Skip to content
OpenAdvisories

Weakness (CWE)

CWE-862: Missing Authorization

Class Incomplete

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

How to prevent it (5 mitigations)

  1. Architecture and Design

    Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.

    Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

  2. Architecture and Design

    Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

  3. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

    For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

  4. Architecture and Design

    For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.

    One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

  5. System Configuration, Installation

    Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

Source: MITRE CWE-862

All Critical High Medium Low Exploited only Public exploit

7,357 results · Clear filters · Feed

  • Medium 5.3
    CVE-2026-22445

    WordPress Apimo Connector plugin <= 2.6.5.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Proptech Plugin Apimo Connector apimo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Apimo Connector: from n/a through <= 2.6.5.2.

    Proptech Plugin Apimo Connector
  • Medium 5.3
    CVE-2026-22348

    WordPress Civic Cookie Control plugin <= 1.53 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Tasos Fel Civic Cookie Control civic-cookie-control-8 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Civic Cookie Control: from n/a through <= 1.53.

    Tasos Fel Civic Cookie Control
  • Medium 6.5
    CVE-2025-69315

    WordPress Simply Schedule Appointments plugin <= 1.6.9.15 - Broken Access Control vulnerability

    Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simply Schedule Appointments: from n/a through <= 1.6.9.15.

    N Squared Simply Schedule Appointments
  • Medium 5.4
    CVE-2025-69300

    WordPress Premium Addons for Elementor plugin <= 4.11.63 - Settings Change vulnerability

    Missing Authorization vulnerability in Leap13 Premium Addons for Elementor premium-addons-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Premium Addons for Elementor: from n/a through <= 4.11.63.

    leap13 Premium Addons for Elementor
  • Medium 6.5
    CVE-2025-69095

    WordPress Reservation Plugin plugin <= 1.7 - Settings Change vulnerability

    Missing Authorization vulnerability in designthemes Reservation Plugin dt-reservation-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reservation Plugin: from n/a through <= 1.7.

    Design themes Reservation Plugin
  • Medium 6.5
    CVE-2025-68911

    WordPress Solace theme <= 2.1.16 - Broken Access Control vulnerability

    Missing Authorization vulnerability in solacewp Solace solace allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Solace: from n/a through <= 2.1.16.

    solacewp Solace
  • Medium 6.5
    CVE-2025-68896

    WordPress WDV One Page Docs plugin <= 1.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in vrpr WDV One Page Docs wdv-one-page-docs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WDV One Page Docs: from n/a through <= 1.2.4.

    vrpr WDV One Page Docs
  • Medium 6.5
    CVE-2025-68558

    WordPress Depicter Slider plugin <= 4.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in averta Depicter Slider depicter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Depicter Slider: from n/a through <= 4.0.4.

    Averta Depicter Slider
  • Medium 6.5
    CVE-2025-68073

    WordPress GDPR CCPA Compliance Support plugin <= 2.7.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ninja Team GDPR CCPA Compliance Support ninja-gdpr-compliance allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GDPR CCPA Compliance Support: from n/a through <= 2.7.4.

    Ninja Team GDPR CCPA Compliance Support
  • Medium 6.5
    CVE-2025-68507

    WordPress Icegram plugin <= 3.1.35 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Icegram Icegram icegram allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Icegram: from n/a through <= 3.1.35.

    Icegram Icegram
  • Medium 6.5
    CVE-2025-68072

    WordPress Easy Property Listings plugin <= 3.5.20 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Merv Barrett Easy Property Listings easy-property-listings allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Property Listings: from n/a through <= 3.5.20.

    Merv Barrett Easy Property Listings
  • Medium 6.5
    CVE-2025-68039

    WordPress WP BackItUp plugin <= 2.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Chris Simmons WP BackItUp wp-backitup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP BackItUp: from n/a through <= 2.1.0.

    Chris Simmons WP BackItUp
  • Medium 6.5
    CVE-2025-68020

    WordPress Notifier plugin <= 2.7.13 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WANotifier Notifier notifier allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Notifier: from n/a through <= 2.7.13.

    WANotifier Notifier
  • Medium 6.5
    CVE-2025-68019

    WordPress SEO Booster plugin <= 6.1.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in cleverplugins SEO Booster seo-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEO Booster: from n/a through <= 6.1.8.

    Clever plugins SEO Booster
  • Medium 6.5
    CVE-2025-68016

    WordPress onepay Payment Gateway For WooCommerce plugin <= 1.1.2 - Other Vulnerability Type vulnerability

    Missing Authorization vulnerability in Onepay Sri Lanka onepay Payment Gateway For WooCommerce onepay-payment-gateway-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects onepay Payment Gateway For WooComm…

    Onepay Sri Lanka onepay Payment Gateway For WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-68013

    WordPress Payment Gateway Authorize.Net CIM for WooCommerce plugin <= 2.1.2 - Arbitrary Content Deletion vulnerability

    Missing Authorization vulnerability in cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce authnet-cim-for-woo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway Authorize.Net CIM for WooC…

    cardpaysolutions Payment Gateway Authorize.Net CIM for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-68009

    WordPress Slider Templates plugin <= 1.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Codeless Slider Templates slider-templates allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Slider Templates: from n/a through <= 1.0.3.

    Codeless Slider Templates
  • Medium 6.5
    CVE-2025-68007

    WordPress Event Espresso 4 Decaf plugin <= 5.0.37.decaf - Settings Change vulnerability

    Missing Authorization vulnerability in Event Espresso Event Espresso 4 Decaf event-espresso-decaf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Espresso 4 Decaf: from n/a through <= 5.0.37.decaf.

    Event Espresso Event Espresso 4 Decaf
  • Medium 6.5
    CVE-2025-68003

    WordPress Shown Connector plugin <= 1.2.10 - Settings Change vulnerability

    Missing Authorization vulnerability in renatoatshown Shown Connector shown-connector allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shown Connector: from n/a through <= 1.2.10.

    renatoatshown Shown Connector
  • Medium 6.5
    CVE-2025-67958

    WordPress TaxCloud for WooCommerce plugin <= 8.3.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Taxcloud TaxCloud for WooCommerce simple-sales-tax allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects TaxCloud for WooCommerce: from n/a through <= 8.3.8.

    Taxcloud TaxCloud for WooCommerce Web / CMS
  • Medium 6.5
    CVE-2025-67939

    WordPress Tickera plugin <= 3.5.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Tickera Tickera tickera-event-ticketing-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tickera: from n/a through <= 3.5.6.2.

    Tickera Tickera
  • Medium 6.5
    CVE-2025-67942

    WordPress Peach Payments Gateway plugin <= 3.3.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Peach Payments Gateway: from n/a through <= 3.3.6.

    Peach Payments Peach Payments Gateway
  • Medium 5.4
    CVE-2025-66142

    WordPress Comparimager for Elementor plugin <= 1.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Comparimager for Elementor comparimager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comparimager for Elementor: from n/a through <= 1.0.1.

    merkulove Comparimager for Elementor
  • Medium 5.4
    CVE-2025-66140

    WordPress Uper for Elementor plugin <= 1.0.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Uper for Elementor uper-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uper for Elementor: from n/a through <= 1.0.5.

    merkulove Uper for Elementor
  • Medium 5.4
    CVE-2025-66139

    WordPress Audier For Elementor plugin <= 1.0.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Audier For Elementor audier-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Audier For Elementor: from n/a through <= 1.0.9.

    merkulove Audier For Elementor
  • Medium 5.4
    CVE-2025-66141

    WordPress Scroller plugin <= 2.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Scroller scroller allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Scroller: from n/a through <= 2.0.2.

    merkulove Scroller
  • Medium 5.4
    CVE-2025-66143

    WordPress Crumber plugin <= 1.0.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Crumber crumber-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Crumber: from n/a through <= 1.0.10.

    merkulove Crumber
  • Medium 5.4
    CVE-2025-66138

    WordPress Motionger for Elementor plugin <= 2.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Motionger for Elementor motionger-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Motionger for Elementor: from n/a through <= 2.0.4.

    merkulove Motionger for Elementor
  • Medium 5.4
    CVE-2025-66136

    WordPress Carter for Elementor plugin <= 1.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Carter for Elementor carter-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Carter for Elementor: from n/a through <= 1.0.2.

    merkulove Carter for Elementor
  • Medium 5.4
    CVE-2025-66137

    WordPress Searcher for Elementor plugin <= 1.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Searcher for Elementor searcher-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Searcher for Elementor: from n/a through <= 1.0.3.

    merkulove Searcher for Elementor
  • Medium 5.4
    CVE-2025-66135

    WordPress Imager for Elementor plugin <= 2.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in merkulove Imager for Elementor imager-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Imager for Elementor: from n/a through <= 2.0.4.

    merkulove Imager for Elementor
  • Medium 4.3
    CVE-2025-63018

    WordPress Bard theme <= 2.229 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wproyal Bard bard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bard: from n/a through <= 2.229.

    WP Royal Bard
  • Medium 5.4
    CVE-2025-62106

    WordPress WP-CRM System plugin <= 3.4.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mario Peshev WP-CRM System wp-crm-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP-CRM System: from n/a through <= 3.4.5.

    Mario Peshev WP-CRM System
  • Medium 5.3
    CVE-2025-62754

    WordPress Payment Gateway bKash for WC plugin <= 3.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Kapil Paul Payment Gateway bKash for WC woo-payment-bkash allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Payment Gateway bKash for WC: from n/a through <= 3.1.0.

    Kapil Paul Payment Gateway bKash for WC
  • Medium 6.5
    CVE-2025-5805

    WordPress Electron theme <= 1.8.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ninetheme Electron electron allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Electron: from n/a through <= 1.8.2.

    Ninetheme Electron
  • Medium 6.5
    CVE-2025-54002

    WordPress xSmart theme <= 1.2.9.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Jthemes xSmart xsmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects xSmart: from n/a through <= 1.2.9.4.

    Jthemes xSmart
  • Medium 5.4
    CVE-2025-49375

    WordPress HomeLancer theme <= 1.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in cozythemes HomeLancer homelancer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeLancer: from n/a through <= 1.0.1.

    CozyThemes HomeLancer
  • Medium 5.3
    CVE-2026-1036

    Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.36 - Missing Authorization to Unauthenticated Arbitrary Comment Deletion

    The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_comment() function in all versions up to, and including, 1.8.36. This makes it p…

    10web Photo Gallery by 10Web – Mobile-Friendly Image Gallery Web / CMS
  • Medium 5.3
    CVE-2026-23990

    Flux Operator Web UI Impersonation Bypass via Empty OIDC Claims

    The Flux Operator is a Kubernetes CRD controller that manages the lifecycle of CNCF Flux CD and the ControlPlane enterprise distribution. Starting in version 0.36.0 and prior to version 0.40.0, a privilege escalation vulnerability exists in the Flux Operator …

    controlplaneio-fluxcd flux-operator github.com/controlplaneio-fluxcd/flux-operator Go
  • Medium 6.3
    CVE-2026-23517

    Fleet has an Access Control vulnerability in debug/pprof endpoints

    Fleet is open source device management software. A broken access control issue in versions prior to 4.78.3, 4.77.1, 4.76.2, 4.75.2, and 4.53.3 allowed authenticated users to access debug and profiling endpoints regardless of role. As a result, low-privilege u…

    fleetdm fleet github.com/fleetdm/fleet/v4 github.com/fleetdm/fleet Go