cve.bz

CWE-862: Missing Authorization, page 64

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 4.3CVE-2026-12902EPSS 0.5%

    The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.7.7. This is due to the plugin not properly verifying that a user is authoriz…

  2. 4.3CVE-2026-12133EPSS 0.4%

    The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Group Deletion in versions up to, and including, 5.7.8. This is due to a missing capability check i…

  3. 4.3CVE-2026-12113EPSS 0.4%

    The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.02 via the cpabc_appointments_filter_list. This makes it possible for authenticated attackers, …

  4. 6.5CVE-2026-14156EPSS 0.3%

    Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to bypass same origin policy via a crafted HTML page. (Chromium security severit…

  5. 7.1CVE-2026-58448EPSS 0.4%

    yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process instance records by supplying a caller-controlled process-instance identifier to an …

  6. 6.0CVE-2026-9132EPSS 0.4%

    A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositories they did not have access to. The Copilot pull request description diff sum…

  7. 8.6CVE-2026-58377EPSS 0.4%

    JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and delete operations on OpenAPI credentials by accessing the OpenApiAuthController …

  8. 5.3CVE-2026-58373EPSS 0.3%

    CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_queryset that allows authenticated attackers to enumerate quality report identifiers belonging to other organizations by exploiting a missing c…

  9. 7.1CVE-2026-58176EPSS 0.3%

    RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permission check: the controller declares no class-level or method-level authorization a…

  10. 7.7CVE-2026-58168EPSS 0.4%

    DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allowed_mcp_tools function returning None instead of a denied result when mcp_tools …

  11. 7.1CVE-2026-58167EPSS 0.4%

    Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passwords, and mTLS client keys, to any authenticated low-privilege (Standard role) u…

  12. 8.7CVE-2026-58165EPSS 0.3%

    OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained enrollment management permissions to create enrollments for any identity, inclu…

  13. 7.5CVE-2026-54475EPSS 0.6%

    Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expected to be isolated to the connection that created them. The isolation can be brok…

  14. 5.3CVE-2026-12349EPSS 0.4%

    The Premium Addons for KingComposer plugin for WordPress is vulnerable to unauthorized modification and loss of data in versions up to, and including, 1.1.1. This is due to missing authorization and capability checks on the add_custom_side…

  15. 9.6CVE-2026-57498EPSS 0.3%

    Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consistently validate server ownership with Server::whereTeamId($teamId) before any oper…

  16. 5.3CVE-2026-57954EPSS 0.2%

    Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort collections by forbidden fields. Attackers can infer hidden field values through row …

  17. 6.0CVE-2026-57952EPSS 0.3%

    Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook, c2profile_get_ioc_webhook, c2profile_sample_message_webhook) that fail to verif…

  18. 7.1CVE-2026-57949EPSS 0.3%

    ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module's GET /admin-api/crm/follow-up-record/get endpoint that allows authenticated users to read any follow-up record by ite…

  19. 6.3CVE-2026-57946EPSS 0.4%

    Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist contents by accessing the RSS feed playlist endpoint without authentication. Attackers …

  20. 6.5CVE-2026-57340EPSS 0.3%

    Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions.

  21. 6.5CVE-2026-57339EPSS 0.3%

    Unauthenticated Broken Access Control in Business Directory <= 6.4.23 versions.

  22. 6.5CVE-2026-57335EPSS 0.3%

    Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 versions.

  23. 6.5CVE-2026-57334EPSS 0.3%

    Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions.

  24. 7.1CVE-2026-57332EPSS 0.3%

    Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions.

  25. 6.3CVE-2026-57327EPSS 0.3%

    Subscriber Broken Access Control in MainWP <= 6.1.1 versions.

  26. 8.3CVE-2025-2902EPSS 0.4%

    Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E390, E590, E790, E990, E1090, E390H, E590H, E790H, E1090H: before DKCMAIN Ver. 93-07-26-…

  27. 2.1CVE-2026-13537EPSS 0.2%

    A vulnerability was found in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function. The manipulation results in cross-site request forgery. The attack may be launched remotely. The exploit has been made public and…

  28. 1.3CVE-2026-13484EPSS 0.5%

    A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experiment-scoped Label Schema CRUD API. Such manipulation leads to missing authorization…

  29. 4.3CVE-2026-9233EPSS 0.5%

    The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 11.1.4. This is due to the plugin not properly verifying that a user is authoriz…

  30. 6.5CVE-2026-3462EPSS 0.4%

    The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'upload_csv' and 'process_batch' functions in all versions up to, and including, 1.8.9. This makes it possible …

  31. 4.3CVE-2026-12471EPSS 0.3%

    The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plugin function in all versions up to, and including, 2.0.11. This makes it possible for authenticated attackers, with Sub…

  32. 5.3CVE-2026-12432EPSS 0.6%

    The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_status AJAX action. The handler is registered through both wp_ajax_ and wp_ajax_…

  33. 4.3CVE-2026-11773EPSS 0.2%

    The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.1. This is due to the plugin not properly verifying that a user is authoriz…

  34. 4.3CVE-2026-11364EPSS 0.4%

    The Product Specifications for WooCommerce plugin for WordPress is vulnerable to unauthorized modification, creation, and deletion of data in versions up to and including 0.8.9. This is due to a missing capability check and missing nonce v…

  35. 5.3CVE-2026-12404EPSS 0.5%

    The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. This is due to the plugin not properly verifying that a user is authorized to perfo…

  36. 8.2CVE-2026-50137EPSS 0.4%

    Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id (app_...) and an S3-source datasource id (ds_...) can call this endpoint with no auth and obtain a 15-minute pre…

  37. 4.3CVE-2026-55838EPSS 0.3%

    RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.7 and earlier, the real-time metrics endpoint at /rustfs/admin/v3/metrics is accessible to any valid IAM user regardless of their assigned policy. Every other admin…

  38. 7.7CVE-2026-55189EPSS 0.3%

    RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, when the FTP frontend is enabled, the FTP read and probe handlers dispatch directly to the storage backend without ever calling the IAM aut…

  39. 8.2CVE-2026-55188EPSS 0.3%

    RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket replication admin API. The ListRemoteTargetHandler handler for listing remote replica…

  40. 8.6CVE-2026-49991EPSS 0.4%

    RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploit a path traversal vulnerability in the Snowball auto-extract feature to write a…

  41. 7.5CVE-2026-47193EPSS 0.3%

    OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field values without enforcing object and field visibility. This vulnerability is fixed in…

  42. 6.5CVE-2026-44734EPSS 0.3%

    OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization vulnerability exists in OpenProject's CostReportsController. The rename and update actions allow any authenticated user …

  43. 8.7CVE-2026-57518EPSS 0.7%

    Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to escalate privileges by assigning arbitrary custom roles to themselves due to missing authorization…

  44. 9.6CVE-2026-12411EPSS 0.3%

    Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's custom storage volume via a crafted device PATCH request over /dev/lxd when security…

  45. 5.4CVE-2026-57661EPSS 0.3%

    Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions.

  46. 5.3CVE-2026-57660EPSS 0.3%

    Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.

  47. 6.5CVE-2026-57654EPSS 0.3%

    Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.

  48. 4.3CVE-2026-57649EPSS 0.3%

    Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.

  49. 4.3CVE-2026-57648EPSS 0.3%

    Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.

  50. 8.1CVE-2026-57645EPSS 0.3%

    newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.