Skip to content
OpenAdvisories

Weakness (CWE)

CWE-862: Missing Authorization

Class Incomplete

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

How to prevent it (5 mitigations)

  1. Architecture and Design

    Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.

    Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.

  2. Architecture and Design

    Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

  3. Architecture and Design

    Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.

    For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].

  4. Architecture and Design

    For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.

    One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

  5. System Configuration, Installation

    Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

Source: MITRE CWE-862

All Critical High Medium Low Exploited only Public exploit

10,687 results · Feed

  • Medium 4.3
    CVE-2024-44006

    WordPress WooCommerce Multilingual & Multicurrency plugin <= 5.3.7 - Broken Access Control vulnerability

    Missing Authorization vulnerability in OnTheGoSystems WooCommerce Multilingual & Multicurrency woocommerce-multilingual.This issue affects WooCommerce Multilingual & Multicurrency: from n/a through 5.3.6.

    OnTheGoSystems WooCommerce Multilingual & Multicurrency Web / CMS
  • Medium 5.3
    CVE-2024-44019

    WordPress Contact Form 7 Campaign Monitor Extension plugin <= 0.4.67 - Arbitrary File Deletion vulnerability

    Missing Authorization vulnerability in Renzo Johnson Contact Form 7 Campaign Monitor Extension contact-form-7-campaign-monitor-extension.This issue affects Contact Form 7 Campaign Monitor Extension: from n/a through <= 0.4.67.

    Renzo Johnson Contact Form 7 Campaign Monitor Extension
  • Medium 4.3
    CVE-2024-44020

    WordPress WP Free SSL plugin <= 1.2.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in prasadkirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS wp-free-ssl.This issue affects WP Free SSL – Free SSL Certificate for WordPress and force HTTPS: from n/a through <= 1.2.7.

    Prasad Kirpekar WP Free SSL – Free SSL Certificate for WordPress and force HTTPS Web / CMS
  • Medium 4.3
    CVE-2024-44031

    WordPress JoomSport plugin <= 5.6.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in beardev JoomSport joomsport-sports-league-results-management.This issue affects JoomSport: from n/a through <= 5.6.3.

    Beardev JoomSport
  • Medium 5.4
    CVE-2024-44021

    WordPress Truepush plugin <= 1.0.8 - Broken Access Control vulnerability

    Missing Authorization vulnerability in truepushplugin Truepush truepush-free-web-push-notifications.This issue affects Truepush: from n/a through <= 1.0.8.

    truepushplugin Truepush
  • Medium 4.3
    CVE-2024-44052

    WordPress HelloAsso plugin <= 1.1.10 - Broken Access Control vulnerability

    Missing Authorization vulnerability in HelloAsso HelloAsso helloasso.This issue affects HelloAsso: from n/a through <= 1.1.10.

    HelloAsso HelloAsso
  • Medium 6.5
    CVE-2024-47308 Scanner template

    WordPress Templately plugin <= 3.1.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper Templately templately.This issue affects Templately: from n/a through <= 3.1.2.

    WPDeveloper Templately
  • Medium 4.3
    CVE-2024-47317

    WordPress Ads by WPQuads plugin <= 2.0.84 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Ads by WPQuads Ads by WPQuads quick-adsense-reloaded.This issue affects Ads by WPQuads: from n/a through <= 2.0.84.

    Ads by WPQuads Ads by WPQuads
  • Medium 4.3
    CVE-2024-47318

    WordPress PWA for WP & AMP plugin <= 1.7.72 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Magazine3 PWA for WP & AMP pwa-for-wp.This issue affects PWA for WP & AMP: from n/a through <= 1.7.72.

    Magazine3 PWA for WP & AMP
  • Medium 5.3
    CVE-2024-47358

    WordPress Popup Maker plugin <= 1.19.2 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Daniel Iser Popup Maker popup-maker.This issue affects Popup Maker: from n/a through <= 1.19.2.

    Daniel Iser Popup Maker
  • Medium 6.5
    CVE-2024-47321

    WordPress WP Datepicker plugin <= 2.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Fahad Mahmood WP Datepicker wp-datepicker.This issue affects WP Datepicker: from n/a through <= 2.1.1.

    Fahad Mahmood WP Datepicker
  • Medium 6.5
    CVE-2024-47361

    WordPress Elementor Addon Elements plugin <= 1.13.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPVibes Elementor Addon Elements addon-elements-for-elementor-page-builder.This issue affects Elementor Addon Elements: from n/a through <= 1.13.6.

    WPVibes Elementor Addon Elements
  • Medium 4.3
    CVE-2024-47362

    WordPress Strong Testimonials plugin <= 3.1.16 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Chill Strong Testimonials strong-testimonials.This issue affects Strong Testimonials: from n/a through <= 3.1.16.

    WP Chill Strong Testimonials
  • High 8.2
    CVE-2024-37094

    WordPress MasterStudy LMS plugin <= 3.2.12 - Broken Access Control vulnerability

    Missing Authorization vulnerability in StylemixThemes MasterStudy LMS allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects MasterStudy LMS: from n/a through 3.2.12.

    StylemixThemes MasterStudy LMS
  • Medium 4.3
    CVE-2024-10399

    Download Monitor <= 5.0.13 - Missing Authorization to Sensitive Information Exposure

    The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_search_users function in all versions up to, and including, 5.0.13. This makes it possible for authenticated attackers, …

    WP Chill Download Monitor Web / CMS
  • Medium 5.3
    CVE-2024-50421

    WordPress PDF Invoices & Packing Slips for WooCommerce plugin <= 3.8.6 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WP Overnight WooCommerce PDF Invoices & Packing Slips woocommerce-pdf-invoices-packing-slips allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce PDF Invoices & Packing S…

    WP Overnight woocommerce-pdf-invoices-packing-slips Web / CMS
  • Medium 5.3
    CVE-2024-50422

    WordPress Breeze plugin <= 2.1.14 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Cloudways Breeze breeze allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Breeze: from n/a through <= 2.1.14.

    Cloudways Breeze
  • Medium 5.4
    CVE-2024-50423

    WordPress Templately plugin <= 3.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templately: from n/a through <= 3.1.5.

    WPDeveloper Templately
  • Medium 6.5
    CVE-2024-50424

    WordPress Templately plugin <= 3.1.5 - Broken Access Control vulnerability

    Missing Authorization vulnerability in WPDeveloper Templately templately allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Templately: from n/a through <= 3.1.5.

    WPDeveloper Templately
  • Medium 4.3
    CVE-2024-50428

    WordPress Multi Step Form plugin <= 1.7.21 - Broken Access Control vulnerability

    Missing Authorization vulnerability in mondula2016 Multi Step Form multi-step-form allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Multi Step Form: from n/a through <= 1.7.21.

    mondula2016 Multi Step Form
  • Medium 5.3
    CVE-2024-50454

    WordPress SEOPress plugin <= 8.1.1 - Unauthenticated Broken Access Control vulnerability

    Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.

    Benjamin Denis SEOPress
  • Medium 4.3
    CVE-2024-50455

    WordPress SEOPress plugin <= 8.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.

    Benjamin Denis SEOPress
  • Medium 5.4
    CVE-2024-50456

    WordPress SEOPress plugin <= 8.1.1 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Benjamin Denis SEOPress wp-seopress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects SEOPress: from n/a through <= 8.1.1.

    Benjamin Denis SEOPress
  • Medium 5.3
    CVE-2024-50459

    WordPress AidWP plugin <= 3.2.3 - Broken Access Control vulnerability

    Missing Authorization vulnerability in Hossni Mubarak AidWP wp-stripe-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AidWP: from n/a through <= 3.2.3.

    Hossni Mubarak AidWP
  • Critical 9.1
    CVE-2024-7475

    Improper Access Control in lunary-ai/lunary

    An improper access control vulnerability in lunary-ai/lunary version 1.3.2 allows an attacker to update the SAML configuration without authorization. This vulnerability can lead to manipulation of authentication processes, fraudulent login requests, and theft…

    lunary-ai lunary-ai/lunary
  • Medium 4.3
    CVE-2024-10437

    WPC Smart Messages for WooCommerce <= 4.2.1 - Missing Authorization to Authenticated (Subscriber+) Message Activation/Deactivation

    The WPC Smart Messages for WooCommerce plugin for WordPress is vulnerable to unauthorized Smar Message activation/deactivation due to a missing capability check on the ajax_enable function in all versions up to, and including, 4.2.1. This makes it possible fo…

    wpclever WPC Smart Messages for WooCommerce Web / CMS
  • Critical 9.8
    CVE-2024-50475 Public exploit

    WordPress Signup Page plugin <= 1.0 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in Scott Gamon Signup Page signup-page allows Privilege Escalation.This issue affects Signup Page: from n/a through <= 1.0.

    Scott Gamon Signup Page
  • Critical 9.8
    CVE-2024-50476 Public exploit

    WordPress GRÜN spendino Spendenformular plugin <= 1.0.1 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in GRÜN Software Group GmbH GRÜN spendino Spendenformular spendino allows Privilege Escalation.This issue affects GRÜN spendino Spendenformular: from n/a through <= 1.0.1.

    GRÜN Software Group GRÜN spendino Spendenformular
  • Critical 9.8
    CVE-2024-50490 Public exploit

    WordPress PegaPoll plugin <= 1.0.2 - Arbitrary Option Update to Privilege Escalation vulnerability

    Missing Authorization vulnerability in lowcage PegaPoll pegapoll allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects PegaPoll: from n/a through <= 1.0.2.

    lowcage PegaPoll
  • Medium 4.3
    CVE-2024-50052

    Arbitrary post deletion via Playbooks /ignore-thread endpoint

    Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.x <= 9.5.9 fail to check that the origin of the message in an integration action matches with the original post metadata which allows an authenticated user to delete an arbitrary post.

    Mattermost Mattermost github.com/mattermost/mattermost-server github.com/mattermost/mattermost-server/v6 Go
  • High 8.8
    CVE-2024-10008

    Masteriyo LMS – eLearning and Online Course Builder for WordPress <= 1.13.3 - Authenticated (Student+) Missing Authorization to Privilege Escalation

    The Masteriyo LMS – eLearning and Online Course Builder for WordPress plugin for WordPress is vulnerable to unauthorized user profile modification due to missing authorization checks on the /wp-json/masteriyo/v1/users/$id REST API endpoint in all versions up …

    masteriyo Masteriyo LMS – Online Course Builder for eLearning, LMS & Education Web / CMS
  • High 7.5
    CVE-2024-44265

    The issue was addressed by restricting options offered on a locked device. This issue is fixed in macOS Sequoia 15.1, m…

    Apple macOS macOS
  • High 7.5
    CVE-2024-44208

    This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15. An app may be able…

    Apple macOS macOS
  • High 7.1
    CVE-2024-44156

    A path deletion vulnerability was addressed by preventing vulnerable code from running with privileges. This issue is f…

    Apple macOS macOS
  • Medium 5.4
    CVE-2024-9629

    Contact Form 7 + Telegram <= 0.8.5 - Missing Authorization to Authenticated (Subscriber+) Subscription Approve/Pause/Refuse

    The Contact Form 7 + Telegram plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'wpcf7_Telegram::ajax' function in versions up to, and including, 0.8.5. This makes it possible for…

    hokku Message Bridge for Contact Form 7 and Telegram Web / CMS
  • Medium 4.3
    CVE-2024-50573

    In JetBrains Hub before 2024.3.47707 improper access control allowed users to generate permanent tokens for unauthorize…

    JetBrains Hub
  • High 7.5
    CVE-2024-10402

    Forminator Forms – Contact Form, Payment Form & Custom Form Builder <= 1.35.1 - Missing Authorization to Authenticated (Contributor+) Form Update and Creation

    The Forminator Forms – Contact Form, Payment Form & Custom Form Builder plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 1.35.1. This makes it possible for authenti…

    WPMU DEV Forminator Forms – Contact Form, Payment Form & Custom Form Builder Web / CMS
  • Medium 4.3
    CVE-2024-10092

    Download Monitor <= 5.0.12 - Missing Authorization to API Key Manipulation

    The Download Monitor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ajax_handle_api_key_actions function in all versions up to, and including, 5.0.12. This makes it possible for authenticated a…

    WP Chill Download Monitor Web / CMS
  • Medium 4.3
    CVE-2024-9626

    Editorial Assistant by Sovrn <= 1.3.3 - Missing Authorization to Authenticated (Subscriber+) Attachment Upload and Set Post Featured Image

    The Editorial Assistant by Sovrn plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'ajax_zemanta_set_featured_image' function in versions up to, and including, 1.3.3. This makes it possible for au…

    zemanta Editorial Assistant by Sovrn Web / CMS
  • Medium 5.4
    CVE-2024-9584

    Image Map Pro <= 6.0.20 - Missing Authorization to Authenticated (Contributor+) Map Project Add/Update/Delete

    The Image Map Pro plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the AJAX functions in versions up to, and including, 6.0.20. This makes it possible for authenticated attackers wit…

    imagemappro Image Map Pro – Drag-and-drop Builder for Interactive Images Web / CMS