CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,936)
page 367 of 547| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-105891 | Med | 0.28 | 4.3 | 0.00 | Oct 8, 2026 | Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1. | ||
| CVE-2026-103072 | Med | 0.28 | 4.3 | 0.00 | Oct 8, 2026 | Missing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VillaTheme Core: from n/a through 1.0.5. | ||
| CVE-2026-87669 | Med | 0.28 | 4.3 | 0.00 | Oct 8, 2026 | A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite (MAPS)… | ||
| CVE-2026-76272 | Med | 0.28 | 4.3 | 0.00 | Oct 7, 2026 | In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because Splunk Secure Gateway does not… | ||
| CVE-2026-104390 | Med | 0.28 | 4.3 | 0.00 | Oct 7, 2026 | Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27. | ||
| CVE-2026-103075 | Med | 0.28 | 4.3 | 0.00 | Oct 7, 2026 | Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2. | ||
| CVE-2026-102410 | Med | 0.28 | 4.3 | 0.00 | Oct 6, 2026 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an… | ||
| CVE-2026-106217 | Med | 0.28 | 4.3 | 0.00 | Oct 6, 2026 | Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium) | ||
| CVE-2026-39599 | Med | 0.28 | 4.3 | 0.00 | Oct 6, 2026 | Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions. | ||
| CVE-2026-105706 | Med | 0.28 | 4.3 | 0.00 | Oct 6, 2026 | A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could… | ||
| CVE-2026-105698 | Med | 0.28 | 5.4 | 0.00 | Oct 5, 2026 | Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} handlers. Through version… | ||
| CVE-2026-39783 | Med | 0.28 | 4.3 | 0.00 | Oct 5, 2026 | Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7. | ||
| CVE-2026-39763 | Med | 0.28 | 4.3 | 0.00 | Oct 5, 2026 | Missing Authorization vulnerability in Deepak Anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through 4.0.0. | ||
| CVE-2026-105062 | Med | 0.28 | 4.3 | 0.00 | Oct 5, 2026 | Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17. | ||
| CVE-2026-104675 | Med | 0.28 | 4.3 | 0.00 | Oct 5, 2026 | Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0. | ||
| CVE-2026-39717 | Med | 0.28 | 4.3 | 0.00 | Oct 2, 2026 | Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10. | ||
| CVE-2026-97219 | Med | 0.28 | 4.3 | 0.00 | Oct 2, 2026 | The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods… | ||
| CVE-2026-79618 | Med | 0.28 | 4.3 | 0.00 | Oct 2, 2026 | The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately… | ||
| CVE-2026-103495 | Med | 0.28 | 4.3 | 0.00 | Oct 1, 2026 | In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs | ||
| CVE-2026-100269 | Med | 0.28 | 4.3 | 0.00 | Sep 30, 2026 | In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed |
- risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.1.
- risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in VillaTheme VillaTheme Core villatheme-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects VillaTheme Core: from n/a through 1.0.5.
- risk 0.28cvss 4.3epss 0.00
A missing authorization check in Brocade Fabric OS versions before 10.0.1 REST API interface of affected platform releases allows an authenticated user, regardless of their assigned role or administrative scope, to retrieve complete Monitoring and Alerting Policy Suite (MAPS)…
- risk 0.28cvss 4.3epss 0.00
In Splunk Enterprise versions below 10.4.3, 10.2.7, 10.0.10, and 9.4.15, a user who does not hold the "admin" or "power" Splunk roles could cause Splunk Secure Gateway to sign attacker-controlled payloads. The vulnerability is possible because Splunk Secure Gateway does not…
- risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Arraytics Booktics booktics allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Booktics: from n/a through 1.0.27.
- risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in WPMU DEV Hustle wordpress-popup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hustle: from n/a through 7.8.14.2.
- risk 0.28cvss 4.3epss 0.00
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal API surface within the Metrics Experience feature did not enforce a Kibana-level authorization check that an…
- risk 0.28cvss 4.3epss 0.00
Missing authorization in Google Lens in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised the renderer process to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
- risk 0.28cvss 4.3epss 0.00
Contributor Broken Access Control in WDS MCP Content Manager <= 3.10.4 versions.
- risk 0.28cvss 4.3epss 0.00
A weakness has been identified in SourceCodester Drug Recommendation System 1.0. Affected is an unknown function. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. The exploit has been made available to the public and could…
- risk 0.28cvss 5.4epss 0.00
Langflow is a tool for building and deploying AI-powered agents and workflows. From 1.0.0 until 1.10.1, Langflow did not verify flow ownership in the deprecated POST /api/v1/build/{flow_id}/vertices and POST /api/v1/build/{flow_id}/vertices/{vertex_id} handlers. Through version…
- risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in WP SYNTEX Polylang polylang allows Retrieve Embedded Sensitive Data.This issue affects Polylang: from n/a through 3.8.7.
- risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Deepak Anand WP Dummy Content Generator wp-dummy-content-generator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Dummy Content Generator: from n/a through 4.0.0.
- risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Brandtoss WP Admin Audit wp-admin-audit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Admin Audit: from n/a through 1.2.17.
- risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in Liquid Web / StellarWP Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Tickets: from n/a through 5.30.0.
- risk 0.28cvss 4.3epss 0.00
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.10.
- risk 0.28cvss 4.3epss 0.00
The MStore API WordPress plugin before 4.22.1 does not restrict which fields of an order a customer may update, allowing any authenticated user with a self-registerable account to change the status of their own unpaid order to a paid or fulfilled state and receive the goods…
- risk 0.28cvss 4.3epss 0.00
The WP User Frontend WordPress plugin before 4.3.12 does not enforce its subscription-purchase requirement in one of its post-creation handlers, allowing authenticated users with subscriber-level access and above to create and, depending on the form's configuration, immediately…
- risk 0.28cvss 4.3epss 0.00
In JetBrains YouTrack before 2026.2.19422 missing authorisation allowed reloading of translation catalogs
- risk 0.28cvss 4.3epss 0.00
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed