CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,924)
page 239 of 547| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-102985 | Med | 0.35 | 6.5 | 0.00 | Oct 14, 2026 | Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's is_active field, including… | ||
| CVE-2026-100404 | Med | 0.35 | 6.5 | 0.00 | Oct 14, 2026 | Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages… | ||
| CVE-2026-110629 | Med | 0.35 | 6.5 | 0.01 | Oct 14, 2026 | VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or… | ||
| CVE-2026-103907 | Med | 0.35 | 6.5 | 0.00 | Oct 14, 2026 | The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to, and including, 3.2.19. The 'wp_ajax_jkit_post_block' handler… | ||
| CVE-2026-109699 | Med | 0.35 | 5.4 | 0.00 | Oct 13, 2026 | Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8. | ||
| CVE-2026-109696 | Med | 0.35 | 5.4 | 0.00 | Oct 13, 2026 | Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.1.0. | ||
| CVE-2026-109672 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role… | ||
| CVE-2026-109666 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond… | ||
| CVE-2026-109661 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to… | ||
| CVE-2026-109660 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond… | ||
| CVE-2026-109659 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits. | ||
| CVE-2026-109658 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their… | ||
| CVE-2026-109656 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read… | ||
| CVE-2026-109655 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory… | ||
| CVE-2026-109650 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what… | ||
| CVE-2026-109645 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their… | ||
| CVE-2026-109644 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation… | ||
| CVE-2026-109643 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond… | ||
| CVE-2026-109641 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when… | ||
| CVE-2026-109637 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to… |
- risk 0.35cvss 6.5epss 0.00
Plane is an open-source project management tool. In 1.3.1 and earlier, ProjectMemberViewSet.partial_update places its authorization checks inside the role update branch, so a guest or member can omit role and change another ProjectMember record's is_active field, including…
- risk 0.35cvss 6.5epss 0.00
Zulip is an open-source team collaboration tool. In Zulip Server versions through 12.1, guest users can receive new message events for public channels outside their subscriptions. A guest can trigger the issue by registering an event queue with parameters that request messages…
- risk 0.35cvss 6.5epss 0.01
VentureDrake Laravel CRM before 2.4.0 contains a missing authorization vulnerability that allows authenticated users to bypass Spatie role permissions through Livewire action methods. Read-only users can invoke delete, won, lost or reopen methods on components like DealIndex, or…
- risk 0.35cvss 6.5epss 0.00
The JNews - Jeg Elementor Kit plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on both the 'jkit_post_block' and 'jeg_find_author' AJAX actions in versions up to, and including, 3.2.19. The 'wp_ajax_jkit_post_block' handler…
- risk 0.35cvss 5.4epss 0.00
Missing Authorization vulnerability in ThemeGrill User Registration user-registration allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects User Registration: from n/a through 5.2.8.
- risk 0.35cvss 5.4epss 0.00
Missing Authorization vulnerability in WP ManageNinja LLC FluentBoards fluent-boards allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentBoards: from n/a through 2.1.0.
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.118.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated users can query these endpoints to read financial data beyond what their assigned role…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks on inventory records. Authenticated users can send requests to these endpoints to modify inventory data beyond…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.116.0 and 16.x before 16.27.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks, exposing financial data. Authenticated attackers with low-privileged accounts can query these endpoints to…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 has certain endpoints that do not enforce proper authorization checks on operations that modify production records. An authenticated low-privileged user can send requests to these endpoints to modify production data beyond…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.113.0 and 16.x before 16.24.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated users can call these endpoints to read financial data beyond what their assigned role permits.
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints to read data, including personal data, beyond what their…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.118.2 and 16.x before 16.30.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks on item master data. Authenticated attackers with low-privileged accounts can call these endpoints to read…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role-based authorization checks. Authenticated low-privileged users can send requests to these endpoints to modify inventory…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.112.0 and 16.x before 16.23.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks. Authenticated low-privileged users can send requests to these endpoints to read personal data beyond what…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated attackers can send requests to these endpoints to create records and modify data beyond their…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.119.0 and 16.x before 16.31.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper authorization checks on valuation data. Authenticated low-privileged users can query these endpoints to read valuation…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.111.0 and 16.x before 16.22.0 contains a missing authorization vulnerability in certain project-related endpoints that fail to enforce permission checks. Authenticated low-privileged users can call these endpoints directly to read project data beyond…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.110.0 and 16.x before 16.21.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce authorization checks. Unauthenticated remote attackers can call these endpoints to create records and enumerate availability even when…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 16.14.0 contains a missing authorization vulnerability that allows authenticated users to modify master data beyond their permitted role. Attackers can send requests to certain endpoints lacking proper authorization checks to make unauthorized changes to…