CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,923)
page 146 of 547| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-106312 | Med | 0.42 | 6.5 | 0.00 | Oct 6, 2026 | Missing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low) | ||
| CVE-2026-106289 | Med | 0.42 | 6.5 | 0.00 | Oct 6, 2026 | Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium) | ||
| CVE-2026-106267 | Med | 0.42 | 6.5 | 0.00 | Oct 6, 2026 | Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium) | ||
| CVE-2026-105852 | Hig | 0.42 | 7.5 | 0.00 | Oct 6, 2026 | Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by… | ||
| CVE-2026-42637 | Med | 0.42 | 6.5 | 0.00 | Oct 6, 2026 | Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions. | ||
| CVE-2026-39798 | Med | 0.42 | 6.5 | 0.00 | Oct 6, 2026 | Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions. | ||
| CVE-2026-39787 | Med | 0.42 | 6.5 | 0.00 | Oct 6, 2026 | Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions. | ||
| CVE-2026-39762 | Med | 0.42 | 6.5 | 0.00 | Oct 6, 2026 | Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from… | ||
| CVE-2026-39749 | Med | 0.42 | 6.5 | 0.00 | Oct 6, 2026 | Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions. | ||
| CVE-2026-105059 | Med | 0.42 | 6.5 | 0.00 | Oct 6, 2026 | Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress: from n/a through 7.1. | ||
| CVE-2026-32582 | Med | 0.42 | 6.5 | 0.00 | Oct 6, 2026 | Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IATO MCP: from n/a through 1.12.0. | ||
| CVE-2026-103337 | Med | 0.42 | 6.5 | 0.00 | Oct 5, 2026 | Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2. | ||
| CVE-2026-97304 | Med | 0.42 | 6.5 | 0.00 | Oct 5, 2026 | Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63. | ||
| CVE-2026-102383 | Med | 0.42 | 6.5 | 0.00 | Oct 5, 2026 | Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14. | ||
| CVE-2026-104386 | Med | 0.42 | 6.5 | 0.00 | Oct 5, 2026 | Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3. | ||
| CVE-2026-105306 | Med | 0.42 | 6.5 | 0.00 | Oct 5, 2026 | A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial… | ||
| CVE-2026-93428 | Hig | 0.42 | 7.5 | 0.01 | Oct 3, 2026 | The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a… | ||
| CVE-2026-96613 | Med | 0.42 | 6.5 | 0.00 | Oct 2, 2026 | The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner… | ||
| CVE-2026-39439 | Med | 0.42 | 6.5 | 0.00 | Oct 2, 2026 | Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebSamurai: from n/a through 1.0.7. | ||
| CVE-2026-32585 | Med | 0.42 | 6.5 | 0.00 | Oct 2, 2026 | Missing Authorization vulnerability in airano Airano MCP Bridge airano-mcp-bridge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Airano MCP Bridge: from n/a through 2.11.0. |
- risk 0.42cvss 6.5epss 0.00
Missing authorization in SignIn in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social engineering to obtain sensitive information via a crafted Chrome extension. (Chromium security severity: Low)
- risk 0.42cvss 6.5epss 0.00
Missing authorization in FedCM in Google Chrome prior to 155.0.8059.39 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium security severity: Medium)
- risk 0.42cvss 6.5epss 0.00
Missing authorization in Network in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)
- risk 0.42cvss 7.5epss 0.00
Payload is a free and open source headless content management system. In versions before 3.90.0 and canary versions before 4.0.0-canary.34, querying a readable collection with a relationship to another collection can expose information about related documents protected by…
- risk 0.42cvss 6.5epss 0.00
Unauthenticated Settings Change in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
- risk 0.42cvss 6.5epss 0.00
Unauthenticated Settings Change in TrueBooker <= 1.2.9 versions.
- risk 0.42cvss 6.5epss 0.00
Unauthenticated Broken Access Control in 10Web Social Photo Feed <= 1.4.35 versions.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products autoship-cloud allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Autoship Cloud for WooCommerce Subscription Products: from…
- risk 0.42cvss 6.5epss 0.00
Subscriber Broken Access Control in App for Cloudflare® <= 1.10.1 versions.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in royalnavneet Delete All Comments of wordpress delete-all-comments-of-website allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Delete All Comments of wordpress: from n/a through 7.1.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in iatoai IATO MCP iato-mcp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects IATO MCP: from n/a through 1.12.0.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in Kirillbdev WC Ukraine Shipping wc-ukr-shipping allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WC Ukraine Shipping: from n/a through 1.23.2.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in Arraytics Timetics timetics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Timetics: from n/a through 1.0.63.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in VillaTheme Lookzy woo-lookbook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Lookzy: from n/a through 1.1.14.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in WPFunnels Team WP VR wpvr allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP VR: from n/a through 9.1.3.
- risk 0.42cvss 6.5epss 0.00
A flaw was found in the Dynamic Client Registration flow of the Keycloak identity and access management server. The issue occurs because the registration process fails to filter security-sensitive client attributes when a new client is created. An attacker with a valid Initial…
- risk 0.42cvss 7.5epss 0.01
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly verifying that a…
- risk 0.42cvss 6.5epss 0.00
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to access the complete device shadow of any device by specifying its device ID. This vulnerability exposes sensitive information, such as device credentials, owner…
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in Kiera Howe WebSamurai websamurai allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WebSamurai: from n/a through 1.0.7.
- risk 0.42cvss 6.5epss 0.00
Missing Authorization vulnerability in airano Airano MCP Bridge airano-mcp-bridge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Airano MCP Bridge: from n/a through 2.11.0.