cve.bz

CWE-862: Missing Authorization, page 67

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 8.7CVE-2026-56396EPSS 0.4%

    phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to escalate privileges. Non-SuperAdmin users with edit_user permission can set is_s…

  2. 5.3CVE-2026-56384EPSS 0.3%

    Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private asset can call the endpoint with an attacker-controlled assetId and receive pre…

  3. 8.7CVE-2026-56341EPSS 0.5%

    AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens, Authorize.Net webhooks, and Bitcoin transaction records. Unauthenticated attacke…

  4. 6.5CVE-2026-12119EPSS 0.5%

    The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode attribute in all versions up to, and including, 6.3.7. This makes it possible for a…

  5. 7.5CVE-2026-11912EPSS 0.5%

    The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and including, 6.3.7. This makes it possible for unauthenticated attackers to delete and…

  6. 6.9CVE-2026-56213EPSS 0.4%

    Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER function exposed via PostgREST RPC, allowing unauthenticated attackers to insert arbitrary rows into version_meta for a…

  7. 9.6CVE-2026-48582EPSS 0.7%

    Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network.

  8. 8.1CVE-2026-49291EPSS 0.5%

    mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read` scope for all requests, then dispatches `tools/call` directly to handlers that…

  9. 4.3CVE-2026-49288EPSS 0.3%

    Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and content for resources they don't have permission to view, including entries, as…

  10. 5.3CVE-2026-12238EPSS 0.4%

    The WP Go Maps – Most Popular Map Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.1.01. This is due to the plugin not properly verifying that a user is authorized to perform an act…

  11. 8.8CVE-2026-49357EPSS 0.6%

    Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly operate the LINE Desktop application on Windows or Mac via MCP. `line-desktop-mcp` supports a `--http-mode` Streamable H…

  12. 5.3CVE-2026-6798EPSS 0.5%

    The 2Download Connector for 2DL Hosted Checkout plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 0.1.5. This is due to the plugin not properly verifying that a user is authorized to perform an…

  13. 5.3CVE-2026-3640EPSS 0.6%

    The STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and including 4.5. The plugin registers a REST API webhook endpoint at /wp-json/strabl/webhook/order with a permission_call…

  14. 4.3CVE-2026-9013EPSS 0.4%

    The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the bogo_rest_create_post_translation. This makes it possible for authenticated attackers, with subscriber-level …

  15. 4.3CVE-2026-10779EPSS 0.4%

    The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.4.2. This is due to a missing capability/ownership check on the gallery_image_…

  16. 5.3CVE-2026-10034EPSS 0.6%

    The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.39. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes …

  17. 7.1CVE-2026-52866EPSS 0.3%

    An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing legitimate users or applications from establishing a connection.

  18. 6.5CVE-2026-49205EPSS 0.4%

    phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed this in the BackupController by adding: $this->userHasPermission(PermissionType::BA…

  19. 8.6CVE-2026-11719EPSS 0.1%

    An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers. While the 2025-11-25 protocol version handler correctly enforces per-tool restriction…

  20. 10.0CVE-2026-28573EPSS 0.1%

    In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for explo…

  21. 4.3CVE-2026-9199EPSS 0.2%

    The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.42.1. This is due to the plugin not properly verifyin…

  22. 5.3CVE-2026-12093EPSS 0.4%

    The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it po…

  23. 5.3CVE-2026-10029EPSS 0.3%

    The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.13.1 via the get_events. This makes it possible for un…

  24. 8.8CVE-2026-12407EPSS 0.4%

    The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to the screen_action() function lacking a dedicated capability check and nonce ver…

  25. 4.3CVE-2026-12515EPSS 0.2%

    A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allowed users with the edit_products permission to query content information for rep…

  26. 7.5CVE-2026-54810EPSS 0.2%

    Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Nexi XPay: from n/a through 8.3.1.

  27. 8.6CVE-2026-54415EPSS 0.3%

    Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker with the admin.access permission to create AzLink server tokens and take over n…

  28. 7.3CVE-2025-69189EPSS 0.2%

    Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n/a through 1.2.3.

  29. 5.3CVE-2026-8383ExploitEPSS 7.6%

    The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map,…

  30. 7.5CVE-2026-54802EPSS 0.4%

    Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions.

  31. 8.2CVE-2026-49081EPSS 0.3%

    Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions.

  32. 6.5CVE-2026-49072EPSS 0.3%

    Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.

  33. 7.5CVE-2026-49057EPSS 0.3%

    Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions.

  34. 9.3CVE-2026-48797EPSS 0.3%

    Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, the optional Reflex web UI exposes a training control plane without authentication: dataset upload, model load, training …

  35. 4.8CVE-2026-48783EPSS 0.2%

    Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects to the organization referenced in that token's clai…

  36. 6.5CVE-2026-45436EPSS 0.3%

    Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.

  37. 8.2CVE-2026-40726EPSS 0.2%

    Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions.

  38. 4.3CVE-2026-40723EPSS 0.2%

    Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions.

  39. 5.5CVE-2026-40722EPSS 0.2%

    Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Yoast SEO Premium: from n/a through 26.6.

  40. 4.7CVE-2026-39595EPSS 0.2%

    Author Broken Access Control in W3 Total Cache <= 2.9.1 versions.

  41. 6.5CVE-2026-39433EPSS 0.4%

    Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions.

  42. 10.0CVE-2026-28615EPSS 0.1%

    In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for ex…

  43. 10.0CVE-2026-28587EPSS 0.1%

    In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User int…

  44. 9.1CVE-2026-24611EPSS 0.4%

    Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions.

  45. 4.3CVE-2026-24610EPSS 0.2%

    Subscriber Broken Access Control in MetForm Pro <= 3.9.1 versions.

  46. 4.3CVE-2026-24575EPSS 0.3%

    Subscriber Broken Access Control in WishList Member X <= 3.29.0 versions.

  47. 8.6CVE-2026-22343EPSS 0.3%

    Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions.

  48. 8.4CVE-2026-11858EPSS 0.1%

    Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\SYSTEM and exposes a .NET Remoting interface over a named pipe without sufficient acces…

  49. 10.0CVE-2026-0092EPSS 0.2%

    In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for ex…

  50. 10.0CVE-2026-0081EPSS 0.1%

    In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.