Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
10,631 results · Feed
-
Medium 4.3
In JetBrains YouTrack before 2026.2.19197 helpdesk project's Authorized Reporters list could be bypassed
-
High 7.7
In JetBrains Hub before 2026.2.52366 missing authorisation allowed authenticated users to send arbitrary emails from th…
-
Medium 5.4
WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability
Contributor Broken Access Control in The Events Calendar <= 6.17.5 versions.
-
Medium 4.3
WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability
Subscriber Broken Access Control in Prevent files / folders access <= 2.6.7 versions.
-
Medium 6.5
WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Blocksy Companion <= 2.1.55 versions.
-
Medium 5.4
WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability
Subscriber Broken Access Control in AllAble Connector <= 0.13.4 versions.
-
Medium 6.5
WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in MCP Content Manager Lite <= 1.1.0 versions.
-
High 7.5
WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WordPress Backup & Migration <= 1.6.0 versions.
-
Medium 6.5
WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability
Missing Authorization vulnerability in Liquid Web / StellarWP GiveWP give allows Retrieve Embedded Sensitive Data.This issue affects GiveWP: from n/a through 4.16.9.
-
High 7.5
WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability
Unauthenticated Arbitrary Content Deletion in Customer Reviews for WooCommerce <= 5.120.0 versions.
-
High 7.5
WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Express Checkout (Accept PayPal Payments) <= 2.4.9 versions.
-
High 8.2
WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in MakeCommerce for WooCommerce <= 4.1.0 versions.
-
High 7.5
WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Bookly <= 28.2 versions.
-
High 7.5
WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Hostinger Migrator <= 1.0 versions.
-
High 7.1
WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in FormGent <= 1.12.2 versions.
-
High 7.5
WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in GravityExport Lite for Gravity Forms <= 2.7.2 versions.
-
Medium 6.5CVE-2026-94074 Public exploit
WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Simply Schedule Appointments <= 1.6.12.29 versions.
-
Medium 6.9
WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability
Missing Authorization vulnerability in Amauri.IO WPMobile.App wpappninja allows Retrieve Embedded Sensitive Data.This issue affects WPMobile.App: from n/a through 11.83.
-
High 8.6
MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection
MISP contains a privilege escalation vulnerability in the tag collection creation and editing functionality. The affected actions accepted the full HTTP request payload and passed it to a bulk-association save operation, which writes not only the intended tag…
-
Medium 5.3
InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook
The InPost PL WordPress plugin before 1.9.8 does not verify the authenticity of incoming shipment webhook requests, relying only on a non-secret identifier and an IP check that is not enforced, allowing unauthenticated attackers who know a target order's parc…
-
Low 2.7
Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation
The Media Library Organizer WordPress plugin before 2.1.4 does not verify that the requesting user holds the target taxonomy's management capability before creating a new term, allowing users with contributor-level access and above to create publicly visible …
-
Medium 4.3
All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update
The All in One Files Upload WordPress plugin before 2.0.17 does not have any capability check, and does not verify the authenticity of the request, when saving its settings, allowing any authenticated user, such as a subscriber, to change them.
-
High 7.1
Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files …
-
High 7.1
Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B
A missing authorization vulnerability in the wgagent management daemon's session initialization function allows an authenticated, low-privileged user (including a read-only or guest administrator account) to crash the wgagent process and read arbitrary files …
-
Medium 5.3
Paused shared dashboard access tokens still expose data source configuration
Pausing a shared (public) dashboard did not revoke its access token for the endpoints that serve frontend bootstrap data. Anyone holding the link to a paused shared dashboard could still retrieve, without authenticating, the configuration of the dashboard's d…
-
Medium 6.5
Missing authorization in Payments in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised…
-
Medium 6.5
Missing authorization in CORS in Google Chrome prior to 154.0.8037.92 allowed a remote attacker who had compromised the…
-
Medium 4.3
Missing authorization in V8 in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass web origin poli…
-
Medium 4.3
Missing authorization in Core in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker leveraging so…
-
High 8.4
Missing authorization in WakeLock in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised…
-
High 8.4
Missing authorization in WebView in Google Chrome on on Android prior to 154.0.8037.57 allowed a remote attacker who ha…
-
Medium 4.8
Missing authorization in DevTools in Google Chrome prior to 154.0.8037.57 allowed a remote attacker leveraging social e…
-
Medium 5.4
Missing authorization in NFC in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromised the …
-
Medium 5.4
Missing authorization in Views in Google Chrome on on Mac prior to 154.0.8037.57 allowed a remote attacker who had comp…
-
Medium 5.4
Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromis…
-
Medium 6.5
Missing authorization in Contextual Tasks in Google Chrome prior to 154.0.8037.57 allowed a remote attacker to bypass w…
-
Medium 5.4
Missing authorization in Navigation in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromis…
-
High 8.1
Missing authorization in Extensions in Google Chrome prior to 154.0.8037.57 allowed a remote attacker who had compromis…
-
Critical 9.1
TemplateSandbox does not check read permissions for the page being previewed
Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - TemplateSandbox Extension allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Mediawiki - TemplateSandbox Extension: from * before 1.46.1, 1.45.5, 1.43.10.
-
Medium 5.0
Missing authorization in the gateway network scan token API in Devolutions Server 2026.3.5.0 and earlier allows an auth…