CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,924)
page 218 of 547| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-96334 | Med | 0.36 | 5.6 | 0.00 | Oct 9, 2026 | Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.7. | ||
| CVE-2026-47604 | Med | 0.36 | 5.5 | 0.00 | Sep 30, 2026 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information… | ||
| CVE-2026-47603 | Med | 0.36 | 5.5 | 0.00 | Sep 30, 2026 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information… | ||
| CVE-2026-47492 | Med | 0.36 | 5.5 | 0.00 | Sep 30, 2026 | NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper access control. A successful exploit of this vulnerability might lead to denial of service. | ||
| CVE-2026-94215 | Med | 0.36 | 5.5 | 0.00 | Sep 21, 2026 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm… | ||
| CVE-2026-86897 | Med | 0.36 | 5.5 | 0.00 | Sep 14, 2026 | This issue was addressed with additional entitlement checks. This issue is fixed in Safari 27, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to access sensitive user data. | ||
| CVE-2026-84569 | Med | 0.36 | 5.5 | 0.00 | Sep 14, 2026 | An access issue was addressed with additional sandbox restrictions on the system pasteboards. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data. | ||
| CVE-2026-84514 | Med | 0.36 | 5.5 | 0.00 | Sep 14, 2026 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to modify protected parts of the file system. | ||
| CVE-2026-8304 | Med | 0.36 | 5.5 | 0.00 | Sep 11, 2026 | Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus About: from 1.2.1 before 1.2.5. | ||
| CVE-2026-86815 | Med | 0.36 | 5.5 | 0.00 | Sep 11, 2026 | The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited… | ||
| CVE-2026-87552 | Med | 0.36 | 5.5 | 0.00 | Sep 9, 2026 | Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High) | ||
| CVE-2026-72966 | Med | 0.36 | 5.5 | 0.00 | Sep 8, 2026 | Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally. | ||
| CVE-2026-69453 | Med | 0.36 | 5.5 | 0.00 | Sep 8, 2026 | Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally. | ||
| CVE-2026-69403 | Med | 0.36 | 5.5 | 0.00 | Sep 8, 2026 | Missing authorization in Windows SMB Server allows an authorized attacker to disclose information locally. | ||
| CVE-2026-61936 | Med | 0.36 | 5.5 | 0.00 | Aug 11, 2026 | Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally. | ||
| CVE-2026-15248 | Med | 0.36 | 5.5 | 0.00 | Aug 2, 2026 | The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users. | ||
| CVE-2026-18201 | Med | 0.36 | 5.5 | 0.00 | Jul 29, 2026 | Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions… | ||
| CVE-2026-44918 | Med | 0.36 | 5.5 | 0.00 | Jul 10, 2026 | OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization. | ||
| CVE-2026-28573 | Med | 0.36 | 5.5 | 0.00 | Jun 18, 2026 | In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation. | ||
| CVE-2026-40722 | Med | 0.36 | 5.5 | 0.00 | Jun 17, 2026 | Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Yoast SEO Premium: from n/a through 26.6. |
- risk 0.36cvss 5.6epss 0.00
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.7.
- risk 0.36cvss 5.5epss 0.00
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information…
- risk 0.36cvss 5.5epss 0.00
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode driver where a local user may access another process's GPU channel state due to missing authorization checks. A successful exploit of this vulnerability might lead to information…
- risk 0.36cvss 5.5epss 0.00
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where an attacker can cause improper access control. A successful exploit of this vulnerability might lead to denial of service.
- risk 0.36cvss 5.5epss 0.00
A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request in-memory cache to resolve clients by their unique identifier without verifying if the client belongs to the realm…
- risk 0.36cvss 5.5epss 0.00
This issue was addressed with additional entitlement checks. This issue is fixed in Safari 27, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. An app may be able to access sensitive user data.
- risk 0.36cvss 5.5epss 0.00
An access issue was addressed with additional sandbox restrictions on the system pasteboards. This issue is fixed in macOS Golden Gate 27. An app may be able to access sensitive user data.
- risk 0.36cvss 5.5epss 0.00
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to modify protected parts of the file system.
- risk 0.36cvss 5.5epss 0.00
Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Pardus About: from 1.2.1 before 1.2.5.
- risk 0.36cvss 5.5epss 0.00
The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-execution management, allowing users holding a BackWPup WordPress plugin before 5.7.5-defined, administrator-assigned limited…
- risk 0.36cvss 5.5epss 0.00
Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information via a co-installed app. (Chromium security severity: High)
- risk 0.36cvss 5.5epss 0.00
Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally.
- risk 0.36cvss 5.5epss 0.00
Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally.
- risk 0.36cvss 5.5epss 0.00
Missing authorization in Windows SMB Server allows an authorized attacker to disclose information locally.
- risk 0.36cvss 5.5epss 0.00
Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally.
- risk 0.36cvss 5.5epss 0.00
The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with a low-privilege role such as Contributor to permanently delete arbitrary media attachments belonging to other users.
- risk 0.36cvss 5.5epss 0.00
Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permission to manage identity providers could link a new provider to an organization without having the required permissions…
- risk 0.36cvss 5.5epss 0.00
OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization.
- risk 0.36cvss 5.5epss 0.00
In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no additional execution privileges needed. User interaction is not needed for exploitation.
- risk 0.36cvss 5.5epss 0.00
Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Yoast SEO Premium: from n/a through 26.6.