Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
7,354 results · Clear filters · Feed
-
Medium 4.3
WordPress Nelio Content plugin <= 4.3.4 - Broken Access Control vulnerability
Contributor Broken Access Control in Nelio Content <= 4.3.4 versions.
-
Medium 4.3
WordPress Shoppable Images Lite plugin <= 1.3 - Broken Access Control vulnerability
Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions.
-
Medium 4.3
WordPress MasterStudy LMS plugin <= 3.7.30 - Broken Access Control vulnerability
Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions.
-
Medium 5.4
WordPress Email Marketing for WooCommerce by Omnisend plugin <= 1.19.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions.
-
Medium 4.3
WordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerability
Subscriber Broken Access Control in WPCafe <= 3.0.14 versions.
-
Medium 4.3
WordPress SEOPress PRO plugin <= 9.1.1 - Broken Access Control vulnerability
Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions.
-
Medium 6.5
WordPress GIFT4U plugin <= 1.0.10 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions.
-
Medium 5.8
WordPress Flash & HTML5 Video plugin <= 2.11.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions.
-
Medium 6.5
WordPress User Registration plugin <= 5.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions.
-
Medium 5.3
WordPress SiteGround Email Marketing plugin <= 1.7.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions.
-
Medium 5.3
WordPress Donation Thermometer plugin <= 2.2.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions.
-
Medium 4.3
WordPress Live Copy Paste for Elementor plugin <= 1.5.3 - Broken Access Control vulnerability
Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions.
-
Medium 4.3
WordPress Restaurant Menu by MotoPress plugin <= 2.4.11 - Broken Access Control vulnerability
Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.
-
Medium 5.4
WordPress Forget About Shortcode Buttons plugin <= 2.1.3 - Broken Access Control vulnerability
Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions.
-
Medium 4.3
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags
-
Medium 5.3
In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying p…
-
Medium 4.3
In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment t…
-
Medium 6.5
User Registration & Membership <= 5.2.0 - Missing Authorization to Unauthenticated Payment Bypass
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing validation checks i…
-
Medium 4.3
Bitwarden Server < 2026.5.0 Broken Access Control via PreviewInvoiceController
Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing data by supplying an arbitrary organizationId to the PreviewInvoiceController endpoints without members…
-
Medium 4.2
Improper Access Control in Mattermost Google Drive Plugin File Creation Endpoint
The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a connected Google account to share Google Drive files to unauthorized private channels and disclose …
-
Medium 6.5
LibreChat: Image Upload Route Bypasses Agent Permission Check — Incomplete Fix for File Upload Authorization
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated user to upload files into any agent's tool_resources (e.g., context, execute_code) without verifying o…
-
Medium 5.3
LibreChat: IDOR in Message Deletion — Incomplete Fix for CVE-2024-41703 Leaves deleteMessages() Without User Filter
LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId endpoint allows any authenticated user to delete any other user's messages. The validateMessageReq middleware o…
-
Medium 6.5
Joomla Extension - getk2.org - Unauthenticated folder delete in K2 extension for Joomla < 2.26
The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::delete()` call under `/media/k2/galleries/`
-
Medium 6.5
WordPress Slim SEO plugin <= 4.6.2 - Broken Access Control vulnerability
Contributor Broken Access Control in Slim SEO <= 4.6.2 versions.
-
Medium 5.4
WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.2 - Broken Access Control vulnerability
Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions.
-
Medium 6.5
WordPress Elementor Website Builder plugin <= 4.1.3 - Sensitive Data Exposure vulnerability
Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions.
-
Medium 5.3
Missing Authorization in GitLab
GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain conditions could have allowed an unauthenticated user to view confidential issue references on public…
-
Medium 4.2
Jenkins Zowe zDevOps Plugin has a missing permission check
A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capt…
-
Medium 5.4
Jenkins Assembla Plugin has a missing permission check
A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username and password.
-
Medium 4.3
Jenkins Contrast Continuous Application Security Plugin missing permission checks
Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate the names of configured Contrast metadata.
-
Medium 4.3
Jenkins MCP Server Plugin missing a permission check
A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay scripts of jobs they can access.
-
Medium 5.4
Jenkins Contrast Continuous Application Security Plugin has a missing permission check
A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key.
-
Medium 5.4
Jenkins EC2 Fleet Plugin has a missing permission check
A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturi…
-
Medium 4.3
Jenkins Gitee Plugin has an incorrect permission check that allows enumerating credentials IDs
An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permission (while lacking Item/Configure permission on any particular job) to enumerate credentials IDs of credentials stored i…
-
Medium 5.4
Jenkins Gitee Plugin missing permission checks
Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method.
-
Medium 4.3
Jenkins Git Parameter Plugin has a missing permission check that allows listing SCM branch and tag names
A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information about the SCM repository used by a job, such as branch names, tag names, and revision metadata.
-
Medium 4.3
Jenkins GitHub Branch Source Plugin has missing permission check that allows enumerating GitHub Enterprise server URLs
A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain the URLs of GitHub Enterprise servers configured in the global plugin configuration.
-
Medium 5.3
RentMy Real-Time Rental Management Plugin <= 4.0.4.1 - Missing Authorization to Unauthenticated Settings Update via rentmy_cdn_request AJAX Action
The RentMy Real-Time Rental Management Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.4.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes…
-
Medium 4.3
Advance Nav Menu Manager <= 1.3 - Missing Authorization to Authenticated (Subscriber+) Nav Menu Item Modification via anmm_save_menu_data AJAX Action
The Advance Nav Menu Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.3. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for auth…
-
Medium 5.3
Devs Accounting <= 1.2.0 - Missing Authorization to Unauthenticated Account Deletion via /delete-account/ REST Endpoint
The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to unauthorized modification/deletion of data due to a missing capability check on the delete_single_account() function in versions up to, and including, 1.2.0. …