Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
10,628 results · Feed
-
Medium 5.3
Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook
The Wava Payment Plugin WordPress plugin before 0.3.10 does not verify the authenticity of incoming payment-provider notifications, nor restrict who may send them, allowing unauthenticated attackers to change the status of any WooCommerce order in the store, …
-
Medium 4.9
AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt
The AI Engine WordPress plugin before 3.8.6 does not check that the caller is allowed to edit the targeted object before updating its title and excerpt, allowing users with the Editor role and above to modify arbitrary posts of any type, including content the…
-
Medium 4.3
Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation
The Productive Commerce WordPress plugin before 1.1.49 does not perform a capability check in one of its AJAX actions and exposes the nonce that guards it on every admin-area page, allowing any authenticated user such as a subscriber to activate arbitrary Pro…
-
Medium 4.3
SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion
The SmartyParcel WordPress plugin before 1.23.4 does not perform authorisation checks when deleting shipping label records, allowing any authenticated user such as a subscriber to delete the shipping label and tracking records of arbitrary orders store-wide.
-
Medium 6.5
Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice
The Moloni WordPress plugin before 5.0.14 does not perform capability or nonce checks on several of its authenticated AJAX actions, relying only on whether the site holds a stored connection to its external invoicing provider, allowing any authenticated user …
-
High 8.2
Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live
The Backup and Staging by WP Time Capsule WordPress plugin before 1.22.28 does not perform capability or nonce checks on the handler that deploys a staging site to the live site, allowing any authenticated user with a Subscriber account on a WP Time Capsule s…
-
Medium 5.3
Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass
The Ettrick Escape Room Booking WordPress plugin before 1.3.1 does not verify a booking's payment status against the payment provider before marking it paid and confirmed, allowing unauthenticated attackers to mark bookings as paid without paying.
-
Medium 5.3
Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization
The Booking Package WordPress plugin before 1.7.31 does not perform any authorization or validity check before resetting its premium subscription state, allowing unauthenticated attackers to disable the Booking Package WordPress plugin before 1.7.31's paid fe…
-
Critical 9.8
HKUDS Vibe-Trading before 0.1.7 Missing Authentication in FastAPI Server Enabling RCE
HKUDS Vibe-Trading from 0.1.0 before 0.1.7 contains a missing authentication vulnerability that allows unauthenticated attackers to access the FastAPI surface because require_auth() returns early when API_AUTH_KEY is unset. Attackers can post messages to /ses…
-
Medium 6.5
Trigger.dev before 4.5.4 Hardcoded Coordinator Secret Authentication Bypass via Socket.IO
Trigger.dev before 4.5.4 contains a hardcoded default secret vulnerability in the /coordinator Socket.IO namespace that allows unauthenticated attackers to connect using the published coordinator-secret value. Attackers can emit READY_FOR_EXECUTION to retriev…
-
High 8.1
Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials
Trigger.dev before 4.6.2 contains an authorization vulnerability that allows public-token holders with session write access to obtain environment-wide S2 stream credentials via session input initialization. Attackers can use the credential directly against th…
-
Low 3.1
Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route
Trigger.dev before 4.5.12 contains an authorization bypass vulnerability that allows authenticated project members to complete another member's DEVELOPMENT environment waitpoint by skipping the per-user environment ownership check. Attackers who know a victim…
-
Medium 4.3
ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that lets authenticated users read other databases' schema metadata. Attackers with credentials for one database can set the db field in RUN or BEG…
-
Medium 4.3
ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure
ArcadeDB from 26.2.1 before 26.10.1 contains a missing authorization vulnerability in the Bolt protocol handler that allows authenticated users to enumerate all database names. Attackers with credentials for any single database can issue a SHOW DATABASES quer…
-
Medium 4.3
ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH
ArcadeDB from 26.8.1 before 26.10.1 contains an authorization bypass vulnerability that allows read-only users to modify edge type lightweight and unique schema flags without UPDATE_SCHEMA permission. Attackers can send a bare ALTER TYPE edgeType WITH lightwe…
-
Medium 4.3
Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing). Supported versions th…
-
Medium 4.1
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supp…
-
Medium 6.6
Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supp…
-
Low 2.9
Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Porting). Supported ver…
-
High 8.8
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensitive…
-
High 8.8
Missing authorization in Actor in Google Chrome on on Android prior to 156.0.8078.47 allowed a local attacker to spoof …
-
High 8.8
Missing authorization in Editing in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass system acc…
-
High 8.8
Missing authorization in Google Lens in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromi…
-
High 8.8
Missing authorization in Media in Google Chrome on on Android prior to 156.0.8078.47 allowed a remote attacker who had …
-
Critical 9.6
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system acc…
-
Medium 6.5
Missing authorization in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromis…
-
High 8.8
Missing authorization in BrowserTag in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromis…
-
Critical 9.6
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a local attacker to bypass system acc…
-
High 8.8
Missing authorization in Scheduling in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain sensiti…
-
High 8.8
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social e…
-
Medium 6.5
Missing authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised th…
-
High 8.8
Missing authorization in DevTools in Google Chrome prior to 156.0.8078.47 allowed a remote attacker leveraging social e…
-
High 8.8
Missing authorization in UI in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the r…
-
High 8.8
Missing authorization in Extensions in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to bypass web ori…
-
Critical 9.6
Missing authorization in Passwords in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromise…
-
High 8.8
Missing authorization in API in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised the …
-
High 8.8
Missing authorization in SiteIsolation in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compro…
-
Medium 6.5
Missing authorization in Actor in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromised th…
-
Critical 9.6
Missing authorization in Internals in Google Chrome prior to 156.0.8078.47 allowed a remote attacker who had compromise…
-
High 8.8
Missing authorization in DOM in Google Chrome prior to 156.0.8078.47 allowed a remote attacker to obtain cross-origin d…