Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
10,633 results · Feed
-
Critical 9.3CVE-2026-73665 Public exploit
FreePBX UCP: Unauthenticated remote code execution via socket.io namespace auth bypass and AMI action injection
FreePBX is an open source IP PBX. Prior to 17.0.9, the UCP Node server on ports 8001 and 8003 uses io.use(checkAuth) in node/lib/server.js, but Socket.IO version 4 applies that middleware only to the default namespace. An unauthenticated client can connect to…
-
High 8.2
Trigger.dev: Cross-tenant object store read and write via URL path traversal
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. From 4.4.2 until 4.5.0-rc.5, Aws4FetchClient.buildUrl() and Aws4FetchClient.presign() in apps/webapp/app/v3/objectStoreClient.server.ts assign user-controlled packet k…
-
Critical 9.9
Trigger.dev: Cross-project deployment worker registration can modify another project's deployment state
Trigger.dev is a platform for building and deploying fully managed AI agents and workflows. Prior to 4.5.6, POST /api/v1/deployments/:deploymentId/background-workers calls CreateDeploymentBackgroundWorkerServiceV4.call() in apps/webapp/app/v3/services/createD…
-
Medium 6.5
Missing Authorization in Kibana Leading to Information Disclosure
Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). An internal Kibana data retrieval capability used by Elastic Defend endpoint response actions did not enforce …
-
High 8.1
Missing Authorization in Kibana Leading to Unauthorized Execution of Host Response Actions
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Osquery and Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who is able to author and evalua…
-
Medium 6.5
Missing Authorization in Kibana Leading to Unauthorized Execution of Endpoint Response Actions
Missing Authorization (CWE-862) in Kibana can lead to unauthorized execution of Elastic Defend response actions on managed hosts via Accessing Functionality Not Properly Constrained by ACLs (CAPEC-1). A Kibana user who holds only detection rule authoring priv…
-
High 7.1
Missing Authorization in Kibana Machine Learning Leading to Cross-Space Information Disclosure and Unauthorized Data Modification
Missing Authorization (CWE-862) in Kibana can lead to cross-space information disclosure and unauthorized data modification via Privilege Abuse (CAPEC-122). Kibana Machine Learning carries out its Elasticsearch operations with elevated internal permissions an…
-
Medium 4.3
Missing Authorization in Kibana Leading to Unauthorized Modification of Machine Learning Trained Model Space Assignments
A Kibana Machine Learning capability that removes a saved object from the current space accepts machine learning trained models as a target, but it verifies only the privileges that apply to anomaly detection jobs and data frame analytics jobs. A user whose r…
-
High 7.6
Missing Authorization in Kibana Leading to Cross-User Information Disclosure and Data Tampering
The state that Kibana stores for an Observability Onboarding flow is not bound to the user who created the flow, and the routes that read and update that state do not verify ownership. An authenticated user who holds only generic read access to the space can …
-
Medium 6.5
Missing Authorization in Kibana Leading to Privilege Escalation and Information Disclosure
Kibana Agent Builder does not correctly verify that the requesting user holds the privileges required by a separate Kibana feature before it creates and runs a tool that invokes that feature's functionality. This allows privilege escalation and could lead to …
-
High 7.1
Open WebUI: Cross-channel message overwrite via chat completion API (single-model and multimodel message_ids)
Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 before 0.10.0, any authenticated user can overwrite the content of a message in a channel they do not belong to (including private and DM channels) by sending a c…
-
Critical 9.4
Vitest: Browser Mode provider commands bypass the file-access permission gate
Vitest is a testing framework powered by Vite. Prior to versions 3.2.7, 4.1.10, and 5.0.0-beta.6, Browser Mode provider commands including upload, takeScreenshot, screenshotMatcher, stopChunkTrace, deleteTracing, and annotateTraces accept browser-supplied fil…
-
High 7.5
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot access
-
High 7.5
Private Repository Metadata Remains Accessible After Access Revocation
Private Repository Metadata Remains Accessible After Access Revocation
-
Critical 9.1
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
Team-repository linking endpoint bypasses the RepoAdminChangeTeamAccess organization setting
-
Medium 5.9
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
Missing Authorization and Authorization Bypass Through User-Controlled Key and Incorrect Permission Assignment for Critical Resource and Exposure of Sensitive Information to an Unauthorized Actor in code.gitea.io/gitea
-
Medium 5.9
Cross-repository issue/comment attachment re-linking can expose private attachment content
Cross-repository issue/comment attachment re-linking can expose private attachment content
-
Medium 4.3
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
RSS/Atom feed handlers bypass API-token scope & public-only confinement (incomplete fix of #37698)
-
Medium 5.3
WordPress User Registration plugin <= 5.2.6 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in User Registration <= 5.2.6 versions.
-
Medium 5.3
WordPress InstaWP Connect plugin <= 0.1.3.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in InstaWP Connect <= 0.1.3.7 versions.
-
Medium 5.3
WordPress Revolut Gateway for WooCommerce plugin < 4.22.10 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Revolut Gateway for WooCommerce < 4.22.10 versions.
-
Medium 5.3
WordPress GiveWP plugin < 4.16.6 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions.
-
Medium 6.5
WordPress Motors plugin <= 1.4.113 - Broken Access Control vulnerability
Subscriber Broken Access Control in Motors <= 1.4.113 versions.
-
Medium 6.3
WordPress Anti Spam and list cleaner – AcyChecker plugin <= 2.0.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Anti Spam and list cleaner – AcyChecker <= 2.0.0 versions.
-
Medium 6.5
WordPress Contact Form 7 – PayPal & Stripe Add-on plugin <= 2.5.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Contact Form 7 – PayPal & Stripe Add-on <= 2.5.1 versions.
-
High 7.5
WordPress Arvow AI SEO Writer plugin <= 1.5.3 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Arvow AI SEO Writer <= 1.5.3 versions.
-
High 7.5
WordPress StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin <= 2.1.1 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart <= 2.1.1 versions.
-
Medium 6.5
WordPress Internal Link Optimiser plugin <= 5.2.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Internal Link Optimiser <= 5.2.7 versions.
-
High 7.5
WordPress SMEPay: UPI Gateway for WooCommerce plugin <= 1.0.5 - Payment Bypass vulnerability
Unauthenticated Broken Access Control in SMEPay: UPI Gateway for WooCommerce <= 1.0.5 versions.
-
Medium 6.5
WordPress AI for SEO plugin <= 2.4.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in AI for SEO <= 2.4.2 versions.
-
Medium 6.0
WordPress ReactPress plugin <= 3.4.0 - Broken Access Control vulnerability
Subscriber Broken Access Control in ReactPress <= 3.4.0 versions.
-
Medium 6.5
WordPress WP Social Avatar plugin <= 1.5 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WP Social Avatar <= 1.5 versions.
-
High 7.5
WordPress MultiVendorX plugin <= 5.0.10 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in MultiVendorX <= 5.0.10 versions.
-
High 7.5
WordPress Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) plugin <= 1.0.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Bitcoin Lightning Payment Gateway for WooCommerce (via CLINK) <= 1.0.7 versions.
-
High 7.5
WordPress WPMobile.App plugin <= 11.77 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in WPMobile.App <= 11.77 versions.
-
Medium 6.5
WordPress Secure Card Gateway for ePay Paycenter (Piraeus Bank) plugin <= 1.0.32 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Secure Card Gateway for ePay Paycenter (Piraeus Bank) <= 1.0.32 versions.
-
High 7.3
WordPress Hydra Booking plugin <= 1.2.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Hydra Booking <= 1.2.2 versions.
-
High 8.1
WordPress Travelfic Toolkit plugin <= 1.5.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in Travelfic Toolkit <= 1.5.1 versions.
-
Medium 6.5
WordPress AcyMailing SMTP Newsletter plugin <= 10.11.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in AcyMailing SMTP Newsletter <= 10.11.1 versions.
-
High 7.1
WordPress WP Event SOlution plugin <= 4.1.19 - Arbitrary Content Deletion vulnerability
Customer Arbitrary Content Deletion in WP Event SOlution <= 4.1.19 versions.