CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,032)
page 58 of 502| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2025-43773 | Cri | 0.52 | 9.1 | 0.00 | Aug 29, 2025 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 has a security vulnerability that… | ||
| CVE-2025-32973 | Cri | 0.52 | 9.0 | 0.00 | Apr 30, 2025 | XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, when a user with programming rights edits a document in XWiki that was last edited by a user without… | ||
| CVE-2025-31685 | Cri | 0.52 | 9.1 | 0.00 | Mar 31, 2025 | Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10. | ||
| CVE-2024-55879 | Cri | 0.52 | 9.1 | 0.01 | Dec 12, 2024 | XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises the confidentiality,… | ||
| CVE-2024-4163 | Hig | 0.52 | 8.0 | 0.00 | Apr 26, 2024 | The Skylab IGX IIoT Gateway allowed users to connect to it via a limited shell terminal (IGX). However, it was discovered that the process was running under root privileges. This allowed the attacker to read, write, and modify any file in the operating system by utilizing the… | ||
| CVE-2023-36144 | Hig | 0.52 | 7.5 | 0.37 | Jun 30, 2023 | An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, exposing critical information about the device configuration. | ||
| CVE-2022-0871 | Cri | 0.52 | 9.1 | 0.01 | Mar 11, 2022 | Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5. | ||
| CVE-2021-24914 | Hig | 0.52 | 8.0 | 0.01 | Dec 6, 2021 | The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the… | ||
| CVE-2021-21689 | Cri | 0.52 | 9.1 | 0.01 | Nov 4, 2021 | FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier. | ||
| CVE-2021-21685 | Cri | 0.52 | 9.1 | 0.02 | Nov 4, 2021 | Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs. | ||
| CVE-2021-38486 | Hig | 0.52 | 8.0 | 0.01 | Oct 19, 2021 | InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements to create an account, which may allow an attacker to have full control over the product and execute code within the… | ||
| CVE-2020-8495 | Hig | 0.52 | 7.5 | 0.03 | Jan 30, 2020 | In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate,… | ||
| CVE-2019-10849 | Hig | 0.52 | 7.5 | 0.09 | May 23, 2019 | Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure. | ||
| CVE-2017-12084 | Hig | 0.52 | 8.0 | 0.01 | Nov 7, 2017 | A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specific set of network packets can remotely start an SSH server on the device, resulting in a persistent backdoor. An attacker can send an API call to enable the SSH… | ||
| CVE-2017-1000086 | Hig | 0.52 | 8.0 | 0.01 | Oct 5, 2017 | The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not… | ||
| CVE-2026-43689 | Hig | 0.51 | 7.8 | 0.00 | Sep 14, 2026 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A malicious app may be able to gain root privileges. | ||
| CVE-2026-28611 | Hig | 0.51 | 7.8 | 0.00 | Sep 8, 2026 | In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for… | ||
| CVE-2026-83942 | Hig | 0.51 | 7.8 | 0.00 | Sep 8, 2026 | Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-73014 | Hig | 0.51 | 7.8 | 0.00 | Sep 8, 2026 | Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally. | ||
| CVE-2026-69377 | Hig | 0.51 | 7.8 | 0.00 | Sep 8, 2026 | Missing authorization in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. |
- risk 0.52cvss 9.1epss 0.00
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 has a security vulnerability that…
- risk 0.52cvss 9.0epss 0.00
XWiki is a generic wiki platform. In versions starting from 15.9-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.8.0-rc-1, when a user with programming rights edits a document in XWiki that was last edited by a user without…
- risk 0.52cvss 9.1epss 0.00
Missing Authorization vulnerability in Drupal Open Social allows Forceful Browsing.This issue affects Open Social: from 0.0.0 before 12.3.11, from 12.4.0 before 12.4.10.
- risk 0.52cvss 9.1epss 0.01
XWiki Platform is a generic wiki platform. Starting in version 2.3 and prior to versions 15.10.9, 16.3.0, any user with script rights can perform arbitrary remote code execution by adding instances of `XWiki.ConfigurableClass` to any page. This compromises the confidentiality,…
- risk 0.52cvss 8.0epss 0.00
The Skylab IGX IIoT Gateway allowed users to connect to it via a limited shell terminal (IGX). However, it was discovered that the process was running under root privileges. This allowed the attacker to read, write, and modify any file in the operating system by utilizing the…
- risk 0.52cvss 7.5epss 0.37
An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, exposing critical information about the device configuration.
- risk 0.52cvss 9.1epss 0.01
Missing Authorization in GitHub repository gogs/gogs prior to 0.12.5.
- risk 0.52cvss 8.0epss 0.01
The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the…
- risk 0.52cvss 9.1epss 0.01
FilePath#unzip and FilePath#untar were not subject to any agent-to-controller access control in Jenkins 2.318 and earlier, LTS 2.303.2 and earlier.
- risk 0.52cvss 9.1epss 0.02
Jenkins 2.318 and earlier, LTS 2.303.2 and earlier does not check agent-to-controller access to create parent directories in FilePath#mkdirs.
- risk 0.52cvss 8.0epss 0.01
InHand Networks IR615 Router's Versions 2.3.0.r4724 and 2.3.0.r4870 cloud portal allows for self-registration of the affected product without any requirements to create an account, which may allow an attacker to have full control over the product and execute code within the…
- risk 0.52cvss 7.5epss 0.03
In Kronos Web Time and Attendance (webTA) 3.8.x and later 3.x versions before 4.0, the com.threeis.webta.H491delegate servlet allows an attacker with Timekeeper or Supervisor privileges to gain unauthorized administrative privileges within the application via the delegate,…
- risk 0.52cvss 7.5epss 0.09
Computrols CBAS 18.0.0 allows unprotected Subversion (SVN) directory / source code disclosure.
- risk 0.52cvss 8.0epss 0.01
A backdoor vulnerability exists in remote control functionality of Circle with Disney running firmware 2.0.1. A specific set of network packets can remotely start an SSH server on the device, resulting in a persistent backdoor. An attacker can send an API call to enable the SSH…
- risk 0.52cvss 8.0epss 0.01
The Periodic Backup Plugin did not perform any permission checks, allowing any user with Overall/Read access to change its settings, trigger backups, restore backups, download backups, and also delete all previous backups via log rotation. Additionally, the plugin was not…
- risk 0.51cvss 7.8epss 0.00
A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27. A malicious app may be able to gain root privileges.
- risk 0.51cvss 7.8epss 0.00
In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for…
- risk 0.51cvss 7.8epss 0.00
Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.00
Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally.
- risk 0.51cvss 7.8epss 0.00
Missing authorization in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally.