cve.bz

CWE-862: Missing Authorization, page 69

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2026-40793EPSS 0.3%

    Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.

  2. 7.1CVE-2026-40788EPSS 0.3%

    Subscriber Broken Access Control in ChatBot <= 7.9.7 versions.

  3. 6.5CVE-2026-40782EPSS 0.2%

    Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions.

  4. 7.5CVE-2026-40776EPSS 0.4%

    Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions.

  5. 7.3CVE-2026-40775EPSS 0.2%

    Unauthenticated Broken Access Control in Royal MCP <= 1.4.2 versions.

  6. 7.5CVE-2026-40774EPSS 0.2%

    Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions.

  7. 6.5CVE-2026-40773EPSS 0.3%

    Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions.

  8. 6.5CVE-2026-40743EPSS 0.3%

    Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.

  9. 7.5CVE-2026-40741EPSS 0.2%

    Unauthenticated Broken Access Control in Redsys for WooCommerce Light <= 7.0.0 versions.

  10. 6.4CVE-2026-39594EPSS 0.3%

    Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.

  11. 6.5CVE-2026-39584EPSS 0.3%

    Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.

  12. 7.5CVE-2026-39534EPSS 0.3%

    Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions.

  13. 7.5CVE-2026-39533EPSS 0.3%

    Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions.

  14. 6.5CVE-2026-39525EPSS 0.2%

    Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.

  15. 7.5CVE-2026-39524EPSS 0.2%

    Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions.

  16. 6.5CVE-2026-39515EPSS 0.4%

    Subscriber Broken Access Control in Motors < 1.4.107 versions.

  17. 7.5CVE-2026-39513EPSS 0.3%

    Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions.

  18. 7.5CVE-2026-39503EPSS 0.2%

    Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions.

  19. 7.5CVE-2026-34898EPSS 0.2%

    Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions.

  20. 6.5CVE-2026-34892EPSS 0.3%

    Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rank Math SEO: from n/a through 1.0.271.

  21. 7.5CVE-2026-34886EPSS 0.3%

    Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions.

  22. 5.3CVE-2026-25440EPSS 0.2%

    Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.

  23. 7.5CVE-2026-25425EPSS 0.4%

    Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions.

  24. 6.5CVE-2025-69332EPSS 0.3%

    Subscriber Broken Access Control in Bookify <= 1.1.1 versions.

  25. 6.3CVE-2025-68049EPSS 0.2%

    Subscriber Broken Access Control in bunny.net <= 2.3.6 versions.

  26. 9.8CVE-2026-38329EPSS 0.6%

    Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails to perform authorization checks and lacks file extension validation. An attacker …

  27. 7.1CVE-2026-5230EPSS 0.2%

    Improper Access Control, Missing Authorization vulnerability in MIA Technology Inc. Pizzy Library allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pizzy Library: from 1.0.0.26250 before 1.3.9.262…

  28. 6.5CVE-2026-48969EPSS 0.3%

    Subscriber Broken Access Control in Really Simple SSL <= 9.5.9 versions.

  29. 6.5CVE-2025-64215EPSS 0.2%

    Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects MasterStudy LMS Pro: from n/a before 4.7.16.

  30. 8.6CVE-2026-34024EPSS 0.3%

    The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains missing authorization checks on multiple web application endpoints. An authenticated attacker with minimal privileges can access endpoints that are not visible…

  31. 8.7CVE-2026-53821EPSS 0.3%

    OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline. Unpaired or restricted trusted-proxy Control UI clients can obtain cached operat…

  32. 6.9CVE-2026-53820EPSS 0.09%

    OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path that allows authenticated callers to bypass intended command restrictions. Attackers can reach the affected bundled MCP …

  33. 7.1CVE-2026-48119EPSS 0.3%

    Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.12, authenticated agents can forge service-monitor results for other users' services. This issue has …

  34. 7.1CVE-2026-47120EPSS 0.3%

    Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember can fire other users' cron tasks via AlertRule.FailTriggerTasks (no ownership check). …

  35. 9.9CVE-2026-46716EPSS 0.4%

    Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user can create a scheduled cron task with Cover=CronCoverAll, Servers=[] and an arbit…

  36. 5.3CVE-2026-45085EPSS 0.2%

    Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to before 2026.4.1, four authorization/disclosure issues in the chat plugin (one als…

  37. 7.8CVE-2026-42851EPSS 0.2%

    Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded file viewed with `cat`, a log line, an email body rendered in `less`, an issue b…

  38. 6.9CVE-2026-50244EPSS 0.2%

    The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-supplied account identifier, without validating any ownership relationship. Each call mints a new sequentia…

  39. 8.7CVE-2026-50108EPSS 0.3%

    The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate device or owner. An actor able to present a platform-valid request signature can…

  40. 5.1CVE-2026-10715EPSS 0.2%

    Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary post_id to POST /admin/post_type/<POST_TYPE_ID>/drafts and overwrit…

  41. 4.3CVE-2026-6689EPSS 0.2%

    Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Fail to enforce PermissionInviteUser when setting AllowOpenInvite or AllowedDomains during team creation (the check was only applied on update…

  42. 6.5CVE-2026-50084EPSS 0.2%

    The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is an instance of "CWE-862: Missing Authorization" with an estimated CVSS of CVSS:3.1/AV:N/AC:L/PR:L…

  43. 6.9CVE-2026-50026EPSS 0.3%

    Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, a lack of permission checks in these endpoints allowed unauthorized access to resources. This issue has been patched in versions 15.107.0 and 16.17.0.

  44. 5.3CVE-2026-44975EPSS 0.3%

    Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, any authenticated user can reset onboarding for all users in the system. This issue has been patched in versions 15.107.2 and 16.17.4.

  45. 8.6CVE-2026-7368EPSS 0.3%

    The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared hard-coded credentials or legitimate per-user credentials, can subscribe to wildcard topics covering all rob…

  46. 7.2CVE-2026-47197EPSS 0.3%

    Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discord permission bit can use the bot to moderate users above them in the Discord role hierarchy, as long as the bot itself outranks the target.…

  47. 6.9CVE-2026-53818EPSS 0.10%

    OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to skip owner-only tool policies and before-tool-call hooks. Attackers can invoke owner-only behavior throug…

  48. 8.6CVE-2026-53816EPSS 0.3%

    OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle events without system.run authorization. A malicious or compromised paired node …

  49. 7.1CVE-2026-53815EPSS 0.2%

    OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can request messages from channels not intended for them by exploiting insufficient v…

  50. 7.2CVE-2026-47163EPSS 0.3%

    Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.1, any guild member who can invoke slash commands can use /automod add, /automod remove, and /automod list because the command …