Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
2,339 results · Clear filters · Feed
-
High 7.1
In OpenStack Mistral through 23.0.0, the /v2/maintenance API controller clears the request context and calls the mainte…
-
High 7.8
Missing Authorization in hMailServer
Missing authorization on COM objects in Progressive Robot hMailServer 6.0.0 through 6.3.5 (Windows only) lets a local interactive user with no hMailServer credential read and write arbitrary files as the service account and queue mail as any sender. The servi…
-
High 7.1
Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials
An authorization vulnerability in Apache DolphinScheduler allows authenticated non-admin users to retrieve Kubernetes configuration data intended for administrator-managed cluster configuration. The exposed kubeconfig data contains credentials that may allow …
-
High 7.7
Missing authorization checks in Amazon Athena engine version 3 request handling
Missing authorization checks in Amazon Athena engine version 3 request handling could have allowed an authenticated user to read limited query metadata (AWS account identifiers and SQL statement text) from other AWS accounts. Query results, credentials, and A…
-
High 7.5
WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPMU DEV Forminator allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Forminator: from n/a through 1.57.2.
-
High 8.2
Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure
The Nexi XPay Build WordPress plugin through 7.6.2 does not verify the payment result supplied to several of its unauthenticated routes, allowing attackers to mark arbitrary orders as paid or failed, to cancel them, and to obtain order keys which expose guest…
-
High 8.3
Missing authorization in Actor in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised th…
-
High 8.1
Missing authorization in Workers in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromised …
-
High 8.1
Missing authorization in Passwords in Google Chrome on on Android prior to 155.0.8059.39 allowed a remote attacker who …
-
High 8.4
Missing authorization in Mobile in Google Chrome on on Android prior to 155.0.8059.39 allowed a local attacker leveragi…
-
High 8.8
Missing authorization in Mobile in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker leveraging …
-
High 8.2
Missing authorization in FileSystem in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromis…
-
High 7.6
Missing authorization in Navigation in Google Chrome on on iOS prior to 155.0.8059.39 allowed a remote attacker to bypa…
-
High 8.3
Missing authorization in FullScreen in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compromis…
-
High 8.8
Missing authorization in Autofill in Google Chrome prior to 155.0.8059.39 allowed a remote attacker leveraging social e…
-
High 8.3
Missing authorization in WebAppInstalls in Google Chrome prior to 155.0.8059.39 allowed a remote attacker who had compr…
-
High 7.1
Missing authorization in the global vault in Devolutions Server 2026.3.7.0 and earlier allows an authenticated user wit…
-
High 7.1
Payload: Tenant authorization bypass in Multi-Tenant Plugin
Payload is a free and open source headless content management system. In @payloadcms/plugin-multi-tenant versions before 3.90.0 and canary versions before 4.0.0-canary.34, the default tenant array field access allows an authenticated user to assign the user's…
-
High 7.7
Payload: API key disclosure through ordinary document reads
Payload is a free and open source headless content management system. In versions from 3.0.0 before 3.90.0 and canary versions before 4.0.0-canary.34, users with ordinary read access to other authentication documents in a collection with useAPIKey enabled can…
-
High 8.6
Payload: Improper access control for MCP API keys
Payload is a free and open source headless content management system. In @payloadcms/plugin-mcp versions from 3.61.0 until 3.88.0, an authenticated user can manage MCP API keys outside the intended account, enabling privilege escalation through account takeov…
-
High 8.2
Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC
Mooncake Store master through 0.3.13.post1 contains a missing authorization vulnerability that allows unauthenticated attackers to erase any object's disk replica via EvictDiskReplica and BatchEvictDiskReplica. Attackers reaching the coro_rpc master port can …
-
High 7.3
WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in picu <= 3.10.1 versions.
-
High 7.2
WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in PowerPress Podcasting <= 11.17.9 versions.
-
High 8.5
WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in WPO365 <= 44.1 versions.
-
High 7.3
WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in BEAR <= 1.2.2 versions.
-
High 8.8
WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Progress Planner <= 1.10.0 versions.
-
High 7.5
WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Sermon'e <= 1.0.2 versions.
-
High 7.5
WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Awesomemotive Easy Digital Downloads easy-digital-downloads allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Digital Downloads: from n/a through 3.7.1.
-
High 7.5
WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WXD Backup Lite <= 1.0.2 versions.
-
High 7.5
WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Advanced Posts Listing – Show Post List Easily <= 1.0.8 versions.
-
High 7.5
WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WooCommerce Multivendor Marketplace – REST API <= 1.6.3 versions.
-
High 7.5
WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in PayPlug for WooCommerce (Official) <= 3.1.0 versions.
-
High 7.1
WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Marcin Wise Chat wise-chat allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Wise Chat: from n/a through 3.4.3.
-
High 7.1
WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability
Subscriber Broken Access Control in ECPay Ecommerce for WooCommerce <= 1.1.2606090 versions.
-
High 7.1
WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability
Subscriber Broken Access Control in WP2LEADS <= 3.5.7 versions.
-
High 7.8
Missing Authorization in Core
Memory corruption when non-secure loader rewrites page tables before secure memory initialization.
-
High 7.5
WordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Fluent Affiliate Pro <= 1.6.4 versions.
-
High 7.5
WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Green Invoice Morning for WooCommerce wc-gateway-greeninvoice allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Morning for WooCommerce: from n/a through 2.4.1.
-
High 7.5
WordPress FluentBooking Pro plugin < 2.5.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in FluentBooking Pro < 2.5.0 versions.
-
High 8.8
In isSystem of WifiPermissionsUtil.java, there is a possible sandbox escape due to a missing permission check. This cou…