CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,923)
page 119 of 547| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-84315 | Hig | 0.47 | 8.3 | 0.00 | Oct 12, 2026 | Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen… | ||
| CVE-2026-109201 | Hig | 0.47 | 8.3 | 0.00 | Oct 12, 2026 | LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink,… | ||
| CVE-2026-62118 | Hig | 0.47 | 7.3 | 0.00 | Oct 10, 2026 | Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions. | ||
| CVE-2026-105849 | Hig | 0.47 | 8.3 | 0.00 | Oct 6, 2026 | Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API… | ||
| CVE-2026-95526 | Hig | 0.47 | 7.3 | 0.00 | Oct 6, 2026 | Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions. | ||
| CVE-2026-104406 | Hig | 0.47 | 7.3 | 0.00 | Oct 6, 2026 | Unauthenticated Broken Access Control in picu <= 3.10.1 versions. | ||
| CVE-2026-104387 | Hig | 0.47 | 7.2 | 0.00 | Oct 6, 2026 | Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions. | ||
| CVE-2026-102779 | Hig | 0.47 | 7.3 | 0.00 | Oct 5, 2026 | Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token… | ||
| CVE-2026-103490 | Hig | 0.47 | 7.2 | 0.00 | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links | ||
| CVE-2026-76143 | Hig | 0.47 | — | 0.00 | Oct 1, 2026 | A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter. | ||
| CVE-2026-47580 | Hig | 0.47 | 7.3 | 0.00 | Sep 30, 2026 | NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization issue. A successful exploit of this vulnerability might lead to information disclosure and data tampering. | ||
| CVE-2026-102249 | — | Hig | 0.47 | 7.3 | 0.00 | Sep 29, 2026 | A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argument url/fileKey results in missing authorization. It is possible to launch the attack remotely. The exploit… | |
| CVE-2026-96896 | Hig | 0.47 | 7.2 | 0.00 | Sep 27, 2026 | The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's… | ||
| CVE-2026-100608 | Hig | 0.47 | 8.3 | 0.00 | Sep 26, 2026 | Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode (MODE=queue, ENABLE_BULLMQ_DASHBOARD=true, and !isCloud()), the /admin/queues mount is protected only by the… | ||
| CVE-2026-96603 | Hig | 0.47 | 7.3 | 0.00 | Sep 23, 2026 | A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_logged_in/confirm_user of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be… | ||
| CVE-2026-17618 | Hig | 0.47 | 7.3 | 0.00 | Sep 22, 2026 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization. | ||
| CVE-2026-94496 | Hig | 0.47 | 8.3 | 0.00 | Sep 21, 2026 | jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to… | ||
| CVE-2026-63199 | Hig | 0.47 | — | 0.00 | Sep 18, 2026 | Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for… | ||
| CVE-2026-17526 | Hig | 0.47 | 7.2 | 0.00 | Sep 16, 2026 | Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability… | ||
| CVE-2026-57112 | Hig | 0.47 | 8.3 | 0.00 | Sep 15, 2026 | PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without… |
- risk 0.47cvss 8.3epss 0.00
Nginx UI is a web user interface for the Nginx web server. Prior to 2.4.1, Nginx UI does not apply RequireSecureSession to multiple authenticated mutation routes even though OTP-enabled users are expected to present a fresh X-Secure-Session-ID for sensitive actions. A stolen…
- risk 0.47cvss 8.3epss 0.00
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in SoapDocumentService operations that allows authenticated users to access and modify unauthorized documents. Attackers can call copy, getExtractedText, deleteVersion, reindex, deleteLink,…
- risk 0.47cvss 7.3epss 0.00
Unauthenticated Broken Access Control in Barcode Scanner with Inventory & Order Manager <= 1.13.1 versions.
- risk 0.47cvss 8.3epss 0.00
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can obtain active API…
- risk 0.47cvss 7.3epss 0.00
Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.
- risk 0.47cvss 7.3epss 0.00
Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
- risk 0.47cvss 7.2epss 0.00
Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
- risk 0.47cvss 7.3epss 0.00
Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4 - The extension exposes the site task `records.custom_action` without authentication, ACL, CSRF, task-trigger, content-binding, or cron-token…
- risk 0.47cvss 7.2epss 0.00
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
- risk 0.47cvss —epss 0.00
A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter.
- risk 0.47cvss 7.3epss 0.00
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a missing authorization issue. A successful exploit of this vulnerability might lead to information disclosure and data tampering.
- risk 0.47cvss 7.3epss 0.00
A security flaw has been discovered in REBUILD up to 4.4.11. This vulnerability affects unknown code of the file /commons/file-editor-save. The manipulation of the argument url/fileKey results in missing authorization. It is possible to launch the attack remotely. The exploit…
- risk 0.47cvss 7.2epss 0.00
The Malcure Malware Shield — Removal, Repair, Monitor WordPress plugin before 19.9.7 does not perform an authorisation check on one of its AJAX actions, allowing users with a subsite administrator role on a multisite network to write and delete arbitrary files in the network's…
- risk 0.47cvss 8.3epss 0.00
Flowise through 3.1.4 does not enforce authorization on the BullMQ admin dashboard. When the server runs in queue mode with the dashboard enabled and not in cloud mode (MODE=queue, ENABLE_BULLMQ_DASHBOARD=true, and !isCloud()), the /admin/queues mount is protected only by the…
- risk 0.47cvss 7.3epss 0.00
A vulnerability has been found in Abdurrab5 online-makeup-store. Affected is the function confirm_logged_in/confirm_user of the file functions.php of the component Admin Handler. Such manipulation of the argument adminid leads to missing authorization. The attack may be…
- risk 0.47cvss 7.3epss 0.00
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a denial of service due to improper authorization.
- risk 0.47cvss 8.3epss 0.00
jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete roles. Attackers can exploit the /role/update and /role/delete endpoints to escalate privileges, change data visibility to…
- risk 0.47cvss —epss 0.00
Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasource proxy paths authorize the caller on a Datasource or GlobalDatasource scope but do not require read permission for…
- risk 0.47cvss 7.2epss 0.00
Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a realm administrator. This allows the attacker to gain full administrative control over the realm, including the ability…
- risk 0.47cvss 8.3epss 0.00
PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-agents/praisonaiagents/mcp/mcp_server.py mounts SseServerTransport on the legacy /sse and /messages/ endpoints without…