Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
7,354 results · Clear filters · Feed
-
Medium 6.5
WordPress WooCommerce Anti-Fraud plugin <= 7.2.6 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions.
-
Medium 6.5
WordPress WPBakery Page Builder plugin <= 8.7.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions.
-
Medium 4.3
WordPress Bricks Builder theme <= 2.1.4 - Broken Access Control vulnerability
Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions.
-
Medium 4.7
WordPress W3 Total Cache plugin <= 2.9.1 - Broken Access Control vulnerability
Author Broken Access Control in W3 Total Cache <= 2.9.1 versions.
-
Medium 4.3
WordPress MetForm Pro plugin <= 3.9.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in MetForm Pro <= 3.9.1 versions.
-
Medium 4.3
WordPress WishList Member X plugin <= 3.29.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in WishList Member X <= 3.29.0 versions.
-
Medium 5.5
WordPress Yoast SEO Premium plugin <= 26.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Yoast SEO Premium: from n/a through 26.6.
-
Medium 5.3CVE-2026-8383 Scanner template
LearnPress < 4.3.7 - Unauthenticated Sensitive User Information Disclosure via REST API
The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthenticated visitors to retrieve each returned user's roles, full capabilities map, extra capabilities, …
-
Medium 4.8
Postiz has an unauthenticated billing-enforcement bypass via /public/modify-subscription
Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscription-enforcement side effects to the organization referenced in that token's claims, without verifyin…
-
Medium 6.5
WordPress WPAMS plugin < 49.5.3 - Arbitrary Content Deletion vulnerability
Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions.
-
Medium 6.5
WordPress Genemy theme <= 1.6.6 - Broken Access Control vulnerability
Subscriber Broken Access Control in Genemy <= 1.6.6 versions.
-
Medium 4.0
In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to …
-
Medium 4.0
In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local informatio…
-
Medium 6.5
Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments vi…
-
Medium 5.3
OpenClaw < 2026.5.12 - Slack Reaction Event Notification Bypass
OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction notifications. Attackers can trigger unintended agent processing by sending reaction events when the fe…
-
Medium 5.5
OpenClaw < 2026.4.25 - Control Scope Enforcement Bypass in Focus Command
OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the command without proper authorization checks. Attackers can trigger the focus command to change focus stat…
-
Medium 6.5
OpenClaw < 2026.4.29 - Session Visibility Check Bypass in Shared Memory Search
OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory entries without proper authorization. Attackers can skip session visibility guards on the search path…
-
Medium 6.9
Improper Authorization of Break Signal Commands in Devices
A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does not properly validate whether a sender is associated with a valid data port session before accepting break signal comm…
-
Medium 6.5
WooCommerce Stripe Payment Gateway <= 10.7.0 - Missing Authorization to Unauthenticated Order Status Manipulation via 'order' Parameter
The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_pay_for_order()` function in all versions up to, and including, 10.7.0 This is due to a missing order…
-
Medium 6.5
WordPress Metro Magazine theme <= 1.4.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Metro Magazine: from n/a through 1.4.1.
-
Medium 6.5
WordPress Envira Photo Gallery plugin <= 1.12.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions.
-
Medium 5.3
Abandoned Contact Form 7 <= 2.2 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'recover_id' Parameter
The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a missing capability check and missing nonce validation in the action__remove_abandoned() function, w…
-
Medium 5.3
Video Conferencing with Zoom <= 4.6.7 - Missing Authorization to Unauthenticated Zoom SDK Credential Exposure via 'get_auth' AJAX Action
The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible fo…
-
Medium 6.5
WordPress Welcart e-Commerce plugin <= 2.11.28 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions.
-
Medium 6.5
WordPress JS Help Desk plugin <= 3.0.9 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions.
-
Medium 6.5
WordPress Advanced Form Integration plugin <= 1.126.12 - Broken Access Control vulnerability
Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions.
-
Medium 6.3
WordPress Classified Listing plugin <= 5.3.9 - Broken Access Control vulnerability
Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions.
-
Medium 6.5
WordPress Classified Listing plugin <= 5.3.8 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions.
-
Medium 6.5
WordPress myCred plugin <= 3.0.3 - Broken Access Control vulnerability
Subscriber Broken Access Control in myCred <= 3.0.3 versions.
-
Medium 6.5
WordPress Amelia plugin <= 2.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in Amelia <= 2.2 versions.
-
Medium 6.5
WordPress Groundhogg plugin < 4.4.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in Groundhogg < 4.4.1 versions.
-
Medium 6.5
WordPress WPAdverts plugin <= 2.3.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions.
-
Medium 6.5
WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.9 - Broken Access Control vulnerability
Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions.
-
Medium 6.5
WordPress Tutor LMS plugin <= 3.9.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions.
-
Medium 6.4
WordPress Ultra Addons for WPForms plugin <= 1.0.11 - Broken Access Control vulnerability
Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions.
-
Medium 6.5
WordPress RepairBuddy plugin <= 4.1132 - Broken Access Control vulnerability
Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions.
-
Medium 6.5
WordPress Booking Activities plugin <= 1.16.48.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions.
-
Medium 6.5
WordPress Motors plugin < 1.4.107 - Broken Access Control vulnerability
Subscriber Broken Access Control in Motors < 1.4.107 versions.
-
Medium 6.5
WordPress Rank Math SEO plugin <= 1.0.271 - Broken Access Control vulnerability
Missing Authorization vulnerability in Rank Math SEO Rank Math SEO seo-by-rank-math allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Rank Math SEO: from n/a through 1.0.271.
-
Medium 5.3
WordPress Essential Addons for Elementor plugin < 6.6.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions.