CWE-862— Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.— MITRE CWE catalog

8,968 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-862page 141 of 180

CVE-2026-0497MEDIUMCVSS 4.3EG 4.3
2026-01-13
SAP Product Designer Web UI of Business Server Pages allows authenticated non-administrative users to access non-sensitive information. This results in a low impact on confidentiality, with no impact on integrity or availability of the app…
CVE-2026-0503MEDIUMCVSS 6.4EG 6.4
2026-01-13
Due to missing authorization check in the SAP ERP Central Component (SAP ECC) and SAP S/4HANA (SAP EHS Management), an attacker could extract hardcoded clear-text credentials and bypass the password authentication check by manipulating use…
CVE-2026-0506HIGHCVSS 8.1EG 8.1
2026-01-13
Due to a Missing Authorization Check vulnerability in Application Server ABAP and ABAP Platform, an authenticated attacker could misuse an RFC function to execute form routines (FORMs) in the ABAP system. Successful exploitation could allo…
CVE-2026-0509CRITICALCVSS 9.6EG 9.6
2026-02-10
SAP NetWeaver Application Server ABAP and ABAP Platform allows an authenticated, low-privileged user to perform background Remote Function Calls without the required S_RFC authorization in certain cases. This can result in a high impact on…
CVE-2026-0511HIGHCVSS 8.1EG 8.1
2026-01-13
SAP Fiori App Intercompany Balance Reconciliation does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. This has high impact on confidentiality and integrity of the application ,a…
CVE-2026-0548MEDIUMCVSS 5.4EG 5.4
2026-01-20
The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized attachment deletion due to a missing capability check on the `delete_existing_user_photo` function in all versions up to, and includi…
CVE-2026-0554MEDIUMCVSS 4.3EG 4.3
2026-01-20
The NotificationX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'regenerate' and 'reset' REST API endpoints in all versions up to, and including, 3.1.11. This makes it poss…
CVE-2026-0572MEDIUMCVSS 6.5EG 6.5
2026-02-04
The WebPurify Profanity Filter plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'webpurify_save_options' function in all versions up to, and including, 4.0.2. This makes it po…
CVE-2026-0593MEDIUMCVSS 5.3EG 5.3
2026-01-24
The WP Go Maps (formerly WP Google Maps) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the processBackgroundAction() function in all versions up to, and including, 10.0.04. Thi…
CVE-2026-0628HIGHCVSS 8.8EG 8.8
2026-01-07
Insufficient policy enforcement in WebView tag in Google Chrome prior to 143.0.7499.192 allowed an attacker who convinced a user to install a malicious extension to inject scripts or HTML into a privileged page via a crafted Chrome Extensi…
CVE-2026-0635MEDIUMCVSS 4.3EG 4.3
2026-01-14
The Responsive Accordion Slider plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'resp_accordion_silder_save_images' function in all versions up to, and including, 1.2.2. This…
CVE-2026-0656HIGHCVSS 8.2EG 8.2
2026-01-07
The iPaymu Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authentication in all versions up to, and including, 2.0.2 via the 'check_ipaymu_response' function. This is due to the plugin not validating webhook …
CVE-2026-0674MEDIUMCVSS 4.3EG 4.3
2026-01-08
Missing Authorization vulnerability in Campaign Monitor Campaign Monitor for WordPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Campaign Monitor for WordPress: from n/a through 2.9.1.
CVE-2026-0676MEDIUMCVSS 5.3EG 5.3
2026-01-08
Missing Authorization vulnerability in G5Theme Zorka zorka allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zorka: from n/a through <= 1.5.7.
CVE-2026-0679MEDIUMCVSS 5.3EG 5.3
2026-02-04
The Fortis for WooCommerce plugin for WordPress is vulnerable to authorization bypass due to an inverted nonce check in the 'check_fortis_notify_response' function in all versions up to, and including, 1.2.0. This makes it possible for una…
CVE-2026-0687MEDIUMCVSS 4.3EG 4.3
2026-01-24
The Meta-box GalleryMeta plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mb_gallery' custom post type in all versions up to, and including, 3.0.1. This makes it possible for…
CVE-2026-0692HIGHCVSS 7.5EG 7.5
2026-02-14
The BlueSnap Payment Gateway for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.4.0. This is due to the plugin relying on WooCommerce's `WC_Geolocation::get_ip_address()` fun…
CVE-2026-0718MEDIUMCVSS 5.3EG 5.3
2026-04-16
The Post Grid Gutenberg Blocks for News, Magazines, Blog Websites – PostX plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ultp_shareCount_callback() function in all version…
CVE-2026-0727MEDIUMCVSS 5.4EG 5.4
2026-02-14
The Accordion and Accordion Slider plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.5. This is due to the plugin not properly verifying that a user is authorized to perform an action in t…
CVE-2026-0814MEDIUMCVSS 4.3EG 4.3
2026-04-08
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_excel' function in all versions up to, and including, 2.0.9. This makes it possibl…
CVE-2026-0817MEDIUMCVSS 5.3EG 5.3
2026-01-09
Missing Authorization vulnerability in Wikimedia Foundation MediaWiki - CampaignEvents extension allows Privilege Abuse.This issue affects MediaWiki - CampaignEvents extension: 1.45, 1.44, 1.43, 1.39.
CVE-2026-0820MEDIUMCVSS 4.3EG 5.3
2026-01-17
The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference due to missing capability checks on the wc_upload_and_save_signature_handler function in all versions…
CVE-2026-0825MEDIUMCVSS 5.3EG 5.3
2026-01-28
The Database for Contact Form 7, WPforms, Elementor forms plugin for WordPress is vulnerable to authorization bypass due to missing capability checks on the CSV export functionality in all versions up to, and including, 1.4.5. This makes i…
CVE-2026-0829MEDIUMCVSS 5.8EG 5.8
2026-02-17
The Frontend File Manager Plugin WordPress plugin through 23.5 allows unauthenticated users to send emails through the site without any security checks. This lets attackers use the WordPress site as an open relay for spam or phishing email…
CVE-2026-0832HIGHCVSS 7.3EG 7.3
2026-01-28
The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on multiple REST API endpoints in all versions up to, and including, 3.2.2. This makes it pos…
CVE-2026-0845HIGHCVSS 7.2EG 7.2
2026-02-10
The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability ch…
CVE-2026-0927MEDIUMCVSS 5.3EG 5.3
2026-01-23
The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to arbitrary file uploads due to missing authorization checks in the uploadMedicalReport() function in all versions up to, and including, 3.6.15. …
CVE-2026-0929HIGHCVSS 4.3EG 7.5
2026-02-16
The RegistrationMagic WordPress plugin before 6.0.7.2 does not have proper capability checks, allowing subscribers and above to create forms on the site.
CVE-2026-0974HIGHCVSS 8.8EG 8.8
2026-02-19
The Orderable – WordPress Restaurant Online Ordering System and Food Ordering Plugin plugin for WordPress is vulnerable to unauthorized plugin installation due to a missing capability check on the 'install_plugin' function in all version…
CVE-2026-0998MEDIUMCVSS 4.3EG 4.3
2026-02-16
Mattermost versions 11.1.x <= 11.1.2, 10.11.x <= 10.11.9, 11.2.x <= 11.2.1 and Mattermost Plugin Zoom versions <=1.11.0 fail to validate user identity and post ownership in the {{/api/v1/askPMI}} endpoint which allows unauthorized users to…
CVE-2026-1000MEDIUMCVSS 6.5EG 6.5
2026-01-16
The MailerLite - WooCommerce integration plugin for WordPress is vulnerable to unauthorized data modification and deletion in all versions up to, and including, 3.1.3. This is due to missing capability checks on the resetIntegration() func…
CVE-2026-10029MEDIUMCVSS 5.3EG 5.3
2026-06-18
The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.13.1 via the get_events. This makes it possible for …
CVE-2026-1003MEDIUMCVSS 4.3EG 4.3
2026-01-16
The GetGenie plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.3.0. This is due to the plugin not properly verifying that a user is authorized to delete a specific post. This makes it possib…
CVE-2026-10033HIGHCVSS 7.3EG 7.3
2026-07-24
The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it…
CVE-2026-10034MEDIUMCVSS 5.3EG 5.3
2026-06-19
The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.39. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes …
CVE-2026-1004MEDIUMCVSS 5.3EG 5.3
2026-01-16
The Essential Addons for Elementor plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to and including 6.5.5 via the 'eael_product_quickview_popup' function. This makes it possible for unauthenticated a…
CVE-2026-10085MEDIUMCVSS 5.4EG 5.4
2026-07-13
Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constrained channel flag to public and private channels that support group synchronization, which allows an ordinary group or direct mes…
CVE-2026-1036MEDIUMCVSS 5.3EG 5.3
2026-01-22
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the delete_comment() function in all versions up to, and including, 1…
CVE-2026-1054MEDIUMCVSS 5.3EG 5.3
2026-01-28
The RegistrationMagic plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.0.7.4. This is due to missing nonce verification and capability checks on the rm_set_otp AJAX action handler. This makes …
CVE-2026-10609MEDIUMCVSS 6.8EG 6.8
2026-06-23
A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destinations without verifying that the ClusterLogForwarder creator has permission to use t…
CVE-2026-10616MEDIUMCVSS 4.3EG 4.3
2026-06-02
A weakness has been identified in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function TeamTasksTool.executeComplete of the file internal/tools/team_tasks_lifecycle.go of the component Team Task Completion Handler. Ex…
CVE-2026-10628MEDIUMCVSS 4.3EG 4.3
2026-07-11
The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to the plugin not properly verifying that a user is authorized to perform an action…
CVE-2026-10715MEDIUMCVSS 5.1EG 5.1
2026-06-12
Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send an arbitrary post_id to POST /admin/post_type/<POST_TYPE_ID>/drafts and overwrit…
CVE-2026-10737HIGHCVSS 7.5EG 7.5
2026-06-04
The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all versions up to, and including, 4.71. This makes it possible for unauthenticated …
CVE-2026-10768CRITICALCVSS 9.8EG 9.8
2026-07-10
Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0.
CVE-2026-10779MEDIUMCVSS 4.3EG 4.3
2026-06-19
The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 5.4.2. This is due to a missing capability/ownership check on the gallery_imag…
CVE-2026-10787MEDIUMCVSS 4.3EG 4.3
2026-06-08
Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user groups via a crafted API request. This issue affects : * Devolutions Server 2…
CVE-2026-10815MEDIUMCVSS 6.3EG 6.3
2026-06-04
A vulnerability was found in LakshayD02 Hostel-Management-System-PHP up to f87e67c283bab6f718faf2fec6ae39a13bd7036b. This issue affects some unknown processing of the file hostel/index.php of the component Admin Dashboard Page. The manipul…
CVE-2026-10831MEDIUMCVSS 6.9EG 6.9
2026-06-16
A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does not properly validate whether a sender is associated with a valid data port session before accepti…
CVE-2026-10855MEDIUMCVSS 4.3EG 4.3
2026-06-04
An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template in overwrite mode, the application checked whether a matching template already existed but did not verify that the impor…

Map vulnerabilities like CWE-862 to your infrastructure

EchelonGraph correlates every CVE — across CWE-862 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →