CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,936)
page 362 of 547| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-0198 | Med | 0.29 | 4.4 | 0.00 | Oct 6, 2026 | In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation. | ||
| CVE-2026-93832 | Med | 0.29 | 4.4 | 0.00 | Oct 1, 2026 | A component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions from other apps. | ||
| CVE-2026-95835 | Med | 0.29 | — | 0.00 | Sep 25, 2026 | Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handle_remote_askpass() in kitty/window.py opens the… | ||
| CVE-2026-66078 | Med | 0.29 | 5.5 | 0.00 | Sep 25, 2026 | RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected (rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser). POST… | ||
| CVE-2026-84551 | Med | 0.29 | 4.4 | 0.00 | Sep 14, 2026 | A logic issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. An app may be able to bypass network restrictions. | ||
| CVE-2026-78601 | Med | 0.29 | 5.5 | 0.00 | Sep 2, 2026 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly… | ||
| CVE-2026-79672 | Med | 0.29 | 5.5 | 0.00 | Aug 25, 2026 | Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments,… | ||
| CVE-2026-75982 | Med | 0.29 | 4.4 | 0.00 | Aug 25, 2026 | The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler only checks the edit_pages capability and a… | ||
| CVE-2026-47718 | Med | 0.29 | — | 0.00 | Aug 12, 2026 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue. | ||
| CVE-2026-55628 | Med | 0.29 | 5.5 | 0.00 | Jul 1, 2026 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy.… | ||
| CVE-2026-53850 | Med | 0.29 | 5.5 | 0.00 | Jun 16, 2026 | OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks. Attackers can trigger the focus command to change focus state outside intended… | ||
| CVE-2025-30017 | Med | 0.29 | 4.4 | 0.00 | Apr 8, 2025 | Due to a missing authorization check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution Manager 7.1. After successful exploitation, an attacker can cause limited impact on the integrity and availability of the application. | ||
| CVE-2025-24116 | Med | 0.29 | 4.4 | 0.00 | Jan 27, 2025 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to bypass Privacy preferences. | ||
| CVE-2024-40834 | Med | 0.29 | 4.4 | 0.00 | Jul 29, 2024 | This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A shortcut may be able to bypass sensitive Shortcuts app settings. | ||
| CVE-2023-48339 | Med | 0.29 | 4.4 | 0.00 | Jan 18, 2024 | In jpg driver, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed | ||
| CVE-2023-42735 | Med | 0.29 | 4.4 | 0.00 | Dec 4, 2023 | In telephony service, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed | ||
| CVE-2023-40638 | Med | 0.29 | 4.4 | 0.00 | Oct 8, 2023 | In Telecom service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed | ||
| CVE-2023-40636 | Med | 0.29 | 4.4 | 0.00 | Oct 8, 2023 | In telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with System execution privileges needed | ||
| CVE-2023-40631 | Med | 0.29 | 4.4 | 0.00 | Oct 8, 2023 | In Dialer, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed | ||
| CVE-2023-43090 | Med | 0.29 | 5.5 | 0.00 | Sep 22, 2023 | A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool. |
- risk 0.29cvss 4.4epss 0.00
In is_pd_allowed of gem_msg.c, there is a possible permission bypass due to a missing permission check. This could lead to local information disclosure with System execution privileges needed. User interaction is not needed for exploitation.
- risk 0.29cvss 4.4epss 0.00
A component of one of the Motorola system applications was exported without permission, allowing for the revocation of runtime permissions from other apps.
- risk 0.29cvss —epss 0.00
Missing Authorization in the askpass escape code handler in kitty from 0.25.0 before 0.49.0 allows a local user other than the one running the terminal to obtain the text typed into a prompt that kitty itself displays, because handle_remote_askpass() in kitty/window.py opens the…
- risk 0.29cvss 5.5epss 0.00
RabbitMQ is a messaging and streaming broker. From 3.13.0 until 3.13.15 and 4.0.20 and 4.1.11 and 4.2.6, protected tag bypass via bulk-delete. dELETE /api/users/:name refuses to delete users tagged protected (rabbitmgmtwmuser:deleteresource/2 checks isprotecteduser). POST…
- risk 0.29cvss 4.4epss 0.00
A logic issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. An app may be able to bypass network restrictions.
- risk 0.29cvss 5.5epss 0.00
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kibana Entity Store configuration operation, allowing an authenticated user with elevated Kibana privileges to indirectly…
- risk 0.29cvss 5.5epss 0.00
Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full comment moderation operations. Attackers with a limited-scope access token can list, approve, reject, delete comments,…
- risk 0.29cvss 4.4epss 0.00
The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the learnpress_create_page AJAX action. The LP_Admin_Ajax::create_page() handler only checks the edit_pages capability and a…
- risk 0.29cvss —epss 0.00
FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. When `secureEnabled=true`, FUXA `1.3.0-2773` still allows guest and invalid-token requests to read project, alarms, and scheduler APIs. Version 1.3.1 fixes this issue.
- risk 0.29cvss 5.5epss 0.00
ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the `-concatenate` operation is missing policy checks, potentially resulting in both reading and writing to paths disallowed by the security policy.…
- risk 0.29cvss 5.5epss 0.00
OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks. Attackers can trigger the focus command to change focus state outside intended…
- risk 0.29cvss 4.4epss 0.00
Due to a missing authorization check, an authenticated attacker could upload a file as a template for solution documentation in SAP Solution Manager 7.1. After successful exploitation, an attacker can cause limited impact on the integrity and availability of the application.
- risk 0.29cvss 4.4epss 0.00
An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Sequoia 15.3, macOS Sonoma 14.7.3, macOS Ventura 13.7.3. An app may be able to bypass Privacy preferences.
- risk 0.29cvss 4.4epss 0.00
This issue was addressed by adding an additional prompt for user consent. This issue is fixed in macOS Monterey 12.7.6, macOS Sonoma 14.6, macOS Ventura 13.6.8. A shortcut may be able to bypass sensitive Shortcuts app settings.
- risk 0.29cvss 4.4epss 0.00
In jpg driver, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed
- risk 0.29cvss 4.4epss 0.00
In telephony service, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed
- risk 0.29cvss 4.4epss 0.00
In Telecom service, there is a possible missing permission check. This could lead to local denial of service with System execution privileges needed
- risk 0.29cvss 4.4epss 0.00
In telecom service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with System execution privileges needed
- risk 0.29cvss 4.4epss 0.00
In Dialer, there is a possible missing permission check. This could lead to local information disclosure with System execution privileges needed
- risk 0.29cvss 5.5epss 0.00
A vulnerability was found in GNOME Shell. GNOME Shell's lock screen allows an unauthenticated local user to view windows of the locked desktop session by using keyboard shortcuts to unlock the restricted functionality of the screenshot tool.