Skip to content
OpenAdvisories

Weakness (CWE)

CWE-862: Missing Authorization

Class Incomplete

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

How to prevent it (5 mitigations)

  1. Architecture and Design

    Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.

    Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

  2. Architecture and Design

    Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

  3. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

    For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

  4. Architecture and Design

    For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.

    One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

  5. System Configuration, Installation

    Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

Source: MITRE CWE-862

All Critical High Medium Low Exploited only Public exploit

7,354 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-65525

    WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.

    uxper Civi Framework
  • Medium 4.3
    CVE-2026-65524

    WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability

    Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.

    ThemeFusion Avada Custom Branding
  • Medium 5.3
    CVE-2026-65506

    WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.

    sonaar MP3 Audio Player for Music, Radio & Podcast by Sonaar
  • Medium 6.5
    CVE-2026-65499

    WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.

    Pepro Dev. Group PeproDev Ultimate Invoice
  • Medium 4.3
    CVE-2026-65491

    WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.

    Jonathan Daggerhart Query Wrangler
  • Medium 5.3
    CVE-2026-65489

    WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.

    LA-Studio LA-Studio Element Kit for Elementor
  • Medium 5.3
    CVE-2026-65487

    WordPress Photography theme <= 7.7.6 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Photography <= 7.7.6 versions.

    ThemeGoods Photography
  • Medium 5.3
    CVE-2026-65486

    WordPress Event post plugin <= 6.0.1 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Event post <= 6.0.1 versions.

    Bastien Ho Event post
  • Medium 6.3
    CVE-2026-65484

    WordPress Style Kits plugin <= 2.6.5 - Broken Access Control vulnerability

    Contributor Broken Access Control in Style Kits <= 2.6.5 versions.

    AnalogWP Style Kits
  • Medium 5.3
    CVE-2026-65485

    WordPress Content Control plugin <= 2.6.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions.

    Daniel Iser Content Control
  • Medium 5.4
    CVE-2026-65479

    WordPress Reviewer plugin <= 3.14.2 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Reviewer <= 3.14.2 versions.

    MVP Themes Reviewer
  • Medium 5.4
    CVE-2026-65478

    WordPress ListingPro plugin <= 2.9.10 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ListingPro <= 2.9.10 versions.

    Cridio Studio ListingPro
  • Medium 5.3
    CVE-2026-65476

    WordPress Civi theme <= 2.2.4 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Civi <= 2.2.4 versions.

    uxper Civi
  • Medium 5.3
    CVE-2026-65472

    WordPress Kit (formerly ConvertKit) plugin <= 3.3.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions.

    Kit Kit (formerly ConvertKit)
  • Medium 5.3
    CVE-2026-65469

    WordPress AWP Classifieds plugin <= 4.4.7 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions.

    Strategy11 Team AWP Classifieds
  • Medium 5.3
    CVE-2026-65468

    WordPress JetBooking plugin <= 4.1.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions.

    Crocoblock. Jetimpex JetBooking
  • Medium 4.3
    CVE-2026-65457

    WordPress ЮKassa для WooCommerce plugin <= 2.16.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions.

    yoomoney ЮKassa для WooCommerce Web / CMS
  • Medium 5.3
    CVE-2026-65452

    WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

    motov.net Ebook Store
  • Medium 5.3
    CVE-2026-65453

    WordPress Ebook Store plugin <= 6.19 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions.

    motov.net Ebook Store
  • Medium 4.3
    CVE-2026-61973

    WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

    Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

    WooLentor ShopLentor Pro
  • Medium 5.3
    CVE-2026-61972

    WordPress ShopLentor Pro plugin <= 2.8.5 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions.

    WooLentor ShopLentor Pro
  • Medium 6.5
    CVE-2026-59522

    WordPress WP ERP plugin <= 1.17.5 - Broken Access Control vulnerability

    Subscriber Broken Access Control in WP ERP <= 1.17.5 versions.

    wedevs WP ERP
  • Medium 6.5
    CVE-2026-57808

    WordPress WP EasyPay plugin <= 4.5.0 - Arbitrary Content Deletion vulnerability

    Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions.

    Saad Iqbal WP EasyPay
  • Medium 6.5
    CVE-2026-57717

    WordPress Knit Pay plugin <= 9.6.0.0 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions.

    Knit Pay Knit Pay
  • Medium 6.3
    CVE-2026-57703

    WordPress Sunshine Photo Cart plugin <= 3.6.10.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions.

    sunshinephotocart Sunshine Photo Cart
  • Medium 6.5
    CVE-2026-57425

    WordPress Autopay dla WooCommerce plugin <= 2.2.27 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions.

    WP Desk Autopay dla WooCommerce Web / CMS
  • Medium 4.3
    CVE-2026-27423

    WordPress Participants Database plugin <= 2.7.8.4 - Broken Access Control vulnerability

    Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions.

    Roland Barker Participants Database
  • Medium 5.3
    CVE-2026-27422

    WordPress YT Player plugin <= 2.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bPlugins YT Player yt-player allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YT Player: from n/a through 2.1.2.

    bPlugins YT Player
  • Medium 5.3
    CVE-2026-27418

    WordPress WP Fast Total Search plugin <= 1.81.282 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions.

    Epsiloncool WP Fast Total Search
  • Medium 5.3
    CVE-2026-27399

    WordPress MarketKing plugin <= 2.1.40 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions.

    WebWizards MarketKing
  • Medium 5.4
    CVE-2026-27391

    WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

    Subscriber Broken Access Control in uListing <= 2.2.0 versions.

    stylemix uListing
  • Medium 4.3
    CVE-2026-27392

    WordPress uListing plugin <= 2.2.0 - Broken Access Control vulnerability

    Contributor Broken Access Control in uListing <= 2.2.0 versions.

    stylemix uListing
  • Medium 6.7
    CVE-2026-27377

    WordPress QuickCal - Appointment Booking Calendar for WordPress plugin <= 1.0.16 - Broken Access Control vulnerability

    Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions.

    axiomthemes QuickCal - Appointment Booking Calendar for WordPress Web / CMS
  • Medium 5.3
    CVE-2026-27355

    WordPress Ditty plugin <= 3.1.66 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions.

    Metaphor Creations Ditty
  • Medium 5.4
    CVE-2026-25427

    WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability

    Subscriber Broken Access Control in eRoom <= 1.7.1 versions.

    DigitalME eRoom
  • Medium 5.3
    CVE-2026-25466

    WordPress WP Go Maps plugin <= 10.1.04 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions.

    WPGMaps WP Go Maps
  • Medium 4.3
    CVE-2026-25424

    WordPress Mediavine Control Panel plugin <= 2.10.10 - Broken Access Control vulnerability

    Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions.

    mediavine Mediavine Control Panel
  • Medium 5.3
    CVE-2026-15827

    GutenKit <= 2.4.12 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Mailchimp REST Endpoints

    The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/get/lists and /wp-json/gutenkit/v1/mailchimp/get/interests REST API endpoints in versions up to, and …

    Ataur R GutenKit – Page Builder Blocks, Patterns, and Templates for Gutenberg Block Editor Web / CMS
  • Medium 6.8
    CVE-2026-59677

    Process Kill Attack Vector in killall() in seunshare

    A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned processes running also in unconfined context This issue affects policycoreutils through 3.10.

    SELinux Project selinux policycoreutils policycoreutils Debian Ubuntu
  • Medium 6.8
    CVE-2026-7328

    Unverified AXI Address in Subsystem Mode Commands Enables Denial of Service

    Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a privileged local attacker to cause a denial of service via mailbox commands containing unverified AX…

    Caliptra Core Runtime Firmware