Skip to content
OpenAdvisories

Weakness (CWE)

CWE-862: Missing Authorization

Class Incomplete

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

How to prevent it (5 mitigations)

  1. Architecture and Design

    Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.

    Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

  2. Architecture and Design

    Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

  3. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

    For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

  4. Architecture and Design

    For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.

    One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

  5. System Configuration, Installation

    Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

Source: MITRE CWE-862

All Critical High Medium Low Exploited only Public exploit

7,357 results · Clear filters · Feed

  • Medium 5.3
    CVE-2025-62147

    WordPress Realbig plugin <= 1.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in nikmelnik Realbig realbig-media allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Realbig: from n/a through <= 1.1.3.

    nikmelnik Realbig
  • Medium 5.3
    CVE-2025-62081

    WordPress Live Shopping & Shoppable Videos For WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce live-shopping-video-streams allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Live Shopping & Shoppable Videos …

    Channelize.io Team Live Shopping & Shoppable Videos For WooCommerce Web / CMS
  • Medium 5.3
    CVE-2025-63001

    WordPress Hotel Booking plugin <= 3.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in nicdark Hotel Booking nd-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Hotel Booking: from n/a through <= 3.8.

    nicdark Hotel Booking
  • Medium 5.3
    CVE-2025-49349

    WordPress Reuters Direct plugin <= 3.0.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Reuters News Agency Reuters Direct reuters-direct allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Reuters Direct: from n/a through <= 3.0.0.

    Reuters News Agency Reuters Direct
  • Medium 5.4
    CVE-2025-62098

    WordPress Portfolio Gallery plugin <= 1.4.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in totalsoft Portfolio Gallery gallery-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Portfolio Gallery: from n/a through <= 1.4.8.

    Total-Soft Portfolio Gallery
  • Medium 5.4
    CVE-2025-62091

    WordPress Serial Codes Generator and Validator with WooCommerce Support plugin <= 2.8.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Vollstart Serial Codes Generator and Validator with WooCommerce Support serial-codes-generator-and-validator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Serial Codes Generat…

    Vollstart Serial Codes Generator and Validator with WooCommerce Support Web / CMS
  • Medium 5.4
    CVE-2025-62108

    WordPress Add Custom Codes plugin <= 4.80 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SaifuMak Add Custom Codes add-custom-codes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Add Custom Codes: from n/a through <= 4.80.

    SaifuMak Add Custom Codes
  • Medium 5.4
    CVE-2025-62888

    WordPress WP Attachments plugin <= 5.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Marco Milesi WP Attachments wp-attachments allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Attachments: from n/a through <= 5.2.

    Marco Milesi WP Attachments
  • Medium 5.4
    CVE-2025-62138

    WordPress WP Advanced PDF plugin <= 1.1.7 - Other vulnerability Type vulnerability

    Missing Authorization vulnerability in cedcommerce WP Advanced PDF wp-advanced-pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Advanced PDF: from n/a through <= 1.1.7.

    cedcommerce WP Advanced PDF
  • Medium 5.4
    CVE-2025-62144

    WordPress Core Web Vitals & PageSpeed Booster plugin <= 1.0.28 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mohammed Kaludi Core Web Vitals & PageSpeed Booster core-web-vitals-pagespeed-booster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Core Web Vitals & PageSpeed Booster: from n…

    mohammed_kaludi Core Web Vitals & PageSpeed Booster
  • Medium 4.3
    CVE-2024-58337

    Akuvox Smart Intercom S539 Improper Access Control via ServicesHTTPAPI

    Akuvox Smart Intercom S539 contains an improper access control vulnerability that allows users with 'User' privileges to modify API access settings and configurations. Attackers can exploit this vulnerability to escalate privileges and gain unauthorized acces…

    The Akuvox Company Akuvox Smart Intercom Akuvox Smart Doorphone
  • Medium 4.3
    CVE-2025-62128

    WordPress SiteLock Security plugin <= 5.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans sitelock allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteLock Security – WP Hardening, Login Securi…

    SiteLock SiteLock Security – WP Hardening, Login Security & Malware Scans
  • Medium 5.3
    CVE-2025-66080

    WordPress WP Cookie Notice for GDPR, CCPA & ePrivacy Consent plugin <= 4.0.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent gdpr-cookie-consent allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Cookie Notice for GDPR, CCPA & ePrivacy …

    WP Legal Pages WP Cookie Notice for GDPR, CCPA & ePrivacy Consent
  • Medium 4.3
    CVE-2025-14426

    Strong Testimonials <= 3.2.18 - Missing Authorization to Authenticated (Contributor+) Rating Meta Update

    The Strong Testimonials plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check in the 'edit_rating' function in all versions up to, and including, 3.2.18. This makes it possible for authenticated attackers wi…

    WP Chill Strong Testimonials Web / CMS
  • Medium 5.3
    CVE-2025-69093

    WordPress ShopMagic plugin <= 4.7.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpdesk ShopMagic shopmagic-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopMagic: from n/a through <= 4.7.2.

    WP Desk ShopMagic
  • Medium 4.3
    CVE-2025-69091

    WordPress Demo Importer Plus plugin <= 2.0.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Kraft Plugins Demo Importer Plus demo-importer-plus allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Demo Importer Plus: from n/a through <= 2.0.8.

    Kraft Plugins Demo Importer Plus
  • Medium 5.3
    CVE-2025-69031

    WordPress Arcane theme <= 3.6.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Skywarrior Arcane arcane allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arcane: from n/a through <= 3.6.6.

    Skywarrior Arcane
  • Medium 5.3
    CVE-2025-69028

    WordPress weForms plugin <= 1.6.25 - Broken Access Control vulnerability

    Missing Authorization vulnerability in BoldGrid weForms weforms allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects weForms: from n/a through <= 1.6.25.

    Bold Grid weForms
  • Medium 5.3
    CVE-2025-69027

    WordPress Product Delivery Date for WooCommerce – Lite plugin <= 3.2.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in tychesoftwares Product Delivery Date for WooCommerce – Lite product-delivery-date-for-woocommerce-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Delivery Date for …

    Tyche Softwares Product Delivery Date for WooCommerce – Lite Web / CMS
  • Medium 5.4
    CVE-2025-69022

    WordPress HR Management Lite plugin <= 3.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Weblizar - WordPress Themes & Plugin HR Management Lite hr-management-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HR Management Lite: from n/a through <= 3.6.

    Weblizar – WordPress Themes & Plugin HR Management Lite
  • Medium 4.3
    CVE-2025-69023

    WordPress Discussion Board plugin <= 2.5.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Marketing Fire Discussion Board wp-discussion-board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Discussion Board: from n/a through <= 2.5.7.

    Marketing Fire Discussion Board
  • Medium 6.5
    CVE-2025-69024

    WordPress BizPrint plugin <= 4.6.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bizswoop BizPrint print-google-cloud-print-gcp-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BizPrint: from n/a through <= 4.6.7.

    bizswoop BizPrint
  • Medium 4.3
    CVE-2025-69016

    WordPress Shortcodes and extra features for Phlox theme plugin <= 2.17.22 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Averta LTD Shortcodes and extra features for Phlox theme auxin-elements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Shortcodes and extra features for Phlox theme: from n/a t…

    Averta Shortcodes and extra features for Phlox theme
  • Medium 4.3
    CVE-2025-69013

    WordPress Stratum plugin <= 1.6.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in jetmonsters Stratum stratum allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Stratum: from n/a through <= 1.6.1.

    jetmonsters Stratum
  • Medium 4.3
    CVE-2025-69012

    WordPress Event Organiser plugin <= 3.12.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Stephen Harris Event Organiser event-organiser allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Event Organiser: from n/a through <= 3.12.8.

    Stephen Harris Event Organiser
  • Medium 5.3
    CVE-2025-69010

    WordPress Themebeez Toolkit plugin <= 1.3.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in themebeez Themebeez Toolkit themebeez-toolkit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Themebeez Toolkit: from n/a through <= 1.3.5.

    themebeez Themebeez Toolkit
  • Medium 5.3
    CVE-2025-69009

    WordPress Medicalequipment theme <= 1.0.9 - Broken Access Control vulnerability

    Missing Authorization vulnerability in kamleshyadav Medicalequipment medicalequipment allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Medicalequipment: from n/a through <= 1.0.9.

    kamleshyadav Medicalequipment
  • Medium 5.3
    CVE-2025-68994

    WordPress Product Loops for WooCommerce plugin <= 2.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in XforWooCommerce Product Loops for WooCommerce product-loops allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Product Loops for WooCommerce: from n/a through <= 2.1.2.

    XforWooCommerce Product Loops for WooCommerce Web / CMS
  • Medium 4.3
    CVE-2025-68995

    WordPress My Sticky Elements plugin <= 2.3.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Premio My Sticky Elements mystickyelements allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects My Sticky Elements: from n/a through <= 2.3.3.

    Premio My Sticky Elements
  • Medium 5.3
    CVE-2025-68993

    WordPress Share, Print and PDF Products for WooCommerce plugin <= 3.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in XforWooCommerce Share, Print and PDF Products for WooCommerce share-print-pdf-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Share, Print and PDF Products for WooCo…

    XforWooCommerce Share, Print and PDF Products for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2025-68982

    WordPress DesignThemes LMS Addon plugin <= 2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in designthemes DesignThemes LMS Addon designthemes-lms-addon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DesignThemes LMS Addon: from n/a through <= 2.6.

    Design themes DesignThemes LMS Addon
  • Medium 5.3
    CVE-2025-68981

    WordPress HomeFix Elementor Portfolio plugin <= 1.0.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in designthemes HomeFix Elementor Portfolio homefix-ele-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects HomeFix Elementor Portfolio: from n/a through <= 1.0.1.

    Design themes HomeFix Elementor Portfolio
  • Medium 5.4
    CVE-2025-68976

    WordPress Eagle Booking plugin <= 1.3.4.3 - Settings Change vulnerability

    Missing Authorization vulnerability in Eagle-Themes Eagle Booking eagle-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Eagle Booking: from n/a through <= 1.3.4.3.

    Eagle-Themes Eagle Booking
  • Medium 5.3
    CVE-2025-68980

    WordPress WeDesignTech Portfolio plugin <= 1.0.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in designthemes WeDesignTech Portfolio wedesigntech-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WeDesignTech Portfolio: from n/a through <= 1.0.2.

    Design themes WeDesignTech Portfolio
  • Medium 5.4
    CVE-2023-41656

    WordPress Better Elementor Addons plugin <= 1.3.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpdive Better Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Better Elementor Addons: from n/a through 1.3.7.

    wpdive Better Elementor Addons
  • Medium 6.5
    CVE-2025-68498

    WordPress JetTabs plugin <= 2.2.12 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Crocoblock JetTabs jet-tabs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetTabs: from n/a through <= 2.2.12.

    Crocoblock JetTabs
  • Medium 6.5
    CVE-2025-68503

    WordPress JetBlog plugin <= 2.4.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Crocoblock JetBlog jet-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JetBlog: from n/a through <= 2.4.7.

    Crocoblock JetBlog
  • Medium 5.5
    CVE-2025-15070

    Data Exposure in Gmission Web FAX

    Exposure of Sensitive Information to an Unauthorized Actor, Missing Authorization vulnerability in Gmission Web Fax allows Authentication Abuse. This issue affects Web Fax: from 3.0 before 3.0.1

    Gmission Web Fax
  • Medium 6.2
    CVE-2025-15066

    Arbitrary File Download through Path Traversal in Innorix WP

    Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Missing Authorization vulnerability in Innorix WP allows Path Traversal.This issue affects Innorix WP from All versions If the "exam" directory exists under the directory where th…

    Innorix Innorix WP
  • Medium 6.7
    CVE-2025-36192

    Missing Authorization with the DS8900F and DS8A00 Hardware Management Console

    IBM DS8A00( R10.1) 10.10.106.0 and IBM DS8A00 ( R10.0) 10.1.3.010.2.45.0 and IBM DS8900F ( R9.4) 89.40.83.089.42.18.089.44.5.0 IBM System Storage DS8000 could allow a local user with authorized CCW update permissions to delete or corrupt backups due to missin…

    IBM DS8900F ( R9.4) DS8A00( R10.1) DS8A00 ( R10.0)