CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,923)
page 153 of 547| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-11801 | Hig | 0.42 | 7.5 | 0.02 | Aug 18, 2026 | The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for… | ||
| CVE-2026-75049 | Med | 0.42 | 6.5 | 0.00 | Aug 17, 2026 | In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint | ||
| CVE-2026-72825 | Hig | 0.42 | 7.6 | 0.00 | Aug 14, 2026 | The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enforces requirePermission('api.config.write') followed by a bare isSuperAdmin() check instead of… | ||
| CVE-2026-72681 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of… | ||
| CVE-2026-72664 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who holds only detection rule authoring privileges for the… | ||
| CVE-2026-72661 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability used by Elastic Defend endpoint response actions did not enforce the Security… | ||
| CVE-2026-58434 | Hig | 0.42 | 7.5 | 0.00 | Aug 13, 2026 | Private Repository Metadata Remains Accessible After Access Revocation | ||
| CVE-2026-66693 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Subscriber Broken Access Control in Motors <= 1.4.113 versions. | ||
| CVE-2026-66660 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions. | ||
| CVE-2026-66464 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions. | ||
| CVE-2026-66459 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions. | ||
| CVE-2026-66454 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions. | ||
| CVE-2026-61978 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions. | ||
| CVE-2026-28181 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions. | ||
| CVE-2026-28159 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions. | ||
| CVE-2026-27999 | Med | 0.42 | 6.5 | 0.00 | Aug 13, 2026 | Subscriber Broken Access Control in Tourfic <= 2.23.1 versions. | ||
| CVE-2026-68758 | Med | 0.42 | 6.5 | 0.00 | Aug 12, 2026 | A low-privileged authenticated user may access restricted support information under specific conditions. | ||
| CVE-2026-68754 | Med | 0.42 | 6.5 | 0.00 | Aug 12, 2026 | A repository publisher without delete permission may modify protected package content under specific conditions. | ||
| CVE-2026-18652 | Med | 0.42 | 6.5 | 0.00 | Aug 12, 2026 | Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied… | ||
| CVE-2026-73249 | Hig | 0.42 | 7.5 | 0.00 | Aug 11, 2026 | calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before… |
- risk 0.42cvss 7.5epss 0.02
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for…
- risk 0.42cvss 6.5epss 0.00
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoint
- risk 0.42cvss 7.6epss 0.00
The getgrav/grav-plugin-api plugin before 1.0.13 contains an API-key scope cap bypass in the POST /reports/twig-content/allowlist endpoint (ReportsController). The endpoint enforces requirePermission('api.config.write') followed by a bare isSuperAdmin() check instead of…
- risk 0.42cvss 6.5epss 0.00
Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to disclosure of…
- risk 0.42cvss 6.5epss 0.00
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who holds only detection rule authoring privileges for the…
- risk 0.42cvss 6.5epss 0.00
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability used by Elastic Defend endpoint response actions did not enforce the Security…
- risk 0.42cvss 7.5epss 0.00
Private Repository Metadata Remains Accessible After Access Revocation
- risk 0.42cvss 6.5epss 0.00
Subscriber Broken Access Control in Motors <= 1.4.113 versions.
- risk 0.42cvss 6.5epss 0.00
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.
- risk 0.42cvss 6.5epss 0.00
Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.
- risk 0.42cvss 6.5epss 0.00
Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.
- risk 0.42cvss 6.5epss 0.00
Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.
- risk 0.42cvss 6.5epss 0.00
Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.
- risk 0.42cvss 6.5epss 0.00
Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.
- risk 0.42cvss 6.5epss 0.00
Subscriber Broken Access Control in Service Finder Booking <= 6.2 versions.
- risk 0.42cvss 6.5epss 0.00
Subscriber Broken Access Control in Tourfic <= 2.23.1 versions.
- risk 0.42cvss 6.5epss 0.00
A low-privileged authenticated user may access restricted support information under specific conditions.
- risk 0.42cvss 6.5epss 0.00
A repository publisher without delete permission may modify protected package content under specific conditions.
- risk 0.42cvss 6.5epss 0.00
Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requested by the GUI is not correctly checked against the prefix deny list, allowing result sets to read from denied…
- risk 0.42cvss 7.5epss 0.00
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access() before…