Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
10,688 results · Feed
-
High 7.5
WordPress Olive One Click Demo Import plugin <= 1.1.1 - Arbitrary File Download vulnerability
Missing Authorization vulnerability in Olive Themes Olive One Click Demo Import.This issue affects Olive One Click Demo Import: from n/a through 1.1.1.
-
Medium 5.3
WordPress 5 Stars Rating Funnel plugin 1.2.67 - Broken Access Control vulnerability
Missing Authorization vulnerability in Saleswonder Team: Tobias 5 Stars Rating Funnel 5-stars-rating-funnel.This issue affects 5 Stars Rating Funnel: from n/a through <= 1.2.67.
-
Medium 5.3
WordPress RomethemeForm For Elementor plugin <= 1.1.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Rometheme RomethemeForm For Elementor.This issue affects RomethemeForm For Elementor: from n/a through 1.1.2.
-
High 7.5
WordPress BizPrint plugin <= 4.3.39 - Broken Access Control vulnerability
Missing Authorization vulnerability in BizSwoop a CPF Concepts, LLC Brand BizPrint.This issue affects BizPrint: from n/a through 4.3.39.
-
Medium 5.3
WordPress Vision – Image Map Builder plugin <= 1.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Avirtum Vision Interactive.This issue affects Vision Interactive: from n/a through 1.7.1.
-
Medium 4.3
WordPress Advanced Testimonial Carousel for Elementor plugin <= 3.0.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in wpcreativeidea Advanced Testimonial Carousel for Elementor.This issue affects Advanced Testimonial Carousel for Elementor: from n/a through 3.0.0.
-
Medium 4.3
WordPress CookieHub plugin <= 1.1.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in CookieHub.This issue affects CookieHub: from n/a through 1.1.0.
-
Medium 4.3
WordPress Secure Copy Content Protection and Content Locking plugin <= 3.7.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Copy Content Protection Team Secure Copy Content Protection and Content Locking.This issue affects Secure Copy Content Protection and Content Locking: from n/a through 3.7.1.
-
Medium 4.3
WordPress Hummingbird plugin <= 3.7.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Hummingbird hummingbird-performance.This issue affects Hummingbird: from n/a through <= 3.7.3.
-
Medium 5.4
WordPress WP LinkedIn Auto Publish plugin <= 8.11 - Broken Access Control vulnerability
Missing Authorization vulnerability in Martin Gibson WP LinkedIn Auto Publish.This issue affects WP LinkedIn Auto Publish: from n/a through 8.11.
-
High 7.5
WordPress WP Travel Engine plugin <= 5.8.0 - Price Manipulation vulnerability
Missing Authorization vulnerability in WP Travel Engine.This issue affects WP Travel Engine: from n/a through 5.8.0.
-
Medium 5.3
WordPress Easy Property Listings plugin <= 3.5.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in Merv Barrett Easy Property Listings.This issue affects Easy Property Listings: from n/a through 3.5.3.
-
Medium 4.3
WordPress WP GoToWebinar plugin <= 14.46 - Broken Access Control vulnerability
Missing Authorization vulnerability in Martin Gibson WP GoToWebinar.This issue affects WP GoToWebinar: from n/a through 14.46.
-
Medium 6.5
WordPress Social Snap plugin <= 1.3.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in Social Snap.This issue affects Social Snap: from n/a through 1.3.5.
-
Medium 5.3
WordPress Integrate Google Drive plugin <= 1.3.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in SoftLab Integrate Google Drive.This issue affects Integrate Google Drive: from n/a through 1.3.9.
-
Medium 5.3
WordPress Advanced Local Pickup for WooCommerce plugin <= 1.6.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Zorem Advanced Local Pickup for WooCommerce.This issue affects Advanced Local Pickup for WooCommerce: from n/a through 1.6.1.
-
Medium 4.3
WordPress MDTF – Meta Data and Taxonomies Filter plugin <= 1.3.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter (MDTF).This issue affects WordPress Meta Data and Taxonomies Filter (MDTF): from n/a through 1.3.3.
-
Medium 5.3
WordPress Social Share Icons & Social Share Buttons plugin <= 3.6.2 - Broken Access Control lead to Notice Dismissal vulnerability
Missing Authorization vulnerability in Social Share Pro Social Share Icons & Social Share Buttons.This issue affects Social Share Icons & Social Share Buttons: from n/a through 3.6.2.
-
Medium 4.3
WordPress Total Poll Lite plugin <= 4.9.9 - Broken Access Control vulnerability
Missing Authorization vulnerability in TotalSuite Total Poll Lite.This issue affects Total Poll Lite: from n/a through 4.9.9.
-
Medium 5.4
WordPress Evergreen Content Poster plugin <= 1.4.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Evergreen Content Poster Evergreen Content Poster evergreen-content-poster.This issue affects Evergreen Content Poster: from n/a through <= 1.4.2.
-
High 7.5
WordPress WP Time Slots Booking Form plugin <= 1.2.06 - Broken Access Control vulnerability
Missing Authorization vulnerability in CodePeople WP Time Slots Booking Form.This issue affects WP Time Slots Booking Form: from n/a through 1.2.06.
-
Medium 5.3
WordPress WZone plugin <= 14.0.10 - Unauthenticated Broken Access Control vulnerability
Missing Authorization vulnerability in AA-Team WZone.This issue affects WZone: from n/a through 14.0.10.
-
High 8.3
WordPress WZone plugin <= 14.0.10 - Site Wide Broken Access Control vulnerability
Missing Authorization vulnerability in AA-Team WZone.This issue affects WZone: from n/a through 14.0.10.
-
High 8.1
WordPress XStore Core plugin <= 5.3.8 - Multiple Authenticated Broken Access Control vulnerability
Missing Authorization vulnerability in 8theme XStore Core.This issue affects XStore Core: from n/a through 5.3.8.
-
High 7.5
WordPress XStore theme <= 9.3.8 - Unauthenticated Broken Access Control vulnerability
Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.
-
High 7.6
WordPress XStore theme <= 9.3.8 - Broken Access Control vulnerability
Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.
-
High 8.8
WordPress XStore theme <= 9.3.8 - Arbitrary Option Update vulnerability
Missing Authorization vulnerability in 8theme XStore.This issue affects XStore: from n/a through 9.3.8.
-
Critical 9.1
WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.5.3 - Unauthenticated Broken Access Control vulnerability
Missing Authorization vulnerability in UkrSolution Barcode Scanner with Inventory & Order Manager.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through 1.5.3.
-
Medium 4.3
WordPress Nexter Blocks plugin <= 3.2.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in POSIMYTH Nexter Blocks the-plus-addons-for-block-editor.This issue affects Nexter Blocks: from n/a through <= 3.2.5.
-
Medium 4.3
WordPress Aiomatic plugin <= 1.9.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in CodeRevolution Aiomatic.This issue affects Aiomatic: from n/a through 1.9.3.
-
Medium 6.5
WordPress Master Addons for Elementor plugin <= 2.0.5.4.1 - Broken Access Control on API vulnerability
Missing Authorization vulnerability in Jewel Theme Master Addons for Elementor.This issue affects Master Addons for Elementor: from n/a through 2.0.5.4.1.
-
Medium 4.3
WordPress Debug Log Manager plugin <= 2.3.1 - Broken Access Control vulnerability
Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1.
-
Medium 5.3
WordPress EmbedPress plugin <= 3.9.11 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPDeveloper EmbedPress.This issue affects EmbedPress: from n/a through 3.9.11.
-
Medium 5.3
WordPress JS Help Desk plugin <= 2.8.3 - Broken Access Control vulnerability
Missing Authorization vulnerability in JS Help Desk JS Help Desk – Best Help Desk & Support Plugin.This issue affects JS Help Desk – Best Help Desk & Support Plugin: from n/a through 2.8.3.
-
Medium 4.3
WordPress Flexible Checkout Fields for WooCommerce plugin <= 4.1.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in WP Desk Flexible Checkout Fields for WooCommerce.This issue affects Flexible Checkout Fields for WooCommerce: from n/a through 4.1.2.
-
Medium 4.3
WordPress Announcer – Notification & message bars plugin <= 6.0 - Broken Access Control vulnerability
Missing Authorization vulnerability in Aakash Chakravarthy Announcer – Notification & message bars.This issue affects Announcer – Notification & message bars: from n/a through 6.0.
-
Medium 4.3
WordPress Responsive Lightbox & Gallery plugin <= 2.4.6 - Broken Access Control vulnerability
Missing Authorization vulnerability in dFactory Responsive Lightbox.This issue affects Responsive Lightbox: from n/a through 2.4.6.
-
Medium 4.3
WordPress All-in-One Video Gallery plugin <= 3.5.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in Team Plugins360 All-in-One Video Gallery.This issue affects All-in-One Video Gallery: from n/a through 3.5.2.
-
Critical 9.8
WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Settings Change vulnerability
Missing Authorization vulnerability in Bricksforge.This issue affects Bricksforge: from n/a through 2.0.17.
-
High 7.5
WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Setting Deletion vulnerability
Missing Authorization vulnerability in Bricksforge.This issue affects Bricksforge: from n/a through 2.0.17.