cve.bz

CWE-862: Missing Authorization, page 68

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 10.0CVE-2026-0071EPSS 0.2%

    In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

  2. 3.3CVE-2026-0057EPSS 0.07%

    In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could lead to local information disclosure with no additional execution privileges need…

  3. 6.5CVE-2025-69137EPSS 0.3%

    Subscriber Broken Access Control in Genemy <= 1.6.6 versions.

  4. 7.5CVE-2025-69103EPSS 0.4%

    Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions.

  5. 8.0CVE-2025-48640EPSS 0.09%

    In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adjacent) escalation of privilege with no additional execution privileges needed. Us…

  6. 7.8CVE-2025-48617EPSS 0.08%

    In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is no…

  7. 4.3CVE-2024-37496EPSS 0.2%

    Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.3.7.

  8. 6.5CVE-2024-37210EPSS 0.3%

    Missing Authorization vulnerability in ali2woo AliNext allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AliNext: from n/a through 3.3.5.

  9. 5.3CVE-2024-33909EPSS 0.2%

    Missing Authorization vulnerability in Avirtum iPages Flipbook allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects iPages Flipbook: from n/a through 1.5.1.

  10. 4.3CVE-2024-33685EPSS 0.2%

    Missing Authorization vulnerability in Jegstudio Startupzy startupzy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Startupzy: from n/a through 1.1.1.

  11. 8.3CVE-2024-32949EPSS 0.3%

    Missing Authorization vulnerability in Prince Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Integrate Google Drive: from n/a through 1.3.8.

  12. 4.3CVE-2024-31435EPSS 0.2%

    : Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Social Media & Share Icons: from n/a through 2.8.6.

  13. 4.3CVE-2024-24709EPSS 0.2%

    Missing Authorization vulnerability in Shareaholic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Shareaholic: from n/a through 9.7.11.

  14. 6.5CVE-2026-12105EPSS 0.3%

    Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited permissions.

  15. 4.0CVE-2026-0158EPSS 0.07%

    In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploita…

  16. 4.0CVE-2026-0145EPSS 0.08%

    In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.

  17. 7.8CVE-2026-0133EPSS 0.07%

    In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges …

  18. 7.6CVE-2026-53866EPSS 0.3%

    OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved commands. A command request using shell inline-command forms could route through…

  19. 6.3CVE-2026-53851EPSS 0.2%

    OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reactio…

  20. 6.8CVE-2026-53850EPSS 0.09%

    OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks. Attackers can trigger the focus command …

  21. 6.0CVE-2026-53844EPSS 0.2%

    OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without proper authorization. Attackers can skip session visibility guard…

  22. 6.9CVE-2026-10831EPSS 0.3%

    A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does not properly validate whether a sender is associated with a valid data port session before accepti…

  23. 8.3CVE-2025-14272EPSS 0.2%

    A security issue was identified in Pavilion due to improper authorization enforcement in API endpoints. This vulnerability can allow an unauthorized actor to execute privileged operations, including user/role management and other administr…

  24. 6.5CVE-2026-54190EPSS 0.3%

    Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.

  25. 5.9CVE-2026-52714EPSS 0.2%

    Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions.

  26. 7.5CVE-2026-52711EPSS 0.2%

    Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions.

  27. 6.5CVE-2026-40809EPSS 0.2%

    Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1.

  28. 7.5CVE-2026-39490EPSS 0.3%

    Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions.

  29. 6.5CVE-2026-2381EPSS 0.4%

    The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_pay_for_order()` function in all versions up to, and including, 10.7.0 This is du…

  30. 7.5CVE-2025-68045EPSS 0.2%

    Missing Authorization vulnerability in Arraytics WP Event Solution wp-event-solution allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Event Solution: from n/a through 4.1.12.

  31. 5.3CVE-2026-9187EPSS 0.2%

    The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation in the action__remove_aba…

  32. 5.3CVE-2026-6964EPSS 0.3%

    The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This …

  33. 6.5CVE-2026-49775EPSS 0.2%

    Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.

  34. 7.5CVE-2026-49070EPSS 0.2%

    Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions.

  35. 8.2CVE-2026-49065EPSS 0.2%

    Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions.

  36. 6.5CVE-2026-48887EPSS 0.2%

    Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.

  37. 7.5CVE-2026-48883EPSS 0.2%

    Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions.

  38. 9.1CVE-2026-48881EPSS 0.3%

    Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions.

  39. 7.5CVE-2026-48873EPSS 0.2%

    Unauthenticated Broken Access Control in Montonio for WooCommerce <= 10.1.2 versions.

  40. 7.5CVE-2026-48835EPSS 0.3%

    Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions.

  41. 3.7CVE-2026-48709EPSS 0.3%

    OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/internal/api/api.go does not perform any authentication or authorization checks. Unli…

  42. 7.5CVE-2026-42666EPSS 0.3%

    Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions.

  43. 8.2CVE-2026-42664EPSS 0.3%

    Unauthenticated Broken Access Control in AI Product Search for WooCommerce &#8211; Motive Commerce Search <= 1.38.2 versions.

  44. 6.5CVE-2026-42659EPSS 0.3%

    Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.

  45. 6.3CVE-2026-42651EPSS 0.2%

    Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions.

  46. 6.5CVE-2026-42640EPSS 0.2%

    Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions.

  47. 6.5CVE-2026-40795EPSS 0.3%

    Subscriber Broken Access Control in Amelia <= 2.2 versions.

  48. 6.5CVE-2026-40794EPSS 0.3%

    Subscriber Broken Access Control in myCred <= 3.0.3 versions.

  49. 6.5CVE-2026-40793EPSS 0.3%

    Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.

  50. 7.1CVE-2026-40788EPSS 0.3%

    Subscriber Broken Access Control in ChatBot <= 7.9.7 versions.