Skip to content
OpenAdvisories

Weakness (CWE)

CWE-862: Missing Authorization

Class Incomplete

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

How to prevent it (5 mitigations)

  1. Architecture and Design

    Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.

    Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

  2. Architecture and Design

    Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

  3. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

    For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

  4. Architecture and Design

    For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.

    One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

  5. System Configuration, Installation

    Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

Source: MITRE CWE-862

All Critical High Medium Low Exploited only Public exploit

2,357 results · Clear filters · Feed

  • High 8.2
    CVE-2024-37903

    Mastodon has improper authorship check on audience extension for existing posts

    Mastodon is a self-hosted, federated microblogging platform. Starting in version 2.6.0 and prior to versions 4.1.18 and 4.2.10, by crafting specific activities, an attacker can extend the audience of a post they do not own to other Mastodon users on a target …

    mastodon mastodon
  • High 7.6
    CVE-2024-5820

    Unprotected WebSocket in stitionai/devika

    An unprotected WebSocket connection in the latest version of stitionai/devika (commit ecee79f) allows a malicious website to connect to the backend and issue commands on behalf of the user. The backend serves all listeners on the given socket, enabling any su…

    stitionai stitionai/devika
  • High 7.5
    CVE-2024-37111

    WordPress WishList Member X plugin < 3.26.7 - Unauthenticated Denial of Service Attack vulnerability

    Missing Authorization vulnerability in Membership Software WishList Member X.This issue affects WishList Member X: from n/a before 3.26.7.

    Membership Software WishList Member X
  • High 8.8
    CVE-2022-43453

    WordPress WP Tools plugin <= 3.41 - Auth. Broken Access Control vulnerability

    Missing Authorization vulnerability in Bill Minozzi WP Tools.This issue affects WP Tools: from n/a through 3.41.

    Bill Minozzi WP Tools
  • High 7.1
    CVE-2024-34444 Public exploit

    WordPress Slider Revolution plugin < 6.7.0 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemePunch OHG Slider Revolution.This issue affects Slider Revolution: from n/a before 6.7.0.

    ThemePunch OHG Slider Revolution
  • High 7.3
    CVE-2023-36515

    WordPress LearnPress plugin <= 4.2.3 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3.

    ThimPress LearnPress
  • High 7.6
    CVE-2023-36516

    WordPress LearnPress plugin <= 4.2.3 - Authenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in ThimPress LearnPress.This issue affects LearnPress: from n/a through 4.2.3.

    ThimPress LearnPress
  • High 7.6
    CVE-2023-38393

    WordPress Ninja Forms plugin <= 3.6.25 - Subscriber+ Broken Access Control vulnerability

    Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.

    Saturday Drive Ninja Forms
  • High 7.1
    CVE-2023-36684

    WordPress Convert Pro plugin <= 1.7.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Brainstorm Force Convert Pro.This issue affects Convert Pro: from n/a through 1.7.5.

    Brainstorm Force Convert Pro
  • High 7.6
    CVE-2023-38386

    WordPress Ninja Forms plugin <= 3.6.25 - Contributor+ Broken Access Control vulnerability

    Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25.

    Saturday Drive Ninja Forms
  • High 8.1
    CVE-2023-37870

    WordPress WooCommerce Warranty Requests plugin <= 2.1.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Woo WooCommerce Warranty Requests.This issue affects WooCommerce Warranty Requests: from n/a through 2.1.9.

    Woo WooCommerce Warranty Requests Web / CMS
  • High 7.5
    CVE-2023-35049

    WordPress WooCommerce Stripe Payment Gateway plugin <= 7.4.0 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in WooCommerce WooCommerce Stripe Payment Gateway.This issue affects WooCommerce Stripe Payment Gateway: from n/a through 7.4.0.

    woocommerce WooCommerce Stripe Payment Gateway Web / CMS
  • High 8.2
    CVE-2023-39998

    WordPress BeTheme theme <= 27.1.1 - Author+ Broken Access Control vulnerability

    Missing Authorization vulnerability in Muffingroup Betheme.This issue affects Betheme: from n/a through 27.1.1.

    Muffin Group Betheme
  • High 7.3
    CVE-2023-40004 EPSS 11%

    Unauth. Access Token Manipulation vulnerability in multiple ServMask WordPress plugins

    Missing Authorization vulnerability in ServMask All-in-One WP Migration Box Extension, ServMask All-in-One WP Migration OneDrive Extension, ServMask All-in-One WP Migration Dropbox Extension, ServMask All-in-One WP Migration Google Drive Extension.This issue …

    servmask All-in-One WP Migration Box Extension All-in-One WP Migration Dropbox Extension All-in-One WP Migration OneDrive Extension
  • High 8.2
    CVE-2023-40608

    WordPress Paid Memberships Pro CCBill Gateway plugin <= 0.3 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in Paid Memberships Pro Paid Memberships Pro CCBill Gateway.This issue affects Paid Memberships Pro CCBill Gateway: from n/a through 0.3.

    Paid Memberships Pro Paid Memberships Pro CCBill Gateway
  • High 7.6
    CVE-2023-45658

    WordPress Nexter theme <= 2.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in POSIMYTH Nexter.This issue affects Nexter: from n/a through 2.0.3.

    POSIMYTH Nexter
  • High 8.3
    CVE-2023-46146

    WordPress Themify Ultra theme <= 7.3.5 - Multiple Broken Access Control vulnerability

    Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.

    Themify Themify Ultra
  • High 8.8
    CVE-2023-46148

    WordPress Themify Ultra theme <= 7.3.5 - Authenticated Arbitrary Settings Change vulnerability

    Missing Authorization vulnerability in Themify Themify Ultra.This issue affects Themify Ultra: from n/a through 7.3.5.

    Themify Themify Ultra
  • High 7.6
    CVE-2023-47770

    WordPress BeTheme theme <= 27.1.1 - Contributor+ Broken Access Control vulnerability

    Missing Authorization vulnerability in Muffin Group Betheme.This issue affects Betheme: from n/a through 27.1.1.

    Muffin Group Betheme
  • High 8.3
    CVE-2023-47771

    WordPress Essential Grid plugin <= 3.0.18 - Multiple Authenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in ThemePunch OHG Essential Grid.This issue affects Essential Grid: from n/a through 3.0.18.

    ThemePunch OHG Essential Grid
  • High 8.3
    CVE-2023-47783

    WordPress Thrive Theme Builder theme < 3.24.0 - Multiple Authenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in Thrive Themes Thrive Theme Builder.This issue affects Thrive Theme Builder: from n/a before 3.24.0.

    Thrive Themes Thrive Theme Builder
  • High 7.5
    CVE-2023-48759

    WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Arbitrary Attachment Download vulnerability

    Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.

    Crocoblock JetElements For Elementor
  • High 8.2
    CVE-2023-48760

    WordPress JetElements For Elementor plugin <= 2.6.13 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in Crocoblock JetElements For Elementor.This issue affects JetElements For Elementor: from n/a through 2.6.13.

    Crocoblock JetElements For Elementor
  • High 8.1
    CVE-2023-6696

    Popup Builder – Create highly converting, mobile friendly marketing popups <= 4.3.1 - Missing Authorization and Nonce Exposure

    The Popup Builder – Create highly converting, mobile friendly marketing popups. plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions in all versions up to, and including, 4.3.1. Whil…

    Popup-Builder Popup Builder – Create highly converting, mobile friendly marketing popups. Web / CMS
  • High 7.4
    CVE-2024-2544

    Popup Builder <= 4.3.0 - Missing Authorization in Multiple AJAX Actions

    The Popup Builder plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on all AJAX actions. This makes it possible for authenticated attackers, with subscriber-level access and above, to pe…

    Popup-Builder Popup Builder – Create highly converting, mobile friendly marketing popups. Web / CMS
  • High 7.6
    CVE-2024-5685

    Broken Function Level Authorization (BFLA) in snipe/snipe-it

    Users with "User:edit" and "Self:api" permissions can promote or demote themselves or other users by performing changes to the group's memberships via API call.This issue affects snipe-it: from v4.6.17 through v6.4.1.

    snipe snipe-it snipe/snipe-it Packagist
  • High 7.3
    CVE-2024-1094

    Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling Plugin <= 1.0.21 - Missing Authorization to Limited Privilege Escalation

    The Timetics- AI-powered Appointment Booking with Visual Seat Plan and ultimate Calendar Scheduling plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the make_staff() function in all versions up to, a…

    Arraytics Timetics – Appointment Booking & Scheduling Web / CMS
  • High 7.5
    CVE-2023-48280

    WordPress Consensu.io plugin <= 1.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Consensu.IO Consensu.Io.This issue affects Consensu.Io: from n/a through 1.0.1.

    Consensu.IO Consensu.io
  • High 8.6
    CVE-2023-52233

    WordPress POST SMTP Mailer plugin <= 2.8.6 - Broken Access Control on API vulnerability

    Missing Authorization vulnerability in Post SMTP Post SMTP Mailer/Email Log.This issue affects Post SMTP Mailer/Email Log: from n/a through 2.8.6.

    Post SMTP Post SMTP Mailer/Email Log
  • High 8.6
    CVE-2024-24703

    WordPress MultiVendorX plugin <= 4.0.25 - Broken Access Control vulnerability

    Missing Authorization vulnerability in MultiVendorX WC Marketplace.This issue affects WC Marketplace: from n/a through 4.0.25.

    MultiVendorX WC Marketplace
  • High 8.3
    CVE-2023-25799

    WordPress Tutor LMS plugin <= 2.1.8 - Multiple Broken Access Control vulnerabilities

    Missing Authorization vulnerability in Themeum Tutor LMS.This issue affects Tutor LMS: from n/a through 2.1.8.

    Themeum Tutor LMS
  • High 7.6
    CVE-2024-34800

    WordPress Crafthemes Demo Import plugin <= 3.3 - Arbitrary plugin Installation vulnerability

    Missing Authorization vulnerability in Crafthemes Crafthemes Demo Import crafthemes-demo-import allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crafthemes Demo Import: from n/a through <= 3.3.

    Crafthemes Crafthemes Demo Import
  • High 8.2
    CVE-2024-31275

    WordPress EventPrime plugin <= 3.3.4 - Booking Price Manipulation vulnerability

    Missing Authorization vulnerability in Metagauss EventPrime.This issue affects EventPrime: from n/a through 3.3.4.

    Metagauss EventPrime
  • High 7.5
    CVE-2024-31283

    WordPress Advanced Local Pickup for WooCommerce plugin <=1.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1.6.2.

    zorem Advanced Local Pickup for WooCommerce Web / CMS
  • High 7.1
    CVE-2024-31304

    WordPress MultiVendorX Marketplace <= 4.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in MultiVendorX WC Marketplace.This issue affects WC Marketplace: from n/a through 4.1.3.

    MultiVendorX WC Marketplace
  • High 7.1
    CVE-2024-32704

    WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary WordPress Options Removal vulnerability

    Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.

    Repute InfoSystems ARForms
  • High 7.1
    CVE-2024-32705

    WordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary Plugin Activation/Deactivation Vulnerability

    Missing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.

    Repute InfoSystems ARForms
  • High 7.5
    CVE-2024-32715

    WordPress Olive One Click Demo Import plugin <= 1.1.1 - Arbitrary File Download vulnerability

    Missing Authorization vulnerability in Olive Themes Olive One Click Demo Import.This issue affects Olive One Click Demo Import: from n/a through 1.1.1.

    Olive Themes Olive One Click Demo Import
  • High 7.5
    CVE-2024-32777

    WordPress BizPrint plugin <= 4.3.39 - Broken Access Control vulnerability

    Missing Authorization vulnerability in BizSwoop a CPF Concepts, LLC Brand BizPrint.This issue affects BizPrint: from n/a through 4.3.39.

    BizSwoop a CPF Concepts, LLC Brand BizPrint
  • High 7.5
    CVE-2024-32798

    WordPress WP Travel Engine plugin <= 5.8.0 - Price Manipulation vulnerability

    Missing Authorization vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.8.0.

    WP Travel Engine WP Travel Engine