CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,923)
page 148 of 547| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-82195 | Med | 0.42 | 6.5 | 0.00 | Sep 24, 2026 | The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator… | ||
| CVE-2026-95527 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions. | ||
| CVE-2026-94498 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions. | ||
| CVE-2026-93620 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions. | ||
| CVE-2026-93529 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions. | ||
| CVE-2026-86867 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in `libs/ktem/ktem/pages/chat/control.py` that load a… | ||
| CVE-2026-95846 | Hig | 0.42 | 7.5 | 0.00 | Sep 23, 2026 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client… | ||
| CVE-2026-18179 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization. | ||
| CVE-2026-6831 | Med | 0.42 | 6.5 | 0.00 | Sep 23, 2026 | The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated… | ||
| CVE-2026-18156 | Med | 0.42 | 6.5 | 0.00 | Sep 22, 2026 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization. | ||
| CVE-2026-18132 | Med | 0.42 | 6.5 | 0.00 | Sep 22, 2026 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization. | ||
| CVE-2026-93344 | Med | 0.42 | 6.5 | 0.00 | Sep 22, 2026 | MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by… | ||
| CVE-2026-93343 | Med | 0.42 | 6.5 | 0.00 | Sep 22, 2026 | MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_vendors_ajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory by sending a crafted… | ||
| CVE-2026-94001 | Med | 0.42 | 6.5 | 0.00 | Sep 19, 2026 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be… | ||
| CVE-2026-89334 | Med | 0.42 | 6.5 | 0.01 | Sep 19, 2026 | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an… | ||
| CVE-2026-15760 | Med | 0.42 | 6.5 | 0.00 | Sep 19, 2026 | The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The handlers only conditionally verify a nonce (the check runs solely when… | ||
| CVE-2026-85058 | Hig | 0.42 | 7.5 | 0.00 | Sep 18, 2026 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and… | ||
| CVE-2026-93455 | Med | 0.42 | 6.5 | 0.00 | Sep 18, 2026 | django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access… | ||
| CVE-2026-92794 | Hig | 0.42 | 7.5 | 0.01 | Sep 16, 2026 | OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers'… | ||
| CVE-2026-82561 | Med | 0.42 | 6.5 | 0.00 | Sep 16, 2026 | Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for… |
- risk 0.42cvss 6.5epss 0.00
The 10Web Booster WordPress plugin before 2.34.0 does not restrict access to the routine which issues the shared secret that authenticates its cloud connection, disclosing that secret to unauthenticated visitors and letting them delete it repeatedly, preventing an administrator…
- risk 0.42cvss 6.5epss 0.00
Unauthenticated Broken Access Control in Conekta Payment Gateway <= 6.2.4 versions.
- risk 0.42cvss 6.5epss 0.00
Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.
- risk 0.42cvss 6.5epss 0.00
Unauthenticated Broken Access Control in PayPlus Payment Gateway <= 8.2.5 versions.
- risk 0.42cvss 6.5epss 0.00
Contributor Broken Access Control in WSP MCP – AI Agents Connector <= 2.7.0 versions.
- risk 0.42cvss 6.5epss 0.00
Cinnamon's Kotaemon (all versions up to and including v0.12.0) multi-user chat interface contains multiple vulnerabilities due to incorrect authorization and improper access controls. There are four handler methods in `libs/ktem/ktem/pages/chat/control.py` that load a…
- risk 0.42cvss 7.5epss 0.00
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client's Last-Will message without applying the canWrite authorization and reserved-topic checks used for a normal PUBLISH. A client can configure a Will for a topic that the client…
- risk 0.42cvss 6.5epss 0.00
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote attacker to clear active chat sessions due to improper authorization.
- risk 0.42cvss 6.5epss 0.00
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to missing authorization in all versions up to, and including, 2.0.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for authenticated…
- risk 0.42cvss 6.5epss 0.00
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities due to improper authorization.
- risk 0.42cvss 6.5epss 0.00
IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due to missing authorization.
- risk 0.42cvss 6.5epss 0.00
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authenticated attackers with subscriber-level access or higher to access arbitrary vendor administrator panel pages by…
- risk 0.42cvss 6.5epss 0.00
MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_vendors_ajax AJAX action that allows authenticated attackers with subscriber-level access or higher to retrieve the complete vendor directory by sending a crafted…
- risk 0.42cvss 6.5epss 0.00
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials does not correctly check for fine-grained reset-password permissions. This allows a delegated administrator, who should be…
- risk 0.42cvss 6.5epss 0.01
The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.15.33. This is due to the plugin not properly verifying that a user is authorized to perform an…
- risk 0.42cvss 6.5epss 0.00
The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tables and dnxte_get_database_data AJAX actions. The handlers only conditionally verify a nonce (the check runs solely when…
- risk 0.42cvss 7.5epss 0.00
Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers without invoking the authorizator.canWrite check used by normal PUBLISH paths. When anonymous access is enabled and…
- risk 0.42cvss 6.5epss 0.00
django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and stored media paths. Attackers with low-privilege staff credentials can enumerate content identifiers and access…
- risk 0.42cvss 7.5epss 0.01
OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supply a document identifier from guest signing links to retrieve complete document details including all signers'…
- risk 0.42cvss 6.5epss 0.00
Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering Process Group flow replacement together with versioned flow update and rebase operations. Framework authorization for…