Weakness (CWE)
CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
How to prevent it (5 mitigations)
-
Architecture and Design
Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
-
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
-
Architecture and Design
Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
-
Architecture and Design
For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
-
System Configuration, Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
Source: MITRE CWE-862
10,634 results · Feed
-
Medium 6.5
WordPress Thrive Leads Version plugin <= 10.9.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions.
-
Medium 6.5
WordPress FundEngine plugin <= 1.7.8 - Broken Access Control vulnerability
Subscriber Broken Access Control in FundEngine <= 1.7.8 versions.
-
Medium 6.5
WordPress RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg plugin <= 1.5.1 - Broken Access Control vulnerability
Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions.
-
Medium 6.5
WordPress Events Made Easy plugin <= 3.1.3 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions.
-
High 7.5
WordPress CoCart – Headless ecommerce plugin <= 4.8.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions.
-
High 7.3
WordPress Thrive Product Manager plugin <= 10.9.2 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions.
-
High 7.5
WordPress Post My CF7 Form plugin <= 6.2.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions.
-
High 7.5
WordPress Stripe For WooCommerce plugin <= 4.0.7 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions.
-
High 7.5
WordPress Ebook Store plugin <= 6.19 - Sensitive Data Exposure vulnerability
Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions.
-
High 8.0
Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant Missing Authorization Allows Privilege Escalation via REST API
A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant allows an authenticated attacker with low privileges to perform privileged administrative operations v…
-
Medium 5.3
The Events Calendar < 6.16.5.1 - Unauthenticated Event Aggregator Import Status Manipulation
The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an integrity check for a particular status value, allowing unauthenticated attackers to mark existing …
-
Critical 10.0
SiYuan before v3.7.2 Unauthenticated Administrator Takeover via MCP
SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckAuth) with no admin-role or read-only enforcement. This exposes 31 MCP tools, including a file tool w…
-
High 7.1
NFSv4: include MAY_WRITE in open permission mask for O_TRUNC
In the Linux kernel, the following vulnerability has been resolved: NFSv4: include MAY_WRITE in open permission mask for O_TRUNC POSIX requires write permission to truncate a file, so an open() that specifies O_TRUNC must be authorized for write access regard…
-
High 8.8
Poweradmin: API user-update endpoint leads to a non-admin reset any user's password and take over the superuser account
### Summary The REST API user-update endpoint (`PUT/PATCH /api/v2/users/{id}` and the V1 equivalent) does not enforce two authorization rules that the web interface enforces. A user who holds the `user_edit_others` permission but is not a superuser can: 1. ed…
-
High 8.3
Suna < 0.9.102 Broken Access Control via Message Queue API
Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue resources belonging to other users by exploiting missing ownership and account isolation checks. Att…
-
Medium 6.5
Apache HBase: Missing scanner instance owner check in thrift delegation service
Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possible multiple times), close. The open step will return an id which will be passed back to server for i…
-
Medium 5.0
Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and…
-
High 7.3
EventON Action User <= 2.5.14 - Missing Authorization to Unauthenticated Privilege Escalation via evoau_save_capability AJAX Action
The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauth…
-
Medium 5.3
Payment Plugins for Stripe WooCommerce <= 4.0.7 - Missing Authorization to Unauthenticated Arbitrary Order Status Modification via Empty Webhook Secret
The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it p…
-
Medium 5.4
ProfileGrid < 5.9.9.7 - Subscriber+ Cross-User Private Message Thread Deletion and Tampering via Missing Authorization
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing authenticated users with Subscriber-level access and above to soft-delete, tamper with the metadata o…
-
Low 3.8
ProfileGrid < 5.9.9.7 - Subscriber+ Premium License Tampering via Missing Authorization
The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed to any logged-in user, allowing authenticated users with Subscriber-level access and above to overwr…
-
Medium 5.3
Participants Database <= 2.7.8.3 - Missing Authorization to Unauthenticated Arbitrary Record Update / Sensitive Information Exposure via 'id' Parameter
The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers to overwrite arbitrary participant record…
-
Critical 10.0
Azure DNS Elevation of Privilege Vulnerability
Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network.
-
Critical 9.9
nebula-mesh: API endpoints lack ownership checks, enabling cross-operator privilege escalation
nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bearer token alone for authorisation on most endpoints. The codebase itself admits this at `internal/api…
-
Medium 6.5
ITFlow Vulnerable to Authenticated Cross-Tenant Credential Disclosure via Unprotected Credential Modal
ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated agent can retrieve plaintext credentials and TOTP secrets belonging to another client by directly re…
-
High 8.1
CyberPanel Missing Authorization in cancelBackupCreation Handler
CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated users to kill, delete, and corrupt other tenants' backups. Attackers can send crafted POST requests…
-
High 8.5
Grav API Plugin before 1.0.10 Broken Access Control
Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.config.write privilege to modify rate limiting and CORS settings. Attackers can disable rate limiting …
-
High 8.6
In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session
-
Medium 4.3
WordPress Cyr to Lat reloaded – transliteration of links and file names plugin <= 1.3.3 - Broken Access Control vulnerability
Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions.
-
Medium 4.8
WordPress Qubely plugin <= 1.8.14 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions.
-
Medium 4.3
WordPress TemplateSpare plugin <= 4.2.2 - Broken Access Control vulnerability
Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions.
-
Medium 5.3
WordPress Graphina plugin <= 3.1.12 - Broken Access Control vulnerability
Missing Authorization vulnerability in Iqonic Designs Graphina – Charts and Graphs For Elementor graphina-elementor-charts-and-graphs allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Graphina – Charts and Graphs For E…
-
Medium 5.3
WordPress Civi Framework plugin <= 2.2.0 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions.
-
Medium 4.3
WordPress Avada Custom Branding plugin <= 1.2 - Broken Access Control vulnerability
Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions.
-
Medium 5.3
WordPress MP3 Audio Player for Music, Radio & Podcast by Sonaar plugin <= 5.12 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions.
-
High 7.5
WordPress Manual - Documentation, Knowledge Base & Education WordPress theme theme <= 7.5.4 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions.
-
Medium 6.5
WordPress PeproDev Ultimate Invoice plugin <= 2.2.6 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions.
-
High 7.5
WordPress Dokan Pro plugin <= 5.0.3 - Broken Access Control vulnerability
Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions.
-
Medium 4.3
WordPress Query Wrangler plugin <= 1.5.57 - Broken Access Control vulnerability
Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions.
-
Medium 5.3
WordPress LA-Studio Element Kit for Elementor plugin <= 1.6.2 - Broken Access Control vulnerability
Missing Authorization vulnerability in LA-Studio LA-Studio Element Kit for Elementor lastudio-element-kit allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LA-Studio Element Kit for Elementor: from n/a through 1.6.2.