CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,924)
page 217 of 547| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2024-0235 | Med | 0.37 | 5.3 | 0.38 | Jan 16, 2024 | The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog | ||
| CVE-2023-47870 | Med | 0.37 | 5.7 | 0.00 | Nov 30, 2023 | Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpForo Forum: from n/a… | ||
| CVE-2023-26510 | Med | 0.37 | 5.7 | 0.01 | Mar 5, 2023 | Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security policy in which a contributor's draft can only be read by editors until published by an editor. NOTE: the vendor's position is that this… | ||
| CVE-2023-22488 | Med | 0.37 | 6.8 | 0.00 | Jan 12, 2023 | Flarum is a forum software for building communities. Using the notifications feature, one can read restricted/private content and bypass access checks that would be in place for such content. The notification-sending component does not check that the subject of the notification… | ||
| CVE-2022-39960 | Med | 0.37 | 5.3 | 0.26 | Sep 17, 2022 | The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all groups from the Jira instance by making a groupexport_download=true request to a plugins/servlet/groupexportforjira/admin/… | ||
| CVE-2022-34212 | Med | 0.37 | 5.7 | 0.01 | Jun 23, 2022 | A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specified URL. | ||
| CVE-2021-25011 | Med | 0.37 | 5.7 | 0.00 | Feb 28, 2022 | The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings. | ||
| CVE-2020-13938 | Med | 0.37 | 5.5 | 0.12 | Jun 10, 2021 | Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows | ||
| CVE-2019-16097 | Med | 0.37 | 6.5 | 0.22 | Sep 8, 2019 | core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without… | ||
| CVE-2026-96926 | Med | 0.36 | 5.5 | 0.00 | Oct 13, 2026 | Missing authorization in DNS Server allows an authorized attacker to perform tampering locally. | ||
| CVE-2026-96855 | Med | 0.36 | 5.5 | 0.00 | Oct 13, 2026 | Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally. | ||
| CVE-2026-96316 | Med | 0.36 | 5.5 | 0.00 | Oct 13, 2026 | Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to perform tampering locally. | ||
| CVE-2026-96315 | Med | 0.36 | 5.5 | 0.00 | Oct 13, 2026 | Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally. | ||
| CVE-2026-96311 | Med | 0.36 | 5.5 | 0.00 | Oct 13, 2026 | Improper authorization in Windows Network List Service allows an authorized attacker to perform tampering locally. | ||
| CVE-2026-85938 | Med | 0.36 | 5.5 | 0.00 | Oct 13, 2026 | Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. | ||
| CVE-2026-83658 | Med | 0.36 | 5.5 | 0.00 | Oct 13, 2026 | Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally. | ||
| CVE-2026-70235 | Med | 0.36 | 5.5 | 0.00 | Oct 13, 2026 | Improper authentication in Windows Event Tracing allows an authorized attacker to perform spoofing locally. | ||
| CVE-2026-70085 | Med | 0.36 | 5.5 | 0.00 | Oct 13, 2026 | Missing authorization in DNS Server allows an authorized attacker to perform tampering locally. | ||
| CVE-2026-69905 | Med | 0.36 | 5.5 | 0.00 | Oct 13, 2026 | Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform tampering locally. | ||
| CVE-2026-103560 | Med | 0.36 | 5.5 | 0.00 | Oct 13, 2026 | Improper authorization in DNS Server allows an authorized attacker to perform tampering locally. |
- risk 0.37cvss 5.3epss 0.38
The EventON WordPress plugin before 4.5.5, EventON WordPress plugin before 2.2.7 do not have authorisation in an AJAX action, allowing unauthenticated users to retrieve email addresses of any users on the blog
- risk 0.37cvss 5.7epss 0.00
Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpForo Forum: from n/a…
- risk 0.37cvss 5.7epss 0.01
Ghost 5.35.0 allows authorization bypass: contributors can view draft posts of other users, which is arguably inconsistent with a security policy in which a contributor's draft can only be read by editors until published by an editor. NOTE: the vendor's position is that this…
- risk 0.37cvss 6.8epss 0.00
Flarum is a forum software for building communities. Using the notifications feature, one can read restricted/private content and bypass access checks that would be in place for such content. The notification-sending component does not check that the subject of the notification…
- risk 0.37cvss 5.3epss 0.26
The Netic Group Export add-on before 1.0.3 for Atlassian Jira does not perform authorization checks. This might allow an unauthenticated user to export all groups from the Jira instance by making a groupexport_download=true request to a plugins/servlet/groupexportforjira/admin/…
- risk 0.37cvss 5.7epss 0.01
A missing permission check in Jenkins vRealize Orchestrator Plugin 3.0 and earlier allows attackers with Overall/Read permission to send an HTTP POST request to an attacker-specified URL.
- risk 0.37cvss 5.7epss 0.00
The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscriber to delete arbitrary posts and update the plugin's settings.
- risk 0.37cvss 5.5epss 0.12
Apache HTTP Server versions 2.4.0 to 2.4.46 Unprivileged local users can stop httpd on Windows
- risk 0.37cvss 6.5epss 0.22
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without…
- risk 0.36cvss 5.5epss 0.00
Missing authorization in DNS Server allows an authorized attacker to perform tampering locally.
- risk 0.36cvss 5.5epss 0.00
Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
- risk 0.36cvss 5.5epss 0.00
Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to perform tampering locally.
- risk 0.36cvss 5.5epss 0.00
Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally.
- risk 0.36cvss 5.5epss 0.00
Improper authorization in Windows Network List Service allows an authorized attacker to perform tampering locally.
- risk 0.36cvss 5.5epss 0.00
Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Improper authentication in Windows Event Tracing allows an authorized attacker to perform spoofing locally.
- risk 0.36cvss 5.5epss 0.00
Missing authorization in DNS Server allows an authorized attacker to perform tampering locally.
- risk 0.36cvss 5.5epss 0.00
Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform tampering locally.
- risk 0.36cvss 5.5epss 0.00
Improper authorization in DNS Server allows an authorized attacker to perform tampering locally.