Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
7,354 results · Clear filters · Feed
-
Medium 5.3
Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromis…
-
Medium 6.4
Automation-controller: automation-controller-container: automation-controller/awx: bulk job launch checks instance_groups at read level instead of use level, allowing execution-placement authorization bypass
A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the requested instance_groups with only a read-level permission check, whereas the standard single-job launch pat…
-
Medium 4.3
Missing Authorization in Kibana Entity Store Leading to Unauthorized API Key Creation
Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An authenticated user holding only low-privilege Security feature access co…
-
Medium 4.3
Missing Authorization in Kibana Leading to Unauthorized Disclosure of Fleet Deployment Metadata
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180). An authenticated user holding minimal Elasticsearch privileges could bypass Kibana feature authoriza…
-
Medium 5.4
Missing Authorization in Elasticsearch Leading to Information Disclosure
Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holding only inference execution privileges could cause outbound inference traffic to be directed to a des…
-
Medium 6.5
Missing Authorization in Kibana Leading to Information Disclosure
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an internal Kibana APM integration function, allowing any authenticated Kibana user to read APM server cr…
-
Medium 6.5
GROWI through 8.0.2 Missing Authorization on apiv3 Attachment Retrieval
GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attackers can retrieve attachment metadata from pages they cannot view by supplying known attachment ident…
-
Medium 5.3
KiviCare – Clinic & Patient Management System (EHR) < 4.5.5 - Unauthenticated Patient Data Disclosure
The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose the patient roster and, when a payment gateway is configured, the payment gateway secret key.
-
Medium 5.3
Cozy Blocks <= 2.2.17 - Missing Authorization to Unauthenticated Unpublished Product Information Disclosure via 'wishlistData' Parameter
The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.2.17. This is due to the plugin not properly verifying that …
-
Medium 5.9
Ash.update_many/4 atomic path skips resource policy authorization, allowing updates to forbidden records
Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_many/4. Ash.update_many/4 runs as a single atomic statement (a data-layer update_many, for example a …
-
Medium 5.3
Sulu: Fix authorization bypass when creating preview links
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu/Bundle/PreviewBundle/Application/Manager/PreviewLinkManager.php do not enforce VIEW permission for …
-
Medium 5.4
WordPress Post SMTP plugin 4.0.0-beta.1 - Settings Change vulnerability
Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SMTP: from 4.0.0 through beta.1.
-
Medium 6.5
WordPress Booking and Rental Manager plugin <= 2.7.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions.
-
Medium 6.3
WordPress OwnerRez API plugin <= 1.2.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions.
-
Medium 4.3
Xibo CMS Missing Authorization in Module::settingsForm due to PHP operator precedence
Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization in Module::settingsForm allows to view (not change) super admin-restricted module settings and leak…
-
Medium 5.3
WordPress bbPress plugin <= 2.6.14 - Broken Access Control vulnerability
Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects bbPress: from n/a through 2.6.14.
-
Medium 6.3
DataEase before 2.10.26 Missing Object-Level Authorization on Geographic, Linkage and Chart Endpoints
DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing authenticated users to access resources belonging to other users. Attackers can overwrite or delete…
-
Medium 5.4
Nodemailer jsonTransport bypasses disableFileAccess and disableUrlAccess
Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local files or fetch URLs by supplying path or href values in message content fields, bypassing intended …
-
Medium 5.3
Icollect <= 1.0.0 - Unauthenticated User and Term Creation via Unrestricted Method Dispatch
The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check on them, allowing unauthenticated users to create WordPress user accounts and taxonomy terms.
-
Medium 4.9
SiYuan before v3.8.1 Missing Authorization via /history and /repo/diff
SiYuan before v3.8.1 does not apply the IsForbiddenAbsPath guard (introduced in GHSA-c8r8-95hg-mp34) to the /history/*path and /repo/diff/*path endpoints in kernel/server/serve.go. These routes require admin authentication but construct file paths independent…
-
Medium 4.3
wger-project wger Password Reset gym.py reset_user_password cross-site request forgery
A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the component Password Reset. Executing a manipulation can lead to cross-site request forgery. It is possib…
-
Medium 4.3
Dolibarr 10.0.0 before 24.0.0 Missing Authorization on REST Users Groups Endpoint
Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users to retrieve group memberships of other users. Attackers can call GET /users/{id}/groups with arbitra…
-
Medium 4.3
Frontend Admin by DynamiApps < 3.29.11 - Subscriber+ Arbitrary Membership Plan Deletion
The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated user, such as a subscriber, to delete arbitrary membership plans.
-
Medium 6.5
MStore API < 4.21.1 - Subscriber+ Arbitrary Order Payment Bypass via Wallet
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not deduct the wallet balance for most payment methods, allowing any authenticated user, including Subscrib…
-
Medium 5.3
CatFolders Document Gallery Pro < 2.0.7 - Unauthenticated Missing Authorization via download-all
The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested content is forgeable client side, allowing unauthenticated users to list and download the contents of fol…
-
Medium 6.5
MStore API < 4.21.1 - Subscriber+ Arbitrary Order Completion
The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any authenticated user, including Subscribers, to mark arbitrary orders as completed and paid without any…
-
Medium 4.3
Yamcs: Missing Authorization on Role and Privilege Enumeration Endpoints Allows Any Authenticated User to Disclose Full Security Configuration
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and IamApi.listPrivileges in yamcs-core/src/main/java/org/yamcs/http/api/IamApi.java. Any authenticated a…
-
Medium 6.5
Yamcs: WebSocket subscription handlers omit the privilege checks their REST siblings enforce
Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent REST endpoints. PacketsApi.subscribePackets exposes the packets WebSocket topic without ObjectPrivile…
-
Medium 4.3
Vikunja incomplete fix for CVE-2026-35595: Write-only user can detach shared project from parent hierarchy via parent_project_id=0
Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project can detach it from its parent hierarchy by submitting parent_project_id equal to 0 to POST /api/v1/pro…
-
Medium 6.5
Mastra Memory API Thread Ownership Check Is a No-op When mapUserToResourceId Is Unset
Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitted from configuration. Authenticated attackers can enumerate all threads via GET /api/memory/threads …
-
Medium 5.4
Komodo Resource Identifier Disclosure and Audit Log Pollution Before Permission Check
Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant} handlers. Authenticated users can guess resource names to obtain internal identifiers and insert f…
-
Medium 6.4
Hatchet: Cross-tenant write/DoS to other tenants' workers via Dispatcher gRPC UpsertWorkerLabels and Unsubscribe
Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does not verify that a request's worker ID belongs to the tenant identified by the bearer-token context …
-
Medium 4.3
WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in WpEvently <= 5.5.0 versions.
-
Medium 5.4
WordPress WpEvently plugin <= 5.5.0 - Broken Access Control vulnerability
Contributor Broken Access Control in WpEvently <= 5.5.0 versions.
-
Medium 4.3
WordPress ACF Extended plugin <= 0.9.2.6 - Broken Access Control vulnerability
Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.
-
Medium 5.3
WCFM Marketplace < 3.8.2 - Unauthenticated Refund Request Creation on Guest Orders
The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated users to create refund requests against any guest checkout order on the site.
-
Medium 5.3
Shared Files < 1.7.70 - Unauthenticated Limited File Upload
The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handler, which is registered for unauthenticated users and protected only by a nonce that is output on publ…
-
Medium 5.1
LimeSurvey Community Edition 7.0.5 - Improper authorization in survey menu entry creation endpoint
LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticated user with only the global settings:read permission can directly invoke POST /index.php/admin/menuent…
-
Medium 5.3
Flowintel Missing Authorization Allows Regular API Users to View Other Users’ Task Assignments
Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying the user whose assignments should be returned, but previously had no role restriction beyond general…
-
Medium 5.3
WordPress Ditty plugin <= 3.1.67 - Broken Access Control vulnerability
Subscriber Broken Access Control in Ditty <= 3.1.67 versions.