cve.bz

CWE-862: Missing Authorization, page 57

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.5CVE-2026-61943EPSS 0.4%

    Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions.

  2. 7.5CVE-2026-59547EPSS 0.3%

    Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions.

  3. 6.5CVE-2026-59522EPSS 0.3%

    Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.

  4. 6.5CVE-2026-57808EPSS 0.3%

    Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions.

  5. 6.5CVE-2026-57717EPSS 0.3%

    Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.

  6. 6.3CVE-2026-57703EPSS 0.3%

    Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.

  7. 6.5CVE-2026-57425EPSS 0.3%

    Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.

  8. 7.1CVE-2026-57367EPSS 0.3%

    Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions.

  9. 4.3CVE-2026-27423EPSS 0.3%

    Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.

  10. 5.3CVE-2026-27422EPSS 0.3%

    Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2.

  11. 5.3CVE-2026-27418EPSS 0.3%

    Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.

  12. 5.3CVE-2026-27399EPSS 0.3%

    Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.

  13. 4.3CVE-2026-27392EPSS 0.3%

    Contributor Broken Access Control in uListing <= 2.2.0 versions.

  14. 5.4CVE-2026-27391EPSS 0.3%

    Subscriber Broken Access Control in uListing <= 2.2.0 versions.

  15. 6.7CVE-2026-27377EPSS 0.4%

    Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.

  16. 5.3CVE-2026-27355EPSS 0.4%

    Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.

  17. 5.3CVE-2026-25466EPSS 0.3%

    Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.

  18. 5.4CVE-2026-25427EPSS 0.3%

    Subscriber Broken Access Control in eRoom <= 1.7.1 versions.

  19. 4.3CVE-2026-25424EPSS 0.3%

    Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.

  20. 5.3CVE-2026-15827EPSS 0.5%

    The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in …

  21. 9.8CVE-2026-15015ExploitEPSS 2.6%

    The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due to the plugin not properly verifying that a user is authorized to perform an ac…

  22. 6.8CVE-2026-59677EPSS 0.1%

    A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in unconfined context This issue affects policycoreutils t…

  23. 7.5CVE-2026-12082EPSS 0.4%

    The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to modify the permalink of any published post and to read Praison AI SEO WordPress plu…

  24. 6.3CVE-2026-13078EPSS 0.4%

    A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables JavaScript calls to read arbitrary files from the host filesystem using the mongod …

  25. 6.8CVE-2026-7328EPSS 0.1%

    Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands cont…

  26. 5.3CVE-2026-65011EPSS 0.4%

    Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint that allows authenticated users to clone any event definition. Attackers with the low-pr…

  27. 6.5CVE-2026-16544EPSS 0.4%

    A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() function (job_events, workflow_events, ad_hoc_command_events). Three event groups - inv…

  28. 4.3CVE-2026-63262EPSS 0.3%

    Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level access control.

  29. 4.3CVE-2026-63143EPSS 0.3%

    Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileges can access workflow execution outputs in their Kibana space without the autho…

  30. 5.4CVE-2026-63141EPSS 0.2%

    Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the required feature privileges, via direct requests to insufficiently protected product e…

  31. 7.3CVE-2026-61267EPSS 0.3%

    Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Spreadsheet Loading). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows unauthenticated …

  32. 8.1CVE-2026-60953EPSS 0.4%

    Vulnerability in the Oracle Telecommunications Billing Integrator product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low pr…

  33. 6.5CVE-2026-60712EPSS 0.2%

    Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22.3-26.5. Easily exploitable vulnerability allows low privileged attacker with lo…

  34. 6.9CVE-2026-65055EPSS 0.3%

    Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow configuration of any private project by supplying a project ID to the filters_data A…

  35. 5.3CVE-2026-63092EPSS 0.3%

    kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrieve the full plaintext commercial license key by sending a GET request to the mod…

  36. 8.2CVE-2026-47688EPSS 0.3%

    FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clearPMTasks` methods in `FOGPage` can be invoked by an unauthenticated attacker via…

  37. 7.1CVE-2026-47657EPSS 0.4%

    HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller allowed any authenticated user to trigger the removal of all members from any Sp…

  38. 9.6CVE-2026-47416EPSS 0.3%

    PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. The `PATCH /workspaces/{workspace_id}/members/{user_id}` endpoint is gated by `re…

  39. 9.6CVE-2026-47413EPSS 0.3%

    PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member injection. The `POST /workspaces/{workspace_id}/members` endpoint is gated only b…

  40. 8.1CVE-2026-47412EPSS 0.5%

    PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive action. The `DELETE /workspaces/{workspace_id}` endpoint is gated only by `requi…

  41. 6.5CVE-2026-47411EPSS 0.3%

    PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace metadata + settings tampering. The `PATCH /workspaces/{workspace_id}` endpoint is …

  42. 8.1CVE-2026-47409EPSS 0.3%

    PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockout. The `DELETE /workspaces/{workspace_id}/members/{user_id}` endpoint is gated o…

  43. 8.8CVE-2026-47405EPSS 0.4%

    PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that allows any authenticated low-privilege workspace member to escalate their own rol…

  44. 4.3CVE-2026-16454EPSS 0.4%

    In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller. This vulnerability allows an authenticated device to escalate i…

  45. 8.7CVE-2026-47394EPSS 0.5%

    PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory description named four vulnerable handlers in `mcp_server/adapters/cli_tools.py`. Commi…

  46. 9.1CVE-2026-28310EPSS 0.5%

    SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system administrator. The impact is lower in Windows deployments.

  47. 9.1CVE-2026-28309EPSS 0.5%

    SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact is lower in Windows deployments.

  48. 7.1CVE-2026-65050EPSS 0.4%

    Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-table` Gutenberg block that allows authenticated attackers with Author-level privil…

  49. 5.0CVE-2026-11876EPSS 0.2%

    In zenml-io/zenml version 0.94.2, the `GET /api/v1/stack-deployment/stack` endpoint (`get_deployed_stack`) lacks proper RBAC authorization checks, allowing any authenticated user to enumerate all deployed stacks across all users and tenant…

  50. 6.5CVE-2026-6792EPSS 0.3%

    Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects FlexCity: from 5.536.0 before 5.542.0.