CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,032)
page 196 of 502| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2019-16097 | Med | 0.37 | 6.5 | 0.22 | Sep 8, 2019 | core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without… | ||
| CVE-2026-94215 | Med | 0.36 | 5.5 | — | Sep 21, 2026 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm… | ||
| CVE-2026-86897 | Med | 0.36 | 5.5 | 0.00 | Sep 14, 2026 | This issue was addressed with additional entitlement checks. This issue is fixed in Safari 27, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to access sensitive user data. | ||
| CVE-2026-84569 | Med | 0.36 | 5.5 | 0.00 | Sep 14, 2026 | An access issue was addressed with additional sandbox restrictions on the system pasteboards. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data. | ||
| CVE-2026-84514 | Med | 0.36 | 5.5 | 0.00 | Sep 14, 2026 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to modify protected parts of the file system. | ||
| CVE-2026-8304 | Med | 0.36 | 5.5 | 0.00 | Sep 11, 2026 | Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus About: from 1.2.1 before 1.2.5. | ||
| CVE-2026-86815 | Med | 0.36 | 5.5 | 0.00 | Sep 11, 2026 | The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited… | ||
| CVE-2026-87552 | Med | 0.36 | 5.5 | 0.00 | Sep 9, 2026 | Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High) | ||
| CVE-2026-72966 | Med | 0.36 | 5.5 | 0.00 | Sep 8, 2026 | Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally. | ||
| CVE-2026-69453 | Med | 0.36 | 5.5 | 0.00 | Sep 8, 2026 | Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally. | ||
| CVE-2026-69403 | Med | 0.36 | 5.5 | 0.00 | Sep 8, 2026 | Missing authorization in Windows SMB Server allows an authorized attacker to disclose information locally. | ||
| CVE-2026-61936 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally. | ||
| CVE-2026-15248 | Med | 0.36 | 5.5 | 0.00 | Aug 2, 2026 | The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users. | ||
| CVE-2026-18201 | Med | 0.36 | 5.5 | 0.00 | Jul 29, 2026 | Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions… | ||
| CVE-2026-44918 | Med | 0.36 | 5.5 | 0.00 | Jul 10, 2026 | OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization. | ||
| CVE-2026-28573 | Med | 0.36 | 5.5 | 0.00 | Jun 18, 2026 | In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||
| CVE-2026-40722 | Med | 0.36 | 5.5 | 0.00 | Jun 17, 2026 | Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Yoast SEO Premium: from n/a through 26.6. | ||
| CVE-2026-28587 | Med | 0.36 | 5.5 | 0.00 | Jun 17, 2026 | In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. | ||
| CVE-2026-53820 | Med | 0.36 | 6.6 | 0.00 | Jun 12, 2026 | OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path that allows authenticated callers to bypass intended command restrictions. Attackers can reach the affected bundled MCP session-spawn path to start sessions… | ||
| CVE-2026-53818 | Med | 0.36 | 6.6 | 0.00 | Jun 11, 2026 | OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to skip owner-only tool policies and before-tool-call hooks. Attackers can invoke owner-only behavior through the affected loopback path to execute… |
- risk 0.37cvss 6.5epss 0.22
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without…
- risk 0.36cvss 5.5epss —
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm…
- risk 0.36cvss 5.5epss 0.00
This issue was addressed with additional entitlement checks. This issue is fixed in Safari 27, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to access sensitive user data.
- risk 0.36cvss 5.5epss 0.00
An access issue was addressed with additional sandbox restrictions on the system pasteboards. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.
- risk 0.36cvss 5.5epss 0.00
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to modify protected parts of the file system.
- risk 0.36cvss 5.5epss 0.00
Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus About: from 1.2.1 before 1.2.5.
- risk 0.36cvss 5.5epss 0.00
The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited…
- risk 0.36cvss 5.5epss 0.00
Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High)
- risk 0.36cvss 5.5epss 0.00
Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally.
- risk 0.36cvss 5.5epss 0.00
Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.
- risk 0.36cvss 5.5epss 0.00
Missing authorization in Windows SMB Server allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally.
- risk 0.36cvss 5.5epss 0.00
The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users.
- risk 0.36cvss 5.5epss 0.00
Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions…
- risk 0.36cvss 5.5epss 0.00
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.
- risk 0.36cvss 5.5epss 0.00
In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- risk 0.36cvss 5.5epss 0.00
Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Yoast SEO Premium: from n/a through 26.6.
- risk 0.36cvss 5.5epss 0.00
In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
- risk 0.36cvss 6.6epss 0.00
OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path that allows authenticated callers to bypass intended command restrictions. Attackers can reach the affected bundled MCP session-spawn path to start sessions…
- risk 0.36cvss 6.6epss 0.00
OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to skip owner-only tool policies and before-tool-call hooks. Attackers can invoke owner-only behavior through the affected loopback path to execute…