CWE-862
Missing Authorization
Description
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Hierarchy (View 1000)
Related attack patterns (CAPEC)
CAPEC-665
CVEs mapped to this weakness (10,032)
page 83 of 502| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2026-81767 | Hig | 0.49 | 7.5 | 0.00 | Aug 28, 2026 | Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions. | ||
| CVE-2026-75813 | Hig | 0.49 | 7.5 | 0.00 | Aug 28, 2026 | Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality. | ||
| CVE-2026-80433 | Hig | 0.49 | 7.5 | 0.00 | Aug 27, 2026 | Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions. | ||
| CVE-2026-78137 | Hig | 0.49 | 7.5 | 0.00 | Aug 27, 2026 | The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout… | ||
| CVE-2026-74928 | Hig | 0.49 | 7.5 | 0.00 | Aug 26, 2026 | The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting. | ||
| CVE-2026-69104 | Hig | 0.49 | 7.6 | 0.00 | Aug 25, 2026 | An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue. | ||
| CVE-2026-56092 | Hig | 0.49 | — | 0.00 | Aug 25, 2026 | The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions… | ||
| CVE-2026-28153 | Hig | 0.49 | 7.5 | 0.00 | Aug 24, 2026 | Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 versions. | ||
| CVE-2026-50222 | Hig | 0.49 | 7.5 | 0.00 | Aug 21, 2026 | Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine,… | ||
| CVE-2026-74021 | Hig | 0.49 | 7.5 | 0.00 | Aug 20, 2026 | Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions. | ||
| CVE-2026-74020 | Hig | 0.49 | 7.5 | 0.00 | Aug 20, 2026 | Unauthenticated Broken Access Control in Koji <= 2.2.1 versions. | ||
| CVE-2026-73394 | Hig | 0.49 | 7.5 | 0.00 | Aug 19, 2026 | Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions. | ||
| CVE-2026-73385 | Hig | 0.49 | 7.5 | 0.00 | Aug 19, 2026 | Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions. | ||
| CVE-2026-73994 | Hig | 0.49 | 7.5 | 0.00 | Aug 18, 2026 | Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions. | ||
| CVE-2026-73377 | Hig | 0.49 | 7.5 | 0.00 | Aug 18, 2026 | Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions. | ||
| CVE-2026-69189 | Hig | 0.49 | 7.6 | 0.00 | Aug 18, 2026 | Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User… | ||
| CVE-2026-32472 | Hig | 0.49 | 7.5 | 0.00 | Aug 18, 2026 | Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions. | ||
| CVE-2026-28571 | Hig | 0.49 | 7.5 | 0.00 | Aug 18, 2026 | Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions. | ||
| CVE-2026-28567 | Hig | 0.49 | 7.5 | 0.00 | Aug 18, 2026 | Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions. | ||
| CVE-2026-74904 | Hig | 0.49 | 7.5 | 0.00 | Aug 18, 2026 | SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access… |
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.
- risk 0.49cvss 7.5epss 0.00
Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings. This could result in full compromise of device functionality.
- risk 0.49cvss 7.5epss 0.00
Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.
- risk 0.49cvss 7.5epss 0.00
The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticated attackers to add a product to the cart at an arbitrary, attacker-chosen price that carries through to the checkout…
- risk 0.49cvss 7.5epss 0.00
The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPress accounts with a password the attacker already knows, bypassing the site's own registration setting.
- risk 0.49cvss 7.6epss 0.00
An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unauthorized state changes, and service disruption. Fixed versions address the issue.
- risk 0.49cvss —epss 0.00
The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions…
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 versions.
- risk 0.49cvss 7.5epss 0.00
Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserDataForVirtualMachine,…
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
- risk 0.49cvss 7.6epss 0.00
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User…
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.
- risk 0.49cvss 7.5epss 0.00
Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.
- risk 0.49cvss 7.5epss 0.00
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lack publish-access…