cve.bz

CWE-862: Missing Authorization, page 8

Filter

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

What the weakness is: CWE-862 at MITRE

Ask an AI about CWE-862

ChatGPTClaudePerplexityGoogle AI Mode

Show the promptExplain CWE-862: Missing Authorization and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/862.html and https://cve.bz/cve/cwe/862?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 5.3CVE-2026-105998EPSS 0.3%

    The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin bef…

  2. 5.3CVE-2026-105992EPSS 0.3%

    The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without…

  3. 7.2CVE-2026-114082EPSS 0.3%

    Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential…

  4. 2.3CVE-2026-114071EPSS 0.3%

    Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attacke…

  5. 5.3CVE-2026-114058EPSS 0.3%

    ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db…

  6. 5.3CVE-2026-114057EPSS 0.3%

    ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a…

  7. 5.3CVE-2026-114056EPSS 0.3%

    ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE e…

  8. 8.8CVE-2026-113128EPSS 0.3%

    Missing authorization in Animation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)

  9. 9.0CVE-2026-112380EPSS 0.4%

    Missing authorization in the WhatsApp group channel in Kiro Crew might allow a remote actor who is a member of an operator-configured WhatsApp group to control the operator's other agent sessions and execute arbitrary commands on the host …

  10. 8.6CVE-2026-111767EPSS 0.3%

    MCP TypeScript SDK is the official TypeScript SDK for Model Context Protocol servers and clients. From version 1.24.0 to before version 1.32.0, the experimental tasks feature (taskStore) did not check which session created a task. Clients …

  11. 5.3CVE-2026-113668EPSS 0.3%

    ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the REST route GET /api/v1/<piece-type>/:_id/locales (and the equivalent page route) does not apply the publicApiCheckAsync gate that ApostropheCMS's other…

  12. 3.7CVE-2026-113665EPSS 0.3%

    ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, the notification module exposes PATCH and DELETE REST endpoints that perform operations directly on the underlying MongoDB collection without verifying tha…

  13. 4.3CVE-2026-113660EPSS 0.4%

    ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, ApostropheCMS’s exist-in-locale API allows an authenticated low-privilege user to determine whether restricted documents exist in a specified locale and mo…

  14. 4.3CVE-2026-113655EPSS 0.3%

    ApostropheCMS is an open-source Node.js content management system. Prior to 4.33.0, an authenticated editor with legitimate edit rights on a pre-existing ordinary page nested under a restricted parent can use the same-parent page move oper…

  15. 6.5CVE-2026-113649EPSS 0.3%

    ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module and 4.34.0 of core ApostropheCMS, an editor who can import an enabled content type but lacks its stronger publication role can ca…

  16. 3.1CVE-2026-113648EPSS 0.3%

    ApostropheCMS is an open-source Node.js content management system. Prior to 3.7.1 of the import-export module, the API endpoint POST /api/v1/@apostrophecms/import-export/clean-export in @apostrophecms/import-export lacks authentication and…

  17. 4.3CVE-2026-112957EPSS 0.3%

    ApostropheCMS is an open-source Node.js content management system. Prior to 4.34.0, the getOne REST endpoint for pages does not apply viewRole type-level restrictions or viewPermission field-level redaction. An editor-level user who knows …

  18. 6.9CVE-2026-94023EPSS 0.1%

    A ThreadX module reaches a kernel object's delete service through the Module Manager's dispatch layer, which asked one question about the pointer: does the object lie outside the module's own code and data. That is the policy for *using* a…

  19. 8.1CVE-2026-90800EPSS 0.6%

    Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed syst…

  20. 5.3CVE-2026-113677EPSS 0.4%

    Froxlor from 0.10.0 before 2.3.15 contains a missing authorization vulnerability in the SubDomains.delete API command that allows authenticated customers to delete reseller-provisioned main domains by supplying a main domain id. Attackers …

  21. 5.3CVE-2026-113612EPSS 0.4%

    SparkyFitness before 0.17.0 contains a missing authorization vulnerability that allows authenticated users to delete other users' food variants via the DELETE /api/foods/food-variants/:id endpoint. Attackers can use variant IDs from public…

  22. 5.3CVE-2026-113601EPSS 0.3%

    Memos before 0.27.0 contains a missing authorization vulnerability in the ActivityService ListActivities and GetActivity API methods that allows authenticated users to view all users' activity records. Low-privileged attackers can enumerat…

  23. 5.3CVE-2026-113595EPSS 0.3%

    Sharkord before 0.0.26 contains a missing authorization vulnerability in the others.changeLogo tRPC mutation that allows any authenticated member to modify the server logo without the MANAGE_SETTINGS permission. Attackers can remove the cu…

  24. 5.3CVE-2026-113594EPSS 0.3%

    Sharkord before 0.0.8 contains a missing authorization vulnerability that allows any authenticated member to change server-wide settings by calling the others.updateSettings tRPC mutation without the MANAGE_SETTINGS permission. Attackers c…

  25. 5.3CVE-2026-112829EPSS 0.3%

    Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.30.

  26. 5.3CVE-2026-112824EPSS 0.3%

    Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation bus-ticket-booking-with-seat-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bus Ticket …

  27. 4.3CVE-2026-112823EPSS 0.2%

    Missing Authorization vulnerability in WP User Manager WP User Manager wp-user-manager allows Manipulating User State.This issue affects WP User Manager: from n/a through 2.9.25.

  28. 7.5CVE-2026-111764EPSS 0.6%

    A2A Java SDK is the official Java SDK for the Agent2Agent (A2A) Protocol. Prior to 1.3.0.Final, the default InMemoryTaskStore configuration performs no authorization on task reads: the no-argument constructor sets authorizationProvider to …

  29. 6.5CVE-2026-109700EPSS 0.3%

    Missing Authorization vulnerability in eLightUp Meta Box – WordPress Custom Fields Framework meta-box allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Meta Box – WordPress Custom Fields Framework: …

  30. 5.3CVE-2026-112834EPSS 0.3%

    Missing Authorization vulnerability in Castos Seriously Simple Podcasting seriously-simple-podcasting allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Seriously Simple Podcasting: from n/a through …

  31. 9.3CVE-2026-9589EPSS 0.4%

    Missing authorization in the configuration cascade operations of the Collaboration Server in Unblu inc. Unblu Spark 7.0 through 8.36.1-hotfix.0, on on-premises and cloud deployments, allows an authenticated remote attacker to read and chan…

  32. 5.3CVE-2026-112787EPSS 0.3%

    OpenCATS before 0.10.0 contains a missing authorization vulnerability in ReportsUI::handleRequest() that allows authenticated users to view EEO demographic reports without the canSeeEEOInfo permission. Attackers can invoke the customizeEEO…

  33. 5.3CVE-2026-112786EPSS 0.3%

    OpenCATS before 0.10.0 contains a missing authorization vulnerability in ImportUI::handleRequest() that allows low-privileged authenticated users to roll back data imports. Attackers with READ-level access can request the import module's r…

  34. 5.3CVE-2026-112785EPSS 0.3%

    OpenCATS before 0.10.0 contains a missing authorization vulnerability that allows READ-level users to create, rename, delete, and populate saved lists via AJAX endpoints. Authenticated attackers can send requests to newList.php, editListNa…

  35. 5.3CVE-2026-112784EPSS 0.2%

    OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/testEmailSettings.php that allows any authenticated user to send mail through the configured SMTP relay. Read-level users can supply testEmailAddress and fromAdd…

  36. 5.3CVE-2026-112783EPSS 0.3%

    OpenCATS before 0.10.0 contains a missing authorization vulnerability in ajax/deleteActivity.php and ajax/editActivity.php that allows READ-level users to edit and delete activity entries. Authenticated attackers can supply an arbitrary ac…

  37. 6.9CVE-2026-113468EPSS 0.4%

    The payment notification endpoint for PayPal accepts incoming data without verifying that it comes from the payment provider. Any site visitor can overwrite the stored payment notification of an order that is still awaiting payment with ar…

  38. 7.2CVE-2026-112239EPSS 0.4%

    The extension provides a backend endpoint that writes a submitted value into a submitted field of a submitted page record. It neither checks the user's permissions nor limits which fields can be changed. Any authenticated backend user can …

  39. 6.9CVE-2026-112071EPSS 0.4%

    The order cancellation function accepts an order identifier from the request and acts on that order without checking that the caller owns it. Any site visitor can set orders that are still awaiting payment to "canceled". This requires a pa…

  40. 5.3CVE-2026-112070EPSS 0.3%

    The AJAX routes of the extension do not check whether a backend user has access to the related module or dashboard widget. Any backend user can therefore retrieve analytics data of the sites they have page access to.

  41. 6.3CVE-2026-112069EPSS 0.5%

    The extension no longer applied its access protection to files in file storages that use a non-default relative base path. These files were served directly by the web server, without any authentication or permission check. The issue is onl…

  42. 7.1CVE-2026-112066EPSS 0.4%

    The JSON import of the cookie consent configuration did not respect the backend user's permissions. Non-admin backend users with access to the module could import a configuration that adds arbitrary scripts to the frontend of the website.

  43. 5.3CVE-2026-112065EPSS 0.3%

    The routes that provide consent history and statistics data did not check whether the backend user had access to the module or to the requested page. Any authenticated backend user, regardless of permissions, could therefore retrieve conse…

  44. 5.5CVE-2026-86955EPSS 0.1%

    An authorization issue was addressed with improved state management. This issue is fixed in iOS 27 and iPadOS 27. An app may be able to access sensitive user data.

  45. 5.5CVE-2026-86932EPSS 0.1%

    An authorization issue was addressed with improved state management. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.

  46. 4.4CVE-2026-86907EPSS 0.1%

    An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Sequoia 15.8, macOS Tahoe 26.7. An app with admin privileges may be able to modify the System Keychain.

  47. 9.3CVE-2026-77930EPSS 0.7%

    EvoScientist 0.1.0 before 0.2.5 contains an approval bypass vulnerability that allows attackers to run host shell commands by delegating them to async sub-agents lacking an interrupt_on gate. Attackers can plant instructions in ingested co…

  48. 5.5CVE-2026-28850EPSS 0.1%

    An authorization issue was addressed with improved state management. This issue is fixed in macOS Sequoia 15.8, visionOS 27. An app may be able to access sensitive user data.

  49. 9.3CVE-2026-109444EPSS 0.7%

    OpenSRE through 0.1.2026.10.19 contains an approval gate bypass vulnerability that allows attackers to execute shell_run commands without confirmation because the headless presenter's execution_allowed() always returns True. Attackers can …

  50. 6.4CVE-2026-112778EPSS 0.2%

    Traefik before 2.11.46, 3.x before 3.6.17, and 3.7.0 lack namespace validation for Ingress and Service annotations in the Kubernetes Ingress provider, allowing references to Middlewares, ServersTransports, and TLSOptions in other namespace…