Skip to content
OpenAdvisories

Weakness (CWE)

CWE-862: Missing Authorization

Class Incomplete

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

How to prevent it (5 mitigations)

  1. Architecture and Design

    Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.

    Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

  2. Architecture and Design

    Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

  3. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

    For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

  4. Architecture and Design

    For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.

    One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

  5. System Configuration, Installation

    Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

Source: MITRE CWE-862

All Critical High Medium Low Exploited only Public exploit

10,687 results · Feed

  • Medium 5.3
    CVE-2024-56009

    WordPress Spreadr Woocommerce plugin <= 1.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in spreadr Spreadr Woocommerce spreadr-for-woocomerce allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Spreadr Woocommerce: from n/a through <= 1.0.4.

    spreadr Spreadr Woocommerce Web / CMS
  • Medium 4.3
    CVE-2024-54402

    WordPress Arabic Webfonts plugin <= 1.4.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Mohamed Abd Elhalim Arabic Webfonts arabic-webfonts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Arabic Webfonts: from n/a through <= 1.4.6.

    Mohamed Abd Elhalim Arabic Webfonts
  • Medium 5.4
    CVE-2024-55998

    WordPress Popup Surveys & Polls for WordPress (Mare.io) plugin <= 1.36 - Settings Change vulnerability

    Missing Authorization vulnerability in Eric Sloan Popup Surveys & Polls for WordPress (Mare.io) popup-surveys allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Popup Surveys & Polls for WordPress (Mare.io): from n/a th…

    Eric Sloan Popup Surveys & Polls for WordPress (Mare.io) Web / CMS
  • Medium 5.4
    CVE-2024-56004

    WordPress Easy Site Importer plugin <= 1.0.1 - Settings Change vulnerability

    Missing Authorization vulnerability in awfowler Easy Site Importer easy-site-importer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Easy Site Importer: from n/a through <= 1.0.1.

    awfowler Easy Site Importer
  • Medium 4.8
    CVE-2024-11715

    WP Job Portal <= 2.2.2 - Missing Authorization to Limited Privilege Escalation

    The WP Job Portal – A Complete Recruitment System for Company or Job Board website plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the assignUserRole() function in all versions up to, and including, 2.2.2. This m…

    WP Job Portal WP Job Portal – AI-Powered Recruitment System for Company or Job Board website Web / CMS
  • Medium 6.5
    CVE-2024-12553

    GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability

    GeoVision GV-ASManager Missing Authorization Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose sensitive information on affected installations of GeoVision GV-ASManager. Although authentication is required to exploit…

    GeoVision GV-ASManager
  • Medium 6.5
    CVE-2024-54326

    WordPress GEO my WP plugin <= 4.5.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Eyal Fitoussi GEO my WordPress geo-my-wp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GEO my WordPress: from n/a through <= 4.5.0.4.

    Eyal Fitoussi GEO my WordPress Web / CMS
  • Medium 5.4
    CVE-2024-54323

    WordPress New User Approve plugin <= 2.6.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects New User Approve: from n/a through <= 2.6.2.

    Saad Iqbal New User Approve
  • Medium 5.4
    CVE-2024-54311

    WordPress Mark New Posts plugin <= 7.5.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in i.lychkov Mark New Posts mark-new-posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mark New Posts: from n/a through <= 7.5.1.

    i.lychkov Mark New Posts
  • Medium 5.3
    CVE-2024-54310

    WordPress Gou Manage My Account Menu plugin <= 1.0.1.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Aslam Khan Gouran Gou Manage My Account Menu gou-wc-account-tabs allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Gou Manage My Account Menu: from n/a through <= 1.0.1.8.

    Aslam Khan Gouran Gou Manage My Account Menu
  • Medium 4.3
    CVE-2024-54298

    WordPress Car Dealer plugin <= 4.46 - Broken Access Control vulnerability

    Missing Authorization vulnerability in sminozzi Car Dealer cardealer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Car Dealer: from n/a through <= 4.46.

    sminozzi Car Dealer
  • Medium 6.5
    CVE-2024-54289

    WordPress Awesome Support plugin <= 6.3.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in awesomesupport Awesome Support awesome-support allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Awesome Support: from n/a through <= 6.3.1.

    Awesome Support Awesome Support
  • Medium 4.3
    CVE-2024-54278

    WordPress News Ticker for Elementor plugin <= 2.1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Plugin Devs News Ticker for Elementor news-ticker-for-elementor allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects News Ticker for Elementor: from n/a through <= 2.1.3.

    Plugin Devs News Ticker for Elementor
  • Medium 5.4
    CVE-2024-54271

    WordPress WPCargo Track & Trace plugin <= 8.0.2 - Settings Change vulnerability

    Missing Authorization vulnerability in Arni Cinco WPCargo Track & Trace wpcargo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPCargo Track & Trace: from n/a through <= 8.0.2.

    Arni Cinco WPCargo Track & Trace
  • Medium 4.3
    CVE-2024-54268

    WordPress SiteOrigin Widgets Bundle plugin <= 1.64.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Greg - SiteOrigin SiteOrigin Widgets Bundle so-widgets-bundle allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SiteOrigin Widgets Bundle: from n/a through <= 1.64.0.

    Greg – SiteOrigin SiteOrigin Widgets Bundle
  • Medium 4.3
    CVE-2024-54267

    WordPress CM Answers plugin <= 3.2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in CreativeMindsSolutions CM Answers cm-answers allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CM Answers: from n/a through <= 3.2.6.

    CreativeMindsSolutions CM Answers
  • High 7.1
    CVE-2024-54256

    WordPress Easy Blocks pro plugin <= 1.0.21 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Seerox Easy Blocks pro easy-blocks-pro allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Easy Blocks pro: from n/a through <= 1.0.21.

    Seerox Easy Blocks pro
  • Medium 6.3
    CVE-2024-54252

    WordPress Pinpoint Booking System Plugin <= 2.9.9.5.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Pinpoint Booking System: from n/a through <= 2.9.9.5.7.

    dotonpaper Pinpoint Booking System
  • Medium 6.5
    CVE-2024-54241

    WordPress Elite Notification plugin 1.5 - Cross Site Scripting (XSS) vulnerability

    Missing Authorization vulnerability in Appsbd Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Elite Notification – Sales Popup, Social P…

    Appsbd Elite Notification – Sales Popup, Social Proof, FOMO & WooCommerce Notification Web / CMS
  • Medium 6.5
    CVE-2024-54242

    WordPress Simple Notification plugin <= 1.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in appsbd Simple Notification simple-notification allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Notification: from n/a through <= 1.3.

    Appsbd Simple Notification
  • Critical 9.8
    CVE-2024-54239 Public exploit

    WordPress Eyewear prescription form plugin <= 4.0.18 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in dugudlabs Eyewear prescription form eyewear-prescription-form allows Privilege Escalation.This issue affects Eyewear prescription form: from n/a through <= 4.0.18.

    dugudlabs Eyewear prescription form
  • Medium 5.3
    CVE-2023-44149

    WordPress Brands for WooCommerce plugin <= 3.8.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in BeRocket Brands for WooCommerce brands-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Brands for WooCommerce: from n/a through <= 3.8.2.2.

    BeRocket Brands for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2023-44147

    WordPress Comment Blacklist Updater plugin <= 1.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in apasionados Comment Blacklist Updater comment-blacklist-updater allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Comment Blacklist Updater: from n/a through <= 1.1.0.

    apasionados Comment Blacklist Updater
  • Medium 5.4
    CVE-2023-44142

    WordPress Inactive Logout plugin <= 3.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Deepen Bajracharya Inactive Logout inactive-logout allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Inactive Logout: from n/a through <= 3.2.2.

    Deepen Bajracharya Inactive Logout
  • Medium 5.3
    CVE-2023-41952

    WordPress Fluent Forms plugin <= 5.0.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Contact Form - WPManageNinja LLC FluentForm allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects FluentForm: from n/a through 5.0.8.

    Contact Form - WPManageNinja FluentForm
  • Medium 4.3
    CVE-2023-41951

    WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.6.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in rtCamp rtMedia for WordPress, BuddyPress and bbPress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects rtMedia for WordPress, BuddyPress and bbPress: from n/a through 4.6.14.

    rtcamp rtMedia for WordPress, BuddyPress and bbPress Web / CMS
  • Medium 5.3
    CVE-2023-41875

    WordPress WP Directory Kit plugin <= 1.2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in wpdirectorykit.com WP Directory Kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Directory Kit: from n/a through 1.2.6.

    wpdirectorykit.com WP Directory Kit
  • Medium 4.3
    CVE-2023-41873

    WordPress SAML Single Sign On – SSO Login plugin <= 5.0.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in miniOrange SAML SP Single Sign On allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SAML SP Single Sign On: from n/a through 5.0.4.

    miniOrange SAML SP Single Sign On
  • Medium 4.3
    CVE-2023-41870

    WordPress WP Crowdfunding plugin <= 2.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Themeum WP Crowdfunding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Crowdfunding: from n/a through 2.1.5.

    Themeum WP Crowdfunding
  • Medium 4.3
    CVE-2023-41869

    WordPress WP Accessibility Helper (WAH) plugin <= 0.6.2.4 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Alex Volkov WP Accessibility Helper (WAH) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Accessibility Helper (WAH): from n/a through 0.6.2.4.

    Alex Volkov WP Accessibility Helper (WAH)
  • Medium 4.3
    CVE-2023-41866

    WordPress Automatic YouTube Gallery plugin <= 2.3.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Team Plugins360 Automatic YouTube Gallery allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Automatic YouTube Gallery: from n/a through 2.3.3.

    Team Plugins360 Automatic YouTube Gallery
  • Medium 4.3
    CVE-2023-41865

    WordPress Slider Pro plugin <= 4.8.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in bqworks Slider Pro allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Slider Pro: from n/a through 4.8.6.

    bqworks Slider Pro
  • Medium 5.4
    CVE-2023-41857

    WordPress Click To Tweet plugin <= 2.0.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in ClickToTweet.com Click To Tweet allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Click To Tweet: from n/a through 2.0.14.

    ClickToTweet.com Click To Tweet
  • Medium 5.3
    CVE-2023-41849

    WordPress Posts Like Dislike plugin <= 1.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Happy Coders Posts Like Dislike allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Posts Like Dislike: from n/a through 1.1.0.

    WP Happy Coders Posts Like Dislike
  • Medium 5.3
    CVE-2023-41803

    WordPress BitPay Checkout for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in BitPay BitPay Checkout for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects BitPay Checkout for WooCommerce: from n/a through 4.1.0.

    BitPay BitPay Checkout for WooCommerce Web / CMS
  • Medium 5.3
    CVE-2023-41848

    WordPress Carousel Slider plugin <= 2.2.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Majeed Raza Carousel Slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Carousel Slider: from n/a through 2.2.2.

    Majeed Raza Carousel Slider
  • Medium 4.3
    CVE-2023-41802

    WordPress Super Socializer plugin <= 7.13.54 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Team Heateor Super Socializer allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Super Socializer: from n/a through 7.13.54.

    Team Heateor Super Socializer
  • Medium 5.3
    CVE-2023-41690

    WordPress WiserNotify Social Proof plugin <= 2.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Wiser Notify WiserNotify Social Proof allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WiserNotify Social Proof: from n/a through 2.5.

    Wiser Notify WiserNotify Social Proof
  • Low 3.5
    CVE-2023-41695

    WordPress Analytify plugin <= 5.1.0 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Adnan Analytify wp-analytify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Analytify: from n/a through <= 5.1.0.

    Adnan Analytify
  • Medium 4.3
    CVE-2023-41689

    WordPress Post to Google My Business (Google Business Profile) plugin <= 3.1.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Koen Reus Post to Google My Business (Google Business Profile) allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Post to Google My Business (Google Business Profile): from n/a thr…

    Koen Reus Post to Google My Business (Google Business Profile)