cve.bz

CWE-862: Missing Authorization, page 65

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-57660EPSS 0.3%

    Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions.

  2. 6.5CVE-2026-57654EPSS 0.3%

    Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions.

  3. 4.3CVE-2026-57649EPSS 0.3%

    Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.

  4. 4.3CVE-2026-57648EPSS 0.3%

    Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.

  5. 8.1CVE-2026-57645EPSS 0.3%

    newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions.

  6. 4.3CVE-2026-57640EPSS 0.3%

    Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.

  7. 5.4CVE-2026-57632EPSS 0.3%

    Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.

  8. 4.3CVE-2026-57622EPSS 0.3%

    Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.

  9. 4.3CVE-2026-57430EPSS 0.3%

    Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.

  10. 6.5CVE-2026-57324EPSS 0.3%

    Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.

  11. 5.8CVE-2026-57323EPSS 0.3%

    Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.

  12. 8.7CVE-2026-56773EPSS 0.5%

    Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can read table schemas, create tables, and modify or delete records across bases and t…

  13. 8.3CVE-2026-56063EPSS 0.3%

    Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions.

  14. 7.5CVE-2026-56061EPSS 0.3%

    Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions.

  15. 8.8CVE-2026-56038EPSS 0.4%

    Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions.

  16. 7.5CVE-2026-56025EPSS 0.3%

    Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions.

  17. 7.5CVE-2026-54847EPSS 0.4%

    Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions.

  18. 7.5CVE-2026-54846EPSS 0.4%

    Unauthenticated Broken Access Control in Syncee Premium Dropshipping &amp; Wholesale <= 1.0.27 versions.

  19. 7.3CVE-2026-54840EPSS 0.3%

    Unauthenticated Broken Access Control in Newsletters <= 4.13 versions.

  20. 7.5CVE-2026-54837EPSS 0.4%

    Unauthenticated Broken Access Control in Intranet &amp; Private Site &#8211; All-In-One Intranet <= 1.8.1 versions.

  21. 7.5CVE-2026-54835EPSS 0.3%

    Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.

  22. 7.5CVE-2026-54832EPSS 0.3%

    Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions.

  23. 6.5CVE-2026-52701EPSS 0.3%

    Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.

  24. 5.3CVE-2026-24547EPSS 0.3%

    Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.

  25. 5.3CVE-2025-64636EPSS 0.3%

    Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.

  26. 4.3CVE-2025-63079EPSS 0.3%

    Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.

  27. 4.3CVE-2025-63078EPSS 0.3%

    Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.

  28. 5.4CVE-2025-63041EPSS 0.3%

    Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.

  29. 5.3CVE-2026-57925EPSS 0.3%

    In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags

  30. 7.5CVE-2026-57923EPSS 0.3%

    In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings

  31. 5.3CVE-2026-57922EPSS 0.2%

    In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible

  32. 7.5CVE-2026-57921EPSS 0.3%

    In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint

  33. 6.5CVE-2026-1869EPSS 0.3%

    The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing…

  34. 5.3CVE-2026-57521EPSS 0.4%

    Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpo…

  35. 7.1CVE-2026-57520EPSS 0.6%

    Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Admin accounts from an organization by exploiting a missing role hierarchy check in…

  36. 4.3CVE-2026-2299EPSS 0.2%

    The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private ch…

  37. 8.7CVE-2026-56768EPSS 0.7%

    Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication. Attackers with a folder share-link token can call the GET endpoint to obtain a…

  38. 8.7CVE-2026-56767EPSS 0.6%

    Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users to access other users' robots and OAuth tokens. Attackers can read plaintext Goo…

  39. 6.5CVE-2026-54029EPSS 0.3%

    LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId endpoint allows any authenticated user to delete any other user's messages. The validateMes…

  40. 6.5CVE-2026-54027EPSS 0.3%

    LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated user to upload files into any agent's tool_resources (e.g., context, execute_code)…

  41. 6.5CVE-2026-48941EPSS 0.3%

    The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::delete()` call under `/media/k2/galleries/`

  42. 6.5CVE-2026-57619EPSS 0.4%

    Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions.

  43. 6.5CVE-2026-57429EPSS 0.3%

    Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.

  44. 5.4CVE-2026-56023EPSS 0.3%

    Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.

  45. 7.5CVE-2026-54844EPSS 0.3%

    Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions.

  46. 8.1CVE-2026-54842EPSS 0.4%

    Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Royal MCP: from n/a through 1.4.25.

  47. 7.5CVE-2026-54830EPSS 0.3%

    Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.

  48. 7.5CVE-2026-54828EPSS 0.3%

    Unauthenticated Broken Access Control in Motors <= 1.4.109 versions.

  49. 7.5CVE-2026-27366EPSS 0.3%

    Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions.

  50. 3.1CVE-2026-3176EPSS 0.3%

    GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an authenticated user with limited permissions to acce…