cve.bz

CWE-862: Missing Authorization, page 71

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE. OWASP Top 10: A01:2025 Broken Access Control

Related attack patterns (CAPEC): 1
  • CAPEC-665 Exploitation of Thunderbolt Protection Flaws Likelihood: Low · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-862, as MITRE names them. Credits.

Ask an AI about CWE-862

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.0CVE-2026-44281EPSS 0.3%

    GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with config READ permission can read a specific asset object. Upgrade to 11.0.7 or 10.0.25 to…

  2. 5.9CVE-2026-42320EPSS 0.2%

    GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 10.0.25 and 11.0.7, a technician can read arbitrary files inside the GLPI_DOC_DIR. Upgrade to 10.0.25 or 11.0.7 to receive a patch.

  3. 7.0CVE-2026-42318EPSS 0.3%

    GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to planning can delete any object in GLPI. Upgrade to 11.0.7 or 10.0.25 to receive…

  4. 7.0CVE-2026-42317EPSS 0.3%

    GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary files from the filesystem as long as the webserver has write rights on them. Upgr…

  5. 7.1CVE-2026-31942EPSS 0.2%

    LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.7.6, an Insecure Direct Object Reference (IDOR) vulnerability exists in the API keys management endpoint (PUT /api/keys). Due to …

  6. 2.1CVE-2026-10616EPSS 0.2%

    A weakness has been identified in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function TeamTasksTool.executeComplete of the file internal/tools/team_tasks_lifecycle.go of the component Team Task Completion Handler. Ex…

  7. 5.3CVE-2026-40571EPSS 0.2%

    NamelessMC is website software for Minecraft servers. In version 2.2.4, `core/classes/Misc/ProfilePostReactionContext.php` only verifies that the wall post exists and does not enforce blocked/private-profile visibility. This means that aut…

  8. 6.9CVE-2026-40314EPSS 0.3%

    NamelessMC is website software for Minecraft servers. In version 2.2.4,`core/classes/Misc/ProfilePostReactionContext.php` only verifies that the wall post exists and does not enforce blocked/private-profile visibility. `modules/Core/querie…

  9. 5.3CVE-2026-35443EPSS 0.2%

    NamelessMC is website software for Minecraft servers. In version 2.2.4, `modules/Forum/classes/ForumPostReactionContext.php` only verifies that the caller can view the forum, but it does not re-enforce topic-level `view_other_topics` autho…

  10. 5.4CVE-2026-49782EPSS 0.2%

    Missing Authorization vulnerability in Elementor Elementor Website Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Elementor Website Builder: from n/a through 4.1.0.

  11. 5.4CVE-2026-27351EPSS 0.2%

    Missing Authorization vulnerability in Sekander Badsha Crew HRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Crew HRM: from n/a through 1.2.2.

  12. 7.5CVE-2026-42670EPSS 0.3%

    Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Five Star Restaurant Reservations: from n/…

  13. 7.5CVE-2026-42669EPSS 0.2%

    Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from n/a through 4.3.2.0.

  14. 4.3CVE-2025-53346EPSS 0.2%

    Missing Authorization vulnerability in ThimPress Thim Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Thim Core: from n/a through 2.3.3.

  15. 8.8CVE-2025-53345EPSS 0.2%

    Missing Authorization vulnerability in ThimPress Thim Core thim-core.This issue affects Thim Core: from n/a through 2.3.3.

  16. 5.3CVE-2025-53302EPSS 0.2%

    Missing Authorization vulnerability in Anton Shevchuk Constructor allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Constructor: from n/a through 1.6.5.

  17. 6.5CVE-2025-52766EPSS 0.2%

    Missing Authorization vulnerability in Printeers Printeers Print & Ship allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Printeers Print & Ship: from n/a through 1.17.0.

  18. 4.3CVE-2026-9234EPSS 0.2%

    The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.4.1. This is due to missing capability checks and nonce verification on the admin_post_settings_save_woo-jtl-…

  19. 4.3CVE-2026-9050EPSS 0.2%

    The Slider Revolution plugin for WordPress in versions 6.0.0-6.7.55 and 7.0.0-7.0.14 is vulnerable to unauthorized modification of data. This is due to the plugin not properly verifying that a user is authorized to perform an action. This …

  20. 7.8CVE-2025-26418EPSS 0.07%

    In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to a managed device due to a missing permission check. This could lead to local escalation of privile…

  21. 6.4CVE-2026-45285EPSS 0.3%

    Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or file with a Nextcloud Team that includes an external member (a person added via …

  22. 6.5CVE-2026-45267EPSS 0.3%

    Nextcloud is an open source content collaboration platform. Prior to version 5.2.6, a missing permissions check allowed users to request reading form submissions of other users. This issue has been patched in version 5.2.6.

  23. 7.5CVE-2026-42677EPSS 0.2%

    Missing Authorization vulnerability in Ben Balter WP Document Revisions allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP Document Revisions: from n/a before 4.0.0.

  24. 7.3CVE-2026-42675EPSS 0.2%

    Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hydra Booking: from n/a through 1.1.41.

  25. 6.5CVE-2026-42671EPSS 0.2%

    Missing Authorization vulnerability in Paolo GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GeoDirectory: from n/a through 2.8.157.

  26. 9.1CVE-2026-42682EPSS 0.3%

    Missing Authorization vulnerability in Tomdever wpForo Forum allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects wpForo Forum: from n/a through 3.0.6.

  27. 4.3CVE-2026-41014EPSS 0.4%

    The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with global Asset:read permission could enumerate partition run state, schedule configur…

  28. 8.8CVE-2026-40543EPSS 0.3%

    SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve backup archives containing user databases with usernames and password hashes, as wel…

  29. 5.3CVE-2026-8382EPSS 0.5%

    The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This…

  30. 4.3CVE-2026-48811EPSS 0.2%

    FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, FreeScout allows a non-admin user to permanently delete an internal note (private thread) from any conversation, even after that user's ac…

  31. 6.5CVE-2026-49385EPSS 0.2%

    In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts

  32. 4.3CVE-2026-49378EPSS 0.2%

    In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion

  33. 7.6CVE-2026-49374EPSS 0.2%

    In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters

  34. 8.8CVE-2026-49367EPSS 0.3%

    In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account

  35. 6.5CVE-2026-47745EPSS 0.2%

    Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-record actions (enable, disable, edit, delete) that were rendered for any authenticat…

  36. 6.5CVE-2026-47742EPSS 0.2%

    Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files) had no authorization on their store() method. Any authenticated panel user, regar…

  37. 8.1CVE-2026-47740EPSS 0.3%

    Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an authenticated low-privilege user without the permission required to mutate orde…

  38. 8.8CVE-2026-47125EPSS 0.2%

    Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/environments/{id}/templates/variables endpoint, which writes the system-wide .env.global file used for variable substitutio…

  39. 9.9CVE-2026-45632EPSS 0.3%

    Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a result, any authenticated user can create, update, run, or delete schedules belonging…

  40. 9.9CVE-2026-45625EPSS 0.4%

    Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, Arcane's huma-based REST API exposes nine endpoints under /api/customize/git-repositories and /api/git-repositories/sync for managing Gi…

  41. 7.5CVE-2026-35630EPSS 0.2%

    OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. Non-approver users can click approval buttons to resolve pending exec or plugin a…

  42. 8.7CVE-2026-32905EPSS 0.2%

    OpenClaw before 2026.5.4 contains an authorization bypass vulnerability in the bundled device-pair plugin that allows non-owner authorized chat senders to issue device-pairing bootstrap codes without proper scope validation. Attackers with…

  43. 8.7CVE-2018-25391EPSS 0.3%

    HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a crafted request that specifies the target record's id. The admin/modul/mod_pengurus/a…

  44. 9.1CVE-2026-4290EPSS 0.3%

    The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint in all versions up to, and including, 10.6.0. This is due to the check_permission() call…

  45. 5.3CVE-2025-12714EPSS 0.4%

    The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the update_site_editor_homepage function in all versions up to, and including, 1.0.271…

  46. 6.0CVE-2026-44884EPSS 0.3%

    Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8 and 2.39.1, a missing authorizati…

  47. 9.4CVE-2026-44849EPSS 0.4%

    Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, Portainer en…

  48. 9.4CVE-2026-44848EPSS 0.4%

    Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8, 2.39.2, and 2.41.0, The Docker p…

  49. 7.2CVE-2026-42071EPSS 0.3%

    Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 2.23.0 to 2.28.1, a missing authorization check in MantisBT's file visibility function allows any authenticated user (REPORTER+) to download attachments on private bugnote…

  50. 5.4CVE-2026-44794EPSS 0.2%

    Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey (a pattern allowing an object to reference another object that may belong to one…