.

  18. 9.9CVE-2026-47724EPSS 0.5%

    nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits t…

  19. 6.5CVE-2026-47755EPSS 0.4%

    ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another c…

  20. 7.2CVE-2026-65916EPSS 0.5%

    CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send c…

  21. 8.2CVE-2026-65895EPSS 0.3%

    Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can di…

  22. 4.3CVE-2026-65537EPSS 0.3%

    Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.

  23. 4.8CVE-2026-65531EPSS 0.2%

    Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.

  24. 4.3CVE-2026-65530EPSS 0.3%

    Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.

  25. 5.3CVE-2026-65529EPSS 0.3%

    Missing Authorization vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Graphina – Cha…

  26. 5.3CVE-2026-65525EPSS 0.3%

    Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.

  27. 4.3CVE-2026-65524EPSS 0.3%

    Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.

  28. 5.3CVE-2026-65506EPSS 0.3%

    Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.

  29. 7.5CVE-2026-65500EPSS 0.4%

    Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.

  30. 6.5CVE-2026-65499EPSS 0.3%

    Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.

  31. 7.5CVE-2026-65495EPSS 0.4%

    Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.

  32. 4.3CVE-2026-65491EPSS 0.3%

    Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.

  33. 5.3CVE-2026-65489EPSS 0.3%

    Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from …

  34. 5.3CVE-2026-65487EPSS 0.3%

    Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.

  35. 5.3CVE-2026-65486EPSS 0.3%

    Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.

  36. 5.3CVE-2026-65485EPSS 0.3%

    Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.

  37. 6.3CVE-2026-65484EPSS 0.3%

    Contributor Broken Access Control in Style Kits <= 2.6.5 versions.

  38. 5.4CVE-2026-65479EPSS 0.3%

    Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.

  39. 5.4CVE-2026-65478EPSS 0.2%

    Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.

  40. 5.3CVE-2026-65476EPSS 0.3%

    Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.

  41. 5.3CVE-2026-65472EPSS 0.3%

    Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.

  42. 5.3CVE-2026-65469EPSS 0.3%

    Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.

  43. 5.3CVE-2026-65468EPSS 0.3%

    Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.

  44. 4.3CVE-2026-65457EPSS 0.3%

    Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.

  45. 5.3CVE-2026-65453EPSS 0.3%

    Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

  46. 5.3CVE-2026-65452EPSS 0.3%

    Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

  47. 8.6CVE-2026-64814EPSS 0.4%

    In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session

  48. 4.3CVE-2026-61973EPSS 0.3%

    Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

  49. 5.3CVE-2026-61972EPSS 0.3%

    Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

  50. 7.5CVE-2026-61954EPSS 0.3%

    Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions.