Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
2,339 results · Clear filters · Feed
-
High 7.6
WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Apps Mav Scratch & Win – Giveaways and Contests scratch-win-giveaways-for-website-facebook allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scratch & Win – Giveaways and Contests…
-
High 7.1
WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability
Missing Authorization vulnerability in Webful Creations RepairBuddy computer-repair-shop allows Retrieve Embedded Sensitive Data.This issue affects RepairBuddy: from n/a through 4.1226.
-
High 7.4
Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token
Plane is an open-source project management tool. Prior to 1.4.0, ProjectJoinEndpoint at GET /api/workspaces/{slug}/projects/{project_id}/join/{pk}/ uses permission_classes = [AllowAny] and returns the full ProjectMemberInvite record, including its email, toke…
-
High 8.7
Plane: Cross-tenant stored XSS in intake enables account takeover
Plane is an open-source project management tool. Prior to 1.4.0, IntakeIssuePublicViewSet.create in Plane v1.3.1 writes description_html through Issue.objects.create(...) without calling validate_html_content from nh3. Any authenticated user, including a new …
-
High 8.5
Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization
Plane is an open-source project management tool. Prior to 1.4.0, DuplicateAssetEndpoint fetches a source FileAsset without limiting it to the caller's workspace, allowing cross-workspace asset duplication. WorkspaceFileAssetEndpoint and the legacy FileAssetEn…
-
High 8.7
Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/
Plane is an open-source project management tool. Prior to 1.4.0, GET /api/workspaces/{slug}/entity-search/?query_type=user_mention returns workspace-member display names, UUIDs, and avatar URLs to any authenticated user who knows the workspace slug, even when…
-
High 8.1
Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter
The Nelio Content – Editorial Calendar & Social Media Auto-Posting plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.5.0 This is due to the plugin not properly verifying that a user is authorized to perform an …
-
High 8.1
Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Arbitrary Content Deletion in versions up to, and including, 1.2.30. This is due to the plugin storing attacker-controlled post IDs from the wcpr_image_upload_id parameter of a public rev…
-
High 7.5
Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints
The Simple Membership plugin for WordPress is vulnerable to unauthorized modification of data and sensitive information disclosure in versions up to, and including, 4.8.3 via the resend-activation and email-activation endpoints. The endpoints are dispatched f…
-
High 7.5
Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass
The Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.13.1 This is due to the plugin not properly v…
-
High 7.1
Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)
### Summary The run replay `action` function at `apps/webapp/app/routes/resources.taskruns.$runParam.replay.ts` has no authentication or authorization check. While the `loader` (GET) in the same file properly calls `requireUser(request)` and scopes queries to…
-
High 7.1CVE-2026-104991 Public exploit
Phproject < 1.8.7 Missing Authorization via Issues REST API
Phproject before 1.8.7 contains a missing object-level authorization vulnerability in the REST API issue endpoints (single_get, single_comments, single_comments_post) that allows authenticated API key holders to bypass the security.restrict_access confidentia…
-
High 7.1
MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data
MISP contains an authorization flaw in its correlation handling during attribute searches. When a user performs an attribute search that triggers correlation lookups, the system authorized access to correlated attributes and events based on a stale distributi…
-
High 7.7
Missing Authorization in Meari IoT Cloud Platform OpenAPI Service
The Meari IoT Cloud Platform OpenAPI Service is vulnerable to an authorization flaw that allows authenticated users to manipulate the configurations of devices they do not own. This vulnerability enables attackers to perform unauthorized actions, such as alte…
-
High 7.5
YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler
YesWiki before 4.6.7 contains a missing authorization vulnerability in the attachment download handler that allows unauthenticated attackers to bypass page read ACLs. Attackers can request the download handler with a known page tag and file parameter to retri…
-
High 8.1
YesWiki before 4.6.7 Authorization Bypass via Public API Mode
YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_…
-
High 7.5
SiYuan before 3.8.5 Information Disclosure via /api/export/preview
SiYuan before 3.8.5 contains an information disclosure vulnerability that allows publish readers to read password-protected and publish-disabled database rows via the /api/export/preview endpoint. Attackers can request an export preview of a public document e…
-
High 7.6
WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability
Subscriber Broken Access Control in Gratisfaction <= 4.6.3 versions.
-
High 7.6
WordPress Social Boost plugin <= 3.6.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Social Boost <= 3.6.2 versions.
-
High 7.5
WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Full Stripe Free <= 8.5.6 versions.
-
High 8.8
Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset
Ghost versions before 6.62.0 contain an authentication bypass vulnerability that allows suspended staff users to reactivate their accounts through self-service password reset. Attackers with suspended staff credentials can perform password reset operations to…
-
High 7.1
n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub
n8n versions before 1.123.80, from 2.0.0 before 2.39.6, and from 2.40.0 before 2.40.1 contain a validation bypass vulnerability in the community package installation handler for queue mode deployments. Attackers with Redis write access can bypass name validat…
-
High 7.2
In JetBrains YouTrack before 2026.2.19422 privilege escalation was possible via user group links
-
High 7.1
MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes
MISP contains an authorization bypass in the event flattening feature. When a user requests an event with the flatten option enabled, the application removes the Object containment from the query and returns object attributes as top-level event attributes. In…
-
High 7.3
Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass
A missing authorization vulnerability in Genian SSL PNS allows an attacker to bypass multi-factor authentication by manipulating a login request parameter.
-
High 7.5
Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_types REST Endpoint via Public Nonce
The Simply Schedule Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.6.12.32 via the 'recursive' parameter. This makes it possible for unauthenticated attackers to extract customer PII —…
-
High 7.8
NVIDIA vGPU software for Windows and Linux contains a vulnerability in the GPU kernel driver where a guest may access p…
-
High 7.3
NVIDIA GPU Display Driver for Windows contains a vulnerability in the kernel module where an attacker could cause a mis…
-
High 7.8
NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability in the kernel mode layer, where a user could a…
-
High 7.8
NVIDIA GPU Display Driver for Linux contains a vulnerability in the kernel mode layer where an unprivileged user could …
-
High 7.7
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from th…
-
High 7.5
WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.
-
High 7.5
WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.
-
High 7.5
WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.
-
High 8.2
WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.
-
High 7.5
WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Bookly <= 28.2 versions.
-
High 7.5
WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
-
High 7.1
WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in FormGent <= 1.12.2 versions.
-
High 7.5
WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.
-
High 8.6
MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection
MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag…