cve.bz

CWE-862: Missing Authorization, page 63

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 9.9CVE-2026-34048EPSS 0.8%

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap routes only check authentication and do not enforce terminal authorization, allowing …

  2. 6.9CVE-2026-53647EPSS 0.5%

    FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is accessible without authentication. Any caller with a valid API key can retrieve al…

  3. 8.7CVE-2026-53643EPSS 0.4%

    FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized actions via admin API endpoints. The root cause is a combination of the `can_alway…

  4. 2.3CVE-2026-53640EPSS 0.4%

    FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, low-privileged staff accounts may read sensitive data via admin API endpoints that lack permission checks. While sibling write endpoints corre…

  5. 6.5CVE-2026-34050EPSS 0.4%

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Settings/Updates Livewire component does not check isInstanceAdmin in its mount method, allowing non-admin use…

  6. 2.1CVE-2026-14800EPSS 0.2%

    A weakness has been identified in imhamzaazam ecommerceFlask up to cb7d9e24c30a99379651b7493b32048126ef402b. The affected element is an unknown function. This manipulation causes cross-site request forgery. The attack may be initiated remo…

  7. 7.8CVE-2026-6509EPSS 0.1%

    Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Privilege Escalation. This issue affects Pardus Update: from <=0.6.3 before 0.6.6.

  8. 4.3CVE-2026-27783EPSS 0.4%

    Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints.

  9. 8.2CVE-2026-27771ExploitEPSS 1.4%

    Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package source information.

  10. 4.3CVE-2026-25714EPSS 0.4%

    Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE-2025-68941.

  11. 7.5CVE-2026-25038EPSS 0.6%

    Gitea 1.26.2 allows unauthorized users to access labels of private organizations.

  12. 8.8CVE-2026-14460EPSS 0.2%

    Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects pardus-software: from <= 1.0.4 before 1.0.5.

  13. 5.3CVE-2026-11398EPSS 0.6%

    The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.6.1. This is due to the plugin not properly verifying that a user is aut…

  14. 4.3CVE-2026-9230EPSS 0.5%

    The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authoriz…

  15. 5.3CVE-2026-12557EPSS 0.4%

    The Ninja Forms - File Uploads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.29. This is due to the plugin not properly verifying that a user is authorized to perform an action. This m…

  16. 4.3CVE-2026-12729EPSS 0.4%

    The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.3.0. This is due to a missing capability check on the do_migration(…

  17. 6.9CVE-2026-59097EPSS 0.4%

    Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any project by exploiting unprotected POST endpoints on the user-story, task, and issue d…

  18. 4.9CVE-2026-50282EPSS 0.4%

    Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an authorization issue where a forced folder move can delete a conflicting destination …

  19. 5.3CVE-2026-57760EPSS 0.3%

    Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Sendcloud Shipping: from n/a through 1.0.29.

  20. 5.3CVE-2026-57750EPSS 0.3%

    Unauthenticated Broken Access Control in ez Form Calculator Premium <= 2.14.1.2 versions.

  21. 7.1CVE-2026-57746EPSS 0.3%

    Subscriber Broken Access Control in Booked <= 3.0.0 versions.

  22. 6.5CVE-2026-57731EPSS 0.3%

    Contributor Broken Access Control in Flatsome <= 3.20.5 versions.

  23. 4.3CVE-2026-57730EPSS 0.3%

    Subscriber Broken Access Control in Flatsome <= 3.20.5 versions.

  24. 4.3CVE-2026-57689EPSS 0.3%

    Subscriber Broken Access Control in Werkstatt <= 4.7.2 versions.

  25. 8.2CVE-2026-57688EPSS 0.4%

    Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions.

  26. 4.3CVE-2026-57685EPSS 0.3%

    Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme <= 3.2.8 versions.

  27. 6.5CVE-2026-57669EPSS 0.3%

    Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions.

  28. 6.5CVE-2026-57355EPSS 0.3%

    Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions.

  29. 6.5CVE-2026-57353EPSS 0.3%

    Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions.

  30. 7.5CVE-2026-39448EPSS 0.3%

    Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions.

  31. 6.5CVE-2026-27433EPSS 0.3%

    Missing Authorization vulnerability in StylemixThemes Motors motors allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motors: from n/a before 5.6.85.

  32. 7.5CVE-2025-69134EPSS 0.4%

    Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper <= 1.1.4 versions.

  33. 5.3CVE-2025-66076EPSS 0.3%

    Unauthenticated Broken Access Control in Woostify Sites Library <= 1.6.2 versions.

  34. 5.3CVE-2026-13459EPSS 0.6%

    The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This is due to the plugin not properly verifying that a user is authorized to perform …

  35. 5.3CVE-2026-12472EPSS 0.6%

    The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.11. This is due to the plugin not properly verifying that a user is author…

  36. 4.3CVE-2026-12134EPSS 0.4%

    The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.7.8. This is due to the plugin not properly verifying that a user is auth…

  37. 5.3CVE-2026-12122EPSS 0.5%

    The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 6.0.11 via the get_single_symbol. This makes it possible for unauthe…

  38. 4.3CVE-2026-11600EPSS 0.4%

    The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the Envo Tabs (and Off Canvas) widget's template rendering in versions u…

  39. 4.3CVE-2026-11592EPSS 0.5%

    The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.9.27. This is due to the plugin …

  40. 7.1CVE-2026-50284EPSS 0.4%

    Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() only requires the deleteAssets:<volume-uid> permission for the target folder. It …

  41. 5.3CVE-2026-50283EPSS 0.4%

    Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsController::actionReplaceFile that can delete a source asset without source delete…

  42. 5.5CVE-2026-55628EPSS 0.10%

    ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to pat…

  43. 5.3CVE-2026-57721EPSS 0.3%

    Missing Authorization vulnerability in WP Reloaded ApplyOnline allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ApplyOnline: from n/a through 2.6.7.6.

  44. 4.3CVE-2026-57720EPSS 0.3%

    Missing Authorization vulnerability in Codexpert Inc ThumbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects ThumbPress: from n/a through 6.3.2.

  45. 5.3CVE-2026-27409EPSS 0.3%

    Missing Authorization vulnerability in Webba Plugins Webba Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Webba Booking: from n/a through 6.4.13.

  46. 9.1CVE-2026-23537EPSS 1.0%

    A vulnerability has been identified in the Feast Feature Server’s `/save-document` endpoint that allows an unauthenticated remote attacker to write arbitrary JSON files to the server's filesystem. Although the system attempts to restrict f…

  47. 5.3CVE-2026-27435EPSS 0.3%

    Missing Authorization vulnerability in WofficeIO Woffice allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woffice: from n/a before 5.4.33.

  48. 4.3CVE-2026-12435EPSS 0.4%

    The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.111. This is due to the plugin not properly verifying that a user is authorized t…

  49. 7.5CVE-2026-1239EPSS 0.5%

    The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization check on the 'ninja-forms-views/token/refresh' REST callback in all versions up…

  50. 7.5CVE-2026-13468EPSS 0.6%

    The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.3. This is due to the plugin not properly verifying that a user is aut…