Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
2,357 results · Clear filters · Feed
-
High 7.5
Reconmap Report Preview Endpoint Is Marked AllowAnonymous, Exposing Every Project and Client Organisation Without Authentication
Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so controllers without their own attribute reject anonymous callers. The report preview action in apps/api/ap…
-
High 7.5
Apache CloudStack: Improper access control in Userdata reference APIs
Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userdata-related APIs in Apache CloudStack, including deleteUserData, linkUserDataToTemplate, resetUserData…
-
High 8.3
Winter: ImportExportController AJAX handlers bypass granular import/export permission gate
### Impact Affected versions of Winter CMS did not enforce the `ImportExportController` behavior's granular access control on the handlers that actually perform the work. The behavior supports per-operation access control through the `import[permissions]` and…
-
High 8.1
WeGIA < 3.9.2 Authorization Bypass Password Change via alterarSenha
WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account password without providing existing credentials by exploiting the unconditional exclusion of the alterarSe…
-
High 7.5
WordPress Koji theme <= 2.2.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.
-
High 7.1
WordPress EPROLO Dropshipping plugin <= 2.4.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions.
-
High 7.5
WordPress Chaplin theme <= 2.6.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.
-
High 8.3
Missing Authorization in Container and Connection Management through the REST API in Splunk AI Toolkit
In Splunk AI Toolkit versions below 6.0.0, a low-privileged user who does not hold the "admin" or "power" Splunk roles could start, stop, and configure containers, and read or modify connection and configuration data through the Representational State Transfe…
-
High 7.1
Improper Access Control through the REST API in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language 2 (SPL2) modules across all apps and users on the instance through the SPL2 module management Repre…
-
High 8.8
Remote Code Execution (RCE) through Federated Search in Splunk Enterprise
In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fsh_manage capability could perform Remote Code Execution through Federated Search bundle selection. This could allow for access to all releva…
-
High 7.1
Missing Authorization through REST API Endpoints in the Splunk App for Splunk Observability Cloud
In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk roles could cause the Splunk App for Splunk Observability Cloud to forward requests to Splunk Observability Cloud, including the Splunk Obse…
-
High 8.8
Termix: Account Takeover via Global Settings Disclosure
Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoint creates a user export that includes the global settings table even though the rest of the export i…
-
High 8.1
Portieris is vulnerable to Image Policy Bypass via Unvalidated ownerReference
IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner references.
-
High 8.8
Leantime JSON-RPC API contains a missing authorization vulnerability
Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php. The dispatcher does not enforce authorization before invoking service-layer methods, allowing an a…
-
High 8.2
Power System Missing Authorization
IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the BMC/FSP and the host system. An attacker with service account or root access to the BMC/FSP can exec…
-
High 8.7
Grav API Plugin: Missing authorization on API-key generate/revoke lets any admin.login user forge keys for any account
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the apiKeyGenerate and apiKeyRevoke admin tasks in user/plugins/api/api.php and authorizes the caller with …
-
High 8.1
Grav API Plugin : API Key 'scopes' Never Enforced - Delegated Least-Privilege Keys Carry Full User ACL
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::generateKey() stores a declared scopes array, but ApiKeyAuthenticator::authenticate() does not read key…
-
High 8.8
Grav API Plugin: non-super api.users.write manager -> super-admin via createApiKey (incomplete fix of CVE-2026-59190); + 2FA strip of super
Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::createApiKey(), generate2fa(), and disable2fa() omit the accessGrantsSuper() target check used by sibling…
-
High 8.8
Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged att…
-
High 7.3
Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged att…
-
High 8.7
MyBooks: Privilege Escalation via Missing Authorization on Admin Settings Endpoint
MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserver/handlers/admin.py applies the auth decorator but does not check the self.admin_user property, unl…
-
High 7.1
ArcadeDB before 26.8.1 Permission Bypass via DEFINE FUNCTION
ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUNCTION statement targets an already-existing function library. A user with only database access can add or overwrite SQL or Cypher functions…
-
High 7.5
WordPress Outranking plugin Options plugin <= 1.1.3 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.
-
High 7.5
WordPress Stitch Express plugin <= 1.9.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.
-
High 8.7
Blueprint Studio API authorization bypass for non-admin Home Assistant users
Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforc…
-
High 7.7
Lemur: Authenticated low-privilege users can read plaintext destination credentials (SFTP password / private-key passphrase) via the destinations API
Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write handlers required admin_permission. DestinationOutputSchema returned raw options and copied them int…
-
High 8.1
Lemur: Unchecked `replaces[]` lets any user silence notifications and hijack auto-rotation for arbitrary certificates
Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers that AssociatedCertificateSchema resolved with fetch_objects without a CertificatePermission check. A…
-
High 8.1
Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit …
-
High 7.8
CodeWhale rlm_eval before 0.8.64 Remote Code Execution
CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' …
-
High 7.6
Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member…
-
High 7.5
WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.
-
High 7.5
WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
-
High 8.2
WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability
Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.
-
High 7.5
WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.
-
High 7.5
WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.
-
High 7.5
WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.
-
High 7.5
WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.
-
High 8.8
ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database
ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticat…
-
High 7.1
ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION
ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermis…
-
High 8.8
Grav API Plugin before 1.0.14 Missing Authorization
The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint correctly filters menubar ite…