CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,924)
page 240 of 547| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-109636 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond… | ||
| CVE-2026-109632 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role… | ||
| CVE-2026-109628 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond… | ||
| CVE-2026-109627 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what… | ||
| CVE-2026-109625 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted… | ||
| CVE-2026-109624 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their… | ||
| CVE-2026-109621 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and… | ||
| CVE-2026-109615 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents… | ||
| CVE-2026-109614 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should… | ||
| CVE-2026-109610 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their… | ||
| CVE-2026-61994 | Med | 0.35 | 5.4 | 0.00 | Oct 12, 2026 | Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: from n/a through 3.5.7. | ||
| CVE-2026-107418 | Med | 0.35 | 5.4 | 0.00 | Oct 12, 2026 | Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28. | ||
| CVE-2026-109333 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespace/database and name a known… | ||
| CVE-2026-109316 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and… | ||
| CVE-2026-109202 | Med | 0.35 | 6.5 | 0.00 | Oct 12, 2026 | LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since… | ||
| CVE-2026-109178 | Med | 0.35 | 5.4 | 0.00 | Oct 12, 2026 | jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries,… | ||
| CVE-2026-107432 | Med | 0.35 | 5.4 | 0.00 | Oct 12, 2026 | Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1. | ||
| CVE-2026-107430 | Med | 0.35 | 5.4 | 0.00 | Oct 12, 2026 | Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex:… | ||
| CVE-2026-103356 | Med | 0.35 | 5.4 | 0.00 | Oct 12, 2026 | Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15. | ||
| CVE-2026-108883 | Med | 0.35 | 6.5 | 0.00 | Oct 11, 2026 | JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent id and corp id of… |
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.115.0 and 16.x before 16.26.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated attackers with low-privileged accounts can call these endpoints to read financial data beyond…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.121.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper authorization checks. Authenticated users can call these endpoints directly to read data beyond what their assigned role…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper role checks when modifying record status. Authenticated low-privileged attackers can invoke these endpoints to alter data beyond…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in which certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints directly to read financial data beyond what…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.121.3 and 16.x before 16.35.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce role-based authorization checks. Authenticated users can request these endpoints to read financial data beyond the permissions granted…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.120.0 and 16.x before 16.33.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks. Authenticated low-privileged users can request these endpoints to read personal data beyond what their…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.120.0 and 16.x before 16.23.0 contains an authorization bypass in an endpoint that honours a caller-supplied flag disabling its own permission enforcement. Authenticated attackers can set this flag when calling the endpoint to skip permission checks and…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.121.0 and 16.x before 16.34.0 contains a missing authorization vulnerability in certain endpoints that fail to enforce proper permission checks during document creation. Authenticated low-privileged users can call these endpoints to create documents…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 16.34.0 contains a missing authorization vulnerability that allows authenticated users to read financial data beyond their permitted role. Attackers can query endpoints lacking proper authorization checks to access sensitive financial records they should…
- risk 0.35cvss 6.5epss 0.00
Frappe ERPNext before 15.119.1 and 16.x before 16.32.0 contains a missing authorization vulnerability because certain endpoints fail to enforce proper permission checks. Authenticated low-privileged users can call these endpoints to modify documents and data beyond what their…
- risk 0.35cvss 5.4epss 0.00
Missing Authorization vulnerability in RocketGeek WP-Members wp-members allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-Members: from n/a through 3.5.7.
- risk 0.35cvss 5.4epss 0.00
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.28.
- risk 0.35cvss 6.5epss 0.00
SurrealDB from 3.0.0 before 3.3.0 contains an authorization bypass vulnerability that allows authenticated record users to read records in other namespaces or databases by resolving record ids through FETCH. Attackers can switch to a foreign namespace/database and name a known…
- risk 0.35cvss 6.5epss 0.00
Grav Data Manager plugin 1.4.0 through 1.4.5 contains a missing authorization vulnerability that allows unauthenticated attackers to delete stored data files via the classic Admin integration. Attackers can send a request with the delete parameter and known data type and…
- risk 0.35cvss 6.5epss 0.00
LogicalDOC Community Edition through 9.3 contains a missing authorization vulnerability in the zip-export servlet that allows authenticated users to export restricted folders by supplying a folderId parameter. Attackers can request /zip-export with a restricted folder ID, since…
- risk 0.35cvss 5.4epss 0.00
jshERP through 3.6 contains a missing authorization vulnerability in LogController that allows any authenticated user to forge, modify, or delete audit log entries. Low-privilege users can call /log/add, /log/update, /log/delete, and /log/deleteBatch to fabricate entries,…
- risk 0.35cvss 5.4epss 0.00
Missing Authorization vulnerability in NOUS Ouvert Utile et Simple Event post event-post allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event post: from n/a through 6.1.1.
- risk 0.35cvss 5.4epss 0.00
Missing Authorization vulnerability in VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex videowhisper-site-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VideoWhisper Site Manager for ChatGPT, Claude, Codex:…
- risk 0.35cvss 5.4epss 0.00
Missing Authorization vulnerability in VillaTheme TMDS tmds-dropshipping-for-temu-and-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TMDS: from n/a through 1.0.15.
- risk 0.35cvss 6.5epss 0.00
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the editThirdAppConfig handler that allows any authenticated user to modify third-party application configurations. Low-privileged attackers can replace client id, client secret, agent id and corp id of…