Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
7,354 results · Clear filters · Feed
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/addSysUserGroup
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysUserController addSysUserGroup handler that allows any authenticated user to modify user group membership. Low-privileged attackers can send POST requests with arbitrary user ids…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to assign or remove department heads by calling PUT /sys/user/changeDepartChargePerson. Low-privileged attackers can supply arbitrary userId, department …
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/doUpdateDepartInfo
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to modify any department by calling PUT /sys/user/doUpdateDepartInfo. Attackers can supply a department id to rename or re-parent it and repl…
-
Medium 5.4
JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the saveDatarule handler of SysDepartRoleController that lets low-privileged authenticated users modify department role data rules. Attackers can send crafted permissionId, roleId and d…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsers
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the batchEditUsers handler of SysUserController that allows any authenticated user to edit user department assignments. Low-privileged attackers can send PUT requests to /sys/user/batch…
-
Medium 5.4
JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysRoleController saveDatarule handler that allows low-privileged authenticated users to modify role data rules. Attackers can send permissionId, roleId and dataRuleIds to overwrite…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to send system announcements by calling POST /sys/api/sendSysAnnouncement. Attackers can supply arbitrary title, content, fromUser and toUser…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to publish templated system announcements via POST /sys/api/sendBusTemplateAnnouncement. Low-privileged attackers can supply templateCode, toUser, and a …
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SystemApiController getUserRoleSetById handler that allows any authenticated user to read other users' role assignments. Low-privileged attackers can supply an arbitrary userId para…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows authenticated users to read any account's permissions via the queryUserAuths handler. Low-privileged attackers can supply an arbitrary userId parameter to retrieve another user…
-
Medium 5.4
UnicomAI Wanwu through 0.6.5 Missing Authorization via DELETE /v1/appspace/app/publish
UnicomAI Wanwu through 0.6.5 contains a missing authorization vulnerability that allows any authenticated enabled user to revoke other users' AppKeys for arbitrary apps via the unpublish endpoint. Attackers can supply a target appId and appType from the explo…
-
Medium 4.3
CoreShop through 2026.2.2 Missing Authorization via ResourceController listAction
CoreShop through 2026.2.2 contains a missing authorization vulnerability that allows low-privileged backend users to list permission-restricted resources because ResourceController listAction skips the isGrantedOr403() check. Authenticated Pimcore users lacki…
-
Medium 5.4
Abilityai Trinity through 0.9.5 Missing Authorization in Telegram Binding Routes
Abilityai Trinity through 0.9.5 contains a missing authorization vulnerability in the Telegram router that allows agent-scoped MCP API keys to perform human-only binding operations. Attackers controlling an agent, typically via prompt injection, can send mess…
-
Medium 4.3
CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation
CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCre…
-
Medium 4.3
Frappe CRM 1.49.0 through 1.87.0 Missing Authorization via get_linked_docs_of_document
Frappe CRM 1.49.0 through 1.87.0 contains a missing authorization vulnerability in crm.api.doc.get_linked_docs_of_document that allows authenticated users to read linked documents without permission checks. Attackers can name a lead, deal, comment or user the…
-
Medium 4.3
Frappe HR (hrms) before 16.11.0 Missing Authorization via expire_allocation
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted expire_allocation method that allows authenticated users to expire any leave allocation. Attackers without…
-
Medium 4.3
Frappe HR (hrms) before 16.11.0 Missing Authorization via get_account_and_amount
Frappe HR (hrms) before 16.11.0, including all 14.x and 15.x releases through 15.64.3, contains a missing authorization vulnerability in the whitelisted get_account_and_amount method that lets authenticated users read payroll amounts. Attackers without HR rol…
-
Medium 5.4
Raven 2.0.0 through 3.0.0 Missing Authorization via join_workspace Invite-Only Bypass
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability that allows authenticated users to join invite-only Public workspaces by ignoring the can_only_join_via_invite setting. Attackers with the Raven User role can call the join_workspace met…
-
Medium 4.3
Raven 2.0.0 through 3.0.0 Missing Authorization via Legacy Message and File APIs
Raven 2.0.0 through 3.0.0 contains a missing authorization vulnerability in legacy methods in raven/api/raven_message.py that skip the workspace membership check. Authenticated non-members can call get_messages_with_dates or get_all_files_shared_in_channel wi…
-
Medium 4.3
GLPI through 12.0.0 Missing Authorization via ajax/map.php
GLPI through 12.0.0 contains a missing authorization vulnerability in ajax/map.php that allows authenticated low-privileged users to search itemtypes they cannot view by omitting the canView() check. Attackers can submit crafted itemtype and search criteria f…
-
Medium 4.3
EdgeEver through 1.108.0 Missing Authorization via Memo-Template API Routes
EdgeEver through 1.108.0 contains a missing authorization vulnerability in the Hono API memo-template routes that allows holders of scoped API tokens to bypass token scope restrictions because template handlers never call requireScopes. Attackers with a token…
-
Medium 4.3
phpIPAM through 1.8.3 Missing Authorization in Customers, Locations and NAT Pages
phpIPAM through 1.8.3 contains a missing authorization vulnerability that allows authenticated low-privilege users to view restricted subnets and addresses because customer, location and NAT pages skip Subnets::check_permission. Attackers can open customer ob…
-
Medium 6.3
Combodo iTop 3.1.0 through 3.3.0 Missing Authorization via LinkSetController
Combodo iTop 3.1.0 through 3.3.0 contains a missing authorization vulnerability in LinkSetController.php that allows authenticated console users to bypass profile grants by supplying arbitrary class and key parameters. Attackers can invoke the linkset delete,…
-
Medium 4.3
SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via setCampaignMarketingAndTemplate
SuiteCRM through 7.15.2 and 8.x through 8.10.2 contains a missing authorization vulnerability that allows authenticated users to create and modify EmailMarketing records via the setCampaignMarketingAndTemplate entry point. Low-privileged users denied Campaign…
-
Medium 4.3
SuiteCRM through 7.15.2 and 8.10.2 Missing Authorization via DetailUserRole Entry Point
SuiteCRM through 7.15.2 and 8.10.2 contains a missing authorization vulnerability in the DetailUserRole entry point that allows authenticated non-admin users to view other users' ACL data. Attackers can supply another non-admin user's id in the record paramet…
-
Medium 6.5
NornicDB through 1.4.1 Missing Authorization via Vector Search Endpoints
NornicDB through 1.4.1 contains a missing authorization vulnerability that allows authenticated users to bypass per-database read restrictions on the /nornicdb/search and /nornicdb/similar endpoints. Viewer-role users allowlisted for a database but denied rea…
-
Medium 4.3
Simple User Registration <= 6.9 - Subscriber+ Arbitrary Email Sending via wpr_send_email_to_user
The MemberHero WordPress plugin through 6.9 does not perform any capability or nonce check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to make the site send arbitrary HTML emails to arbitrary recipients from its own mail…
-
Medium 4.3
eladmin through commit 55fbf70 Missing Authorization via S3 Storage Download Endpoint
eladmin through commit 55fbf70 contains a missing authorization vulnerability in the downloadS3Storage handler that allows any authenticated user to retrieve stored object URLs without storage permissions. Attackers can enumerate sequential ids against GET /a…
-
Medium 4.3
CordysCRM through 1.9.3 Missing Authorization via /custom-form/data/import
CordysCRM through 1.9.3 contains a missing authorization vulnerability in the POST /custom-form/data/import endpoint that allows authenticated users to import data into any custom form by customFormId. Low-privileged attackers can upload Excel files with impo…
-
Medium 5.4
CordysCRM through 1.9.3 Missing Authorization via /approval-resource/push
CordysCRM through 1.9.3 contains a missing authorization vulnerability in POST /approval-resource/push that allows authenticated users to submit any resource for approval without ownership checks. Low-privileged attackers can supply arbitrary resourceId value…
-
Medium 4.3
CordysCRM through 1.9.3 Missing Authorization and Blind SSRF via Webhook Test
1Panel-dev CordysCRM through 1.9.3 lacks a PROCESS_SETTING permission check on POST /approval-flow/webhook/test, allowing any authenticated user to trigger server-side requests to attacker-supplied URLs. Attackers can redirect GET requests from a controlled h…
-
Medium 6.5
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via /field/source/business-title
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability that allows authenticated users to list business titles by calling POST /field/source/business-title without permission checks. Users lacking CONTRACT_BUSINESS_TITLE_READ can ret…
-
Medium 4.3
1Panel-dev CordysCRM before 1.9.2 Missing Authorization via POST /contract/sort
1Panel-dev CordysCRM before 1.9.2 contains a missing authorization vulnerability in the ContractController sortModule handler for POST /contract/sort, which lacks any permission annotation. Authenticated users without contract update permission can supply a d…
-
Medium 6.5
1Panel-dev CordysCRM 1.9.0 before 1.9.2 Missing Authorization via /field/source Endpoints
1Panel-dev CordysCRM from 1.9.0 before 1.9.2 contains a missing authorization vulnerability in eight ModuleFieldController /field/source data-source endpoints lacking permission checks. Authenticated users denied module permission can page through organizatio…
-
Medium 4.3
Eladmin through 2.7 Missing Authorization via /api/localStorage/pictures Upload
Eladmin through 2.7 contains a missing authorization vulnerability in the LocalStorageController uploadPicture handler that allows low-privileged authenticated users to bypass the storage:add permission. Attackers can send POST requests with image-named files…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendTemplateAnnouncement
JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows any authenticated user to send template notifications by calling POST /sys/api/sendTemplateAnnouncement. Low-privileged attackers can supply forged sender, recipients, title, a…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the sendBusAnnouncement handler of SystemApiController that allows any authenticated user to send announcements without the required permissions. Low-privileged attackers can POST craft…
-
Medium 6.5
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in GET /sys/api/getUserByName that allows low-privileged authenticated users to retrieve any user's stored password value. Attackers can decrypt the AES-CBC protected response using the ha…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the queryUserRoles handler of SystemApiController that lets authenticated users read any user's role codes. Low-privileged attackers can send GET requests to /sys/api/queryUserRoles wit…
-
Medium 4.3
JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles
JeecgBoot through 3.9.5 contains a missing authorization vulnerability in the SysAnnouncementController downLoadFiles handler that allows low-privileged authenticated users to download announcement attachments. Attackers can supply a known announcement id to …