Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
2,357 results · Clear filters · Feed
-
High 7.3
WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.
-
High 8.1
WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.
-
High 7.1
WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability
Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.
-
High 7.1
WordPress Solace Extra plugin <= 1.6.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Solace Extra <= 1.6.0 versions.
-
High 7.5
WordPress Taxi Booking Manager for WooCommerce plugin <= 2.0.3 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce <= 2.0.3 versions.
-
High 7.2CVE-2026-6471 Public exploit
PostgreSQL logical decoding can dlopen arbitrary file
Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbitrary cod…
-
High 8.6
SiYuan v3.7.4-alpha.2 Authorization Bypass via getAttributeViewSearchTarget
SiYuan's development branch (endpoint introduced by commit 9b8e8956f, not present in v3.7.3 or master, patched in v3.7.4-alpha.3) contains a missing-authorization vulnerability in the /api/av/getAttributeViewSearchTarget endpoint. The route is registered with…
-
High 7.6
CamaleonCMS Missing Authorization via Plugin Administration Endpoints
CamaleonCMS contains a missing authorization vulnerability that allows any authenticated low-privileged user to access and modify plugin settings by reaching four unprotected plugin-administration endpoints without administrator-level authorization. Attackers…
-
High 8.6
SiYuan before v3.7.4 Authentication Bypass via Graph Endpoints
SiYuan versions before v3.7.4 fail to validate publish-password tier in getGraph and getLocalGraph endpoints, allowing anonymous readers to retrieve block-level content of password-protected documents. Attackers can call these endpoints without supplying a pa…
-
High 8.6
SiYuan before v3.7.4 Information Disclosure via renderAttributeView
SiYuan versions before v3.7.4 fail to properly filter related-database content in renderAttributeView, allowing anonymous readers to access Relation and Rollup cell contents from hidden or password-protected databases. Attackers can request published database…
-
High 8.6
SiYuan before v3.7.4 Information Disclosure via Embed Block
SiYuan versions before v3.7.4 fail to filter embedded block content by publish access in the getBlockDOMWithEmbed and getBlockDOMsWithEmbed endpoints. Attackers can request published blocks containing embed queries to read content from password-protected, hid…
-
High 8.6
SiYuan before v3.7.4 Authentication Bypass via Encrypted Notebooks
SiYuan before v3.7.4 fails to properly validate publish access for encrypted notebooks, treating them as publicly accessible by default. Anonymous readers can enumerate and retrieve fully decrypted document content from unlocked encrypted notebooks through th…
-
High 7.1
Missing Authorization in GitLab
GitLab has remediated an issue in GitLab EE affecting all versions from 19.1 before 19.1.4 and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to modify project settings restricted to higher-privileged roles, due to m…
-
High 8.1
Low-privilege users may remove protected Artifactory metadata
A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions.
-
High 7.0
NetBSD hdaudio(4) Driver Privilege Bypass Use-After-Free via HDAUDIO_FGRP_SETCONFIG ioctl
NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the HDAUDIO_FGRP_SETCONFIG ioctl without elevated permissions by exploiting the absence of an access che…
-
High 7.5
Ezoic < 2.23.1 - Unauthenticated Database Export via Content Export REST Routes
The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to trigger a server-side export of the site's database, including user password hashes and password rese…
-
High 8.2
Velociraptor collect_client() Permissions Bypass
Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permission. However, this is not enforced when the user can run a VQL query which resets the authorization pr…
-
High 7.5
calibre Content Server `/book-update-annotations` Missing Write Authorization Check Allows Unauthorized Annotation Modification
calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/srv/books.py omits needs_db_write=True, causing Router.dispatch() to skip ctx.check_for_write_access()…
-
High 8.2
TypeBot has Arbitrary S3 Object Write in deprecated public upload endpoint via attacker-controlled filePath
TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/typebots/{typebotId}/blocks/{blockId}/storage/upload-url` that accepts an attacker-controlled `filePath` and returns a presigned S3 `PUT` UR…
-
High 8.8
Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token
The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible f…
-
High 8.1
Azure CycleCloud Elevation of Privilege Vulnerability
Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
-
High 7.1
CoPilot Chat Security Feature Bypass Vulnerability
No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a security feature over a network.
-
High 8.8
Visual Studio Code Remote Code Execution Vulnerability
Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
-
High 7.1
TypeBot Google Sheets OAuth callback can create credentials in unauthorized workspaces and modify arbitrary typebots
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the embedded `workspaceId`, `typebotId`, `blockId`, and `redirectUrl` without cryptographic integrity prote…
-
High 7.1
TypeBot has Authorization Bypass in Google Sheets `getSheets` Endpoint that Allows Cross-Workspace Credential Access
TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace membership, allowing any authenticated user to access and decrypt another workspace's Google Sheets OAuth …
-
High 8.6
IDOR in Prospero Flow CRM allows cross-tenant ticket read, hijacking, and deletion
Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any company to read the full content (title, description, and attachments) of tickets belonging to anoth…
-
High 8.8
Privilege Escalation vulnerability in SAP ABAP Developer Tools
SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unauthorized database operations against SAP NetWeaver AS ABAP. Successful exploitation could allow the a…
-
High 7.3
Missing Authorization Check in SAP Manufacturing Integration and Intelligence
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access scheduling-related application functions without proper authorization validation. Successful exploitation cou…
-
High 7.3
Missing Authorization Check in SAP Manufacturing Integration and Intelligence
Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests to the Cost Servlet using specific parameter values. If processed by the application, these requests …
-
High 8.7
Authentication Bypass via Broken Access Control in Web Server in Multiple TP-Link Aginet Devices
The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoints. An attacker can send specially crafted requests to bypass authentication and directly invoke pri…
-
High 7.1
ERPNext: Unauthorised modification of master data due to missing validation
ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc, change_release_date, and update_cost_center functions across erpnext/accounts/doctype/account/accoun…
-
High 8.5
Feast: feast: authorization bypass in /materialize endpoints enables dos via unauthorized full re-materialization
A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially crafted request that omits the feature_views field, an attacker can bypass intended permission checks. T…
-
High 8.8
Dokploy: WebSocket Terminal Missing Service-Level Access Control
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in apps/dokploy/server/wss/terminal.ts, apps/dokploy/server/wss/docker-container-terminal.ts, apps/dokploy/server/wss/docker-container-logs.ts, and apps/do…
-
High 8.2
Vault Enterprise vulnerable to cross-namespace entity deletion
Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one namespace to permanently delete the storage backing of entities belonging to another namespace. This…
-
High 8.8
WebSocket Terminal Auth Bypass
Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a session but does not authorize access to the requested server. An authenticated user can connect to /term…
-
High 7.5
Flowise 2.2.4 - 3.1.4 Missing Authorization via openai-assistants-file/download
Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows unauthenticated attackers to access private files by exploiting the endpoint's inclusion in the global …
-
High 8.8
net: qrtr: restrict socket creation to the initial network namespace
In the Linux kernel, the following vulnerability has been resolved: net: qrtr: restrict socket creation to the initial network namespace QRTR keeps its entire port and node state in module-global variables that are not partitioned per network namespace: qrtr_…
-
High 7.5
OpenSignLabs opensignserver - Missing Authorization
A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-flight document and forge the decline attribution to an arbitrary user via the declinedoc Parse cloud …
-
High 8.8
geneve: require CAP_NET_ADMIN in the device netns for changelink
In the Linux kernel, the following vulnerability has been resolved: geneve: require CAP_NET_ADMIN in the device netns for changelink A tunnel changelink() operates on at most two netns, dev_net(dev) and the sticky underlay netns geneve->net. They differ once …
-
High 8.1
Bricksforge < 3.1.8.8 - Unauthenticated Arbitrary Password Reset via Pro Forms
The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its form actions, allowing unauthenticated attackers to set an arbitrary password for any user, including …