CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,117)
page 484 of 506| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-43665 | Med | 0.00 | 5.5 | 0.00 | Jul 27, 2026 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A local attacker may be able to determine the legacy VNC password configured for Screen Sharing. | ||
| CVE-2026-65922 | Hig | 0.00 | 7.1 | 0.00 | Jul 27, 2026 | An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level;… | ||
| CVE-2026-66477 | Med | 0.00 | 5.3 | 0.00 | Jul 27, 2026 | Unauthenticated Broken Access Control in Gillion <= 4.13 versions. | ||
| CVE-2026-66442 | Med | 0.00 | 5.4 | 0.00 | Jul 27, 2026 | Subscriber Broken Access Control in YayPricing <= 3.5.6 versions. | ||
| CVE-2026-65568 | Med | 0.00 | 5.0 | 0.00 | Jul 27, 2026 | Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions. | ||
| CVE-2026-65567 | Med | 0.00 | 5.3 | 0.00 | Jul 27, 2026 | Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions. | ||
| CVE-2026-65435 | Med | 0.00 | 6.5 | 0.00 | Jul 27, 2026 | Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions. | ||
| CVE-2026-65433 | Med | 0.00 | 6.5 | 0.00 | Jul 27, 2026 | Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions. | ||
| CVE-2026-59560 | Med | 0.00 | 6.5 | 0.00 | Jul 27, 2026 | Subscriber Broken Access Control in FundEngine <= 1.7.8 versions. | ||
| CVE-2026-59557 | Med | 0.00 | 6.5 | 0.00 | Jul 27, 2026 | Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions. | ||
| CVE-2026-59536 | Hig | 0.00 | 7.5 | 0.00 | Jul 27, 2026 | Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions. | ||
| CVE-2026-59535 | Hig | 0.00 | 7.3 | 0.00 | Jul 27, 2026 | Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions. | ||
| CVE-2026-59534 | Hig | 0.00 | 7.5 | 0.00 | Jul 27, 2026 | Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions. | ||
| CVE-2026-59530 | Hig | 0.00 | 7.5 | 0.00 | Jul 27, 2026 | Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions. | ||
| CVE-2026-59529 | Hig | 0.00 | 7.5 | 0.00 | Jul 27, 2026 | Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions. | ||
| CVE-2026-13390 | Med | 0.00 | 5.3 | 0.00 | Jul 27, 2026 | The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as… | ||
| CVE-2026-66027 | Hig | 0.00 | 8.3 | 0.00 | Jul 24, 2026 | Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read… | ||
| CVE-2026-16799 | Med | 0.00 | 5.0 | 0.00 | Jul 24, 2026 | Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization… | ||
| CVE-2026-10033 | Hig | 0.00 | 7.3 | 0.00 | Jul 24, 2026 | The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers… | ||
| CVE-2026-12654 | Med | 0.00 | 5.3 | 0.01 | Jul 24, 2026 | The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for… |
- risk 0.00cvss 5.5epss 0.00
This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A local attacker may be able to determine the legacy VNC password configured for Screen Sharing.
- risk 0.00cvss 7.1epss 0.00
An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal metadata areas under specific conditions. Successful abuse is limited to integrity and availability impact at a low level;…
- risk 0.00cvss 5.3epss 0.00
Unauthenticated Broken Access Control in Gillion <= 4.13 versions.
- risk 0.00cvss 5.4epss 0.00
Subscriber Broken Access Control in YayPricing <= 3.5.6 versions.
- risk 0.00cvss 5.0epss 0.00
Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions.
- risk 0.00cvss 5.3epss 0.00
Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions.
- risk 0.00cvss 6.5epss 0.00
Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.
- risk 0.00cvss 6.5epss 0.00
Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.
- risk 0.00cvss 6.5epss 0.00
Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.
- risk 0.00cvss 6.5epss 0.00
Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions.
- risk 0.00cvss 7.3epss 0.00
Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions.
- risk 0.00cvss 7.5epss 0.00
Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions.
- risk 0.00cvss 5.3epss 0.00
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing import records as…
- risk 0.00cvss 8.3epss 0.00
Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Attackers can read…
- risk 0.00cvss 5.0epss 0.00
Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user with only the Reader role to execute automation tests and modify workflow properties via missing server-side authorization…
- risk 0.00cvss 7.3epss 0.00
The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers…
- risk 0.00cvss 5.3epss 0.01
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for…