Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
10,631 results · Feed
-
Medium 5.3
authentik: Unauthenticated LDAP directory data disclosure
authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level read-authorization filter used by the rest of the API. Any party able to reach the API, including an un…
-
Medium 4.3
MyBB: Mod CP report resolution missing authorization
MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without report-management permission to mark reports as resolved. The modcp.php?action=do_reports Mark Selected…
-
High 7.8
CodeWhale rlm_eval before 0.8.64 Remote Code Execution
CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool. The tool's approval_requirement() returns ApprovalRequirement::Auto, which the engine treats as 'never prompt,' …
-
High 7.6
Hoppscotch: Cross-user private data exposure and UserHistory IDOR via team GraphQL resolvers
Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member…
-
Medium 4.3
WordPress WP Table Builder plugin <= 2.2.0 - Broken Access Control vulnerability
Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions.
-
Medium 5.4
WordPress Gravity Booster – Styles & Layouts for Gravity Forms plugin <= 6.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms <= 6.0 versions.
-
Medium 4.3
WordPress RomethemeForm For Elementor plugin <= 1.2.6 - Broken Access Control vulnerability
Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions.
-
High 7.5
WordPress Charitable plugin <= 1.8.11.3 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.
-
Medium 6.5
WordPress MasterStudy LMS plugin <= 3.7.41 - Broken Access Control vulnerability
Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions.
-
High 7.5
WordPress Ultimate Maps by Supsystic plugin < 1.5.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.
-
High 8.2
WordPress Breeze plugin <= 2.5.12 - Arbitrary Content Deletion vulnerability
Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.
-
Medium 6.5
WordPress GiveWP plugin <= 4.16.5.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions.
-
Medium 6.5
WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
-
Medium 6.5
WordPress MultiVendorX plugin <= 5.0.20 - Broken Access Control vulnerability
Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects MultiVendorX: from n/a through 5.0.20.
-
High 7.5
WordPress ThumbPress plugin < 6.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.
-
High 7.5
WordPress Online Contact Widget plugin <= 1.3.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.
-
High 7.5
WordPress FormyChat plugin <= 2.15.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.
-
High 7.5
WordPress WP Sort Order plugin <= 1.3.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.
-
High 8.8
ArcadeDB Gremlin Wire Protocol Authorization Bypass Cross-Database
ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions (canAccessToDatabase) and never binds the authenticat…
-
Medium 4.2
ArcadeDB before 26.8.1 Per-Type ACL Bypass via Batch Handlers
ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on the worker thread, the engine's fine-grained per-type ACL layer (LocalBucket.checkPermissionsOnFile)…
-
High 7.1
ArcadeDB before 26.8.1 Unauthorized Function Deletion via DELETE FUNCTION
ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStatement.executeSimple unregisters and persists deletion of a server-side function without any checkPermis…
-
Critical 9.1
Grav before 2.0.14 Privilege Escalation via Group Access Field
Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction. A delegated admin.users operator can save a group with access[admin][super]=true to escalate to super-admin, gaining scheduler…
-
High 8.8
Grav API Plugin before 1.0.14 Missing Authorization
The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction(). While the GET /menubar/items listing endpoint correctly filters menubar ite…
-
Medium 4.3
Grav API Plugin before 1.0.14 Missing Authorization
Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). The function fails to consult the calling request's API key scopes, relying instead on the account's r…
-
Medium 4.3
Grav API Plugin before 1.0.14 Authorization Bypass
The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in BlueprintPathResolver::resolveUserScope(). The method gates the users/<name> scope on the account's …
-
High 7.5
SiYuan before v3.7.4 Missing Authorization via block API
SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb). These handlers are gated only by basic authentication (model.CheckAuth) and lac…
-
High 7.5CVE-2026-11801 Scanner template
WPAdverts <= 2.3.2 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via classifieds-types REST Endpoint
The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible …
-
Medium 4.3
SourceCodester Onlne Examination & Learning Management System cross-site request forgery
A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality. The manipulation leads to cross-site request forgery. The attack can be initiated remotely.
-
Medium 6.5
MLflow: LogInputs endpoint bypasses per-run UPDATE authorization in basic-auth
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent from BEFORE_REQUEST_HANDLERS in the mlflow/server/auth package, allowing any authenticated user to c…
-
High 7.1
MLflow: CreateModelVersion source validation does not check READ permission on referenced run_id
MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a run_id or model_id after _validate_source_run() or _validate_source_model() in mlflow/server/handler…
-
High 7.1
Determined Missing Authorization Check on Generic Task Endpoints
Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other users' workloads by terminating, pausing, or unpausing tasks they do not own.
-
Medium 5.4
Next Terminal Missing Per-Asset Authorization on Portal Endpoints
Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake assets they are not granted access to. Attackers can call these endpoints with arbitrary asset identi…
-
High 7.1CVE-2026-54356 Public exploit
Budibase authenticated arbitrary S3 signed upload URL issuance via `/api/attachments/:datasourceId/url`
Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages/server/src/api/controllers/static/index.ts allows an authenticated published-app user with the BASI…
-
Medium 6.5
ApostropheCMS: Missing destination-parent authorization in page `move()` allows a low-privileged editor to move and re-rank pages inside a restricted subtree
ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent's _create permission because its oldParent archive condition disables the check for ordinary moves, …
-
Medium 6.5
Astro: Unauthenticated path override in the @astrojs/vercel ISR function
Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypoint.ts accepts x_astro_path for the public /_isr function based only on the x-vercel-isr header, all…
-
High 8.8
Missing device-pointer validation in flash_copy() syscall allows userspace privilege escalation
The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with CONFIG_USERSPACE enabled, this handler is the kernel-side trust boundary for a user-mode caller. Prior to the fix it validated only the output buffer…
-
Medium 5.1
New API: Admin can reset passkeys for same-level or higher-privileged users
New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in controller/passkey.go lacks the canManageTargetRole authorization check for DELETE /api/user/:id/reset…
-
High 8.1
In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible
-
Medium 6.5
In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other…
-
Medium 4.3
In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint