CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,936)
page 296 of 547| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-64965 | Med | 0.34 | — | 0.00 | Aug 20, 2026 | ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user (e.g. a student) enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the… | ||
| CVE-2026-17153 | Med | 0.34 | 5.3 | 0.00 | Aug 20, 2026 | The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated… | ||
| CVE-2026-76340 | Med | 0.34 | 5.3 | 0.00 | Aug 19, 2026 | In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could cause Splunk Enterprise to reload token-signing keys through the Representational State Transfer (REST) API. The vulnerability does not affect Splunk Enterprise versions below 10.4. The vulnerability… | ||
| CVE-2026-62670 | Med | 0.34 | 6.3 | 0.00 | Aug 19, 2026 | Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits… | ||
| CVE-2026-18779 | Med | 0.34 | 5.3 | 0.00 | Aug 19, 2026 | The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records. | ||
| CVE-2026-18777 | Med | 0.34 | 5.3 | 0.00 | Aug 19, 2026 | The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers. | ||
| CVE-2026-47721 | Med | 0.34 | 6.3 | 0.00 | Aug 18, 2026 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin… | ||
| CVE-2026-8840 | Med | 0.34 | 5.3 | 0.01 | Aug 15, 2026 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for… | ||
| CVE-2026-73403 | Med | 0.34 | 5.3 | 0.00 | Aug 13, 2026 | Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions. | ||
| CVE-2026-73401 | Med | 0.34 | 5.3 | 0.00 | Aug 13, 2026 | Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions. | ||
| CVE-2026-73353 | Med | 0.34 | 5.3 | 0.00 | Aug 13, 2026 | Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions. | ||
| CVE-2026-73349 | Med | 0.34 | 5.3 | 0.00 | Aug 13, 2026 | Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. | ||
| CVE-2026-73603 | Med | 0.34 | 5.3 | 0.00 | Aug 13, 2026 | Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API… | ||
| CVE-2026-68753 | Med | 0.34 | 5.3 | 0.00 | Aug 12, 2026 | An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way. | ||
| CVE-2026-66377 | Med | 0.34 | 5.3 | 0.00 | Aug 12, 2026 | An unauthenticated user may access restricted repository information under specific conditions. | ||
| CVE-2026-18035 | Med | 0.34 | 5.3 | 0.00 | Aug 12, 2026 | The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups. | ||
| CVE-2026-17021 | Med | 0.34 | 5.3 | 0.00 | Aug 10, 2026 | The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary… | ||
| CVE-2026-15237 | Med | 0.34 | 5.3 | 0.00 | Aug 10, 2026 | The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as… | ||
| CVE-2026-19350 | Med | 0.34 | 6.3 | 0.00 | Aug 9, 2026 | A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is… | ||
| CVE-2026-16608 | Med | 0.34 | 5.3 | 0.00 | Aug 8, 2026 | The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and… |
- risk 0.34cvss —epss 0.00
ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user (e.g. a student) enrolled in a course can bypass authorization checks by sending requests directly to the backend import endpoints, allowing the…
- risk 0.34cvss 5.3epss 0.00
The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated…
- risk 0.34cvss 5.3epss 0.00
In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could cause Splunk Enterprise to reload token-signing keys through the Representational State Transfer (REST) API. The vulnerability does not affect Splunk Enterprise versions below 10.4. The vulnerability…
- risk 0.34cvss 6.3epss 0.00
Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method in classes/Api/FlexApiController.php returns without denying access when a directory blueprint omits…
- risk 0.34cvss 5.3epss 0.00
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete arbitrary appointment records along with their associated booking items and payment records.
- risk 0.34cvss 5.3epss 0.00
The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change the status of arbitrary appointments, as well as to trigger notification emails to the affected customers.
- risk 0.34cvss 6.3epss 0.00
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler/index.js do not consistently enforce authJwt.haveAdminPermission for scheduler settings. An authenticated non-admin…
- risk 0.34cvss 5.3epss 0.01
The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for…
- risk 0.34cvss 5.3epss 0.00
Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.
- risk 0.34cvss 5.3epss 0.00
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
- risk 0.34cvss 5.3epss 0.00
Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.
- risk 0.34cvss 5.3epss 0.00
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
- risk 0.34cvss 5.3epss 0.00
Flowise before 3.1.4 fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint, allowing attackers to abuse private chatflow TTS credentials. Unauthenticated attackers can generate unlimited text-to-speech audio using stored OpenAI or ElevenLabs API…
- risk 0.34cvss 5.3epss 0.00
An unauthenticated user may access restricted Artifactory content when a credentialed remote repository is configured in a specific way.
- risk 0.34cvss 5.3epss 0.00
An unauthenticated user may access restricted repository information under specific conditions.
- risk 0.34cvss 5.3epss 0.00
The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read the content of posts, pages and custom post types that have been restricted to specific user groups.
- risk 0.34cvss 5.3epss 0.00
The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verify ownership of the targeted booking, allowing unauthenticated users to tamper with the stored total of arbitrary…
- risk 0.34cvss 5.3epss 0.00
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as…
- risk 0.34cvss 6.3epss 0.00
A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Module. Such manipulation leads to missing authorization. The attack may be performed from remote. The name of the patch is…
- risk 0.34cvss 5.3epss 0.00
The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce protecting it to unauthenticated visitors, allowing unauthenticated users to inject arbitrary download log entries and…