CWE-862 · Missing Authorization (page 10)
Page 10 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-78953 | Low | 3.1 | 2026-08-25 | Missing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass sit… |
CVE-2026-78897 | Medium | 6.5 | 2026-08-25 | Missing authorization in BrowserTag in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive informa… |
CVE-2026-70550 | Medium | 6.5 | 2026-08-25 | An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadat… |
CVE-2026-69104 | High | 7.6 | 2026-08-25 | An authenticated user may initiate repository migration operations without required repository permissions, potentially causing information disclosure, unautho… |
CVE-2026-55541 | | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonai 4.6.58, praisonai serve agents and praisonai serve unified parse --api-key but _create_agents_app()… | |
CVE-2026-55530 | Medium | 6.1 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, ast_grep_rewrite lacks the @require_approval decorator used by sibling mutation tools… |
CVE-2026-55528 | High | 8.2 | 2026-08-25 | PraisonAI is a multi-agent teams system. Prior to praisonaiagents 1.6.58, AgentServer exposes ServerConfig.auth_token but AgentServer._create_app does not chec… |
CVE-2026-79672 | Medium | 5.5 | 2026-08-25 | Ech0 before 4.4.3 fails to enforce scope-based authorization on nine comment panel admin endpoints, allowing access tokens with minimal scopes to perform full… |
CVE-2026-79669 | Medium | 4.3 | 2026-08-25 | Ech0 before 4.4.3 lacks authorization checks on system log endpoints allowing any authenticated non-admin user to read and stream all server logs. Attackers ca… |
CVE-2026-79666 | Medium | 6.5 | 2026-08-25 | Ech0 before 4.4.3 fails to enforce administrator authorization on dashboard log endpoints, allowing any authenticated user to access system logs. Attackers wit… |
CVE-2026-79665 | High | 8.8 | 2026-08-25 | Ech0 before 4.5.1 contains an authorization bypass vulnerability where session tokens skip scope validation in RequireScopes middleware, allowing logged-in non… |
CVE-2026-75908 | Medium | 4.3 | 2026-08-25 | The Newsletters plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.17. This is due to the plugin not properly v… |
CVE-2026-17587 | Medium | 5.3 | 2026-08-25 | The My Agile Privacy® – CMP, Cookie Consent & Privacy Tools plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3… |
CVE-2026-79652 | Medium | 5.9 | 2026-08-25 | A flaw was found in the JWT Bearer authorization grant implementation within the keycloak-services component of Red Hat Build of Keycloak. This component handl… |
CVE-2026-77146 | | 2026-08-25 | The extension's invitation controller fails to stop processing after redirecting on invalid input (missing hash, non-existent, disabled, or deleted users), all… | |
CVE-2026-77143 | | 2026-08-25 | The frontend topic editing flow does not verify on the server side that the requesting visitor owns the topic being modified. As a result, a visitor who knows… | |
CVE-2026-77142 | | 2026-08-25 | The frontend company self-service editing feature relies on a template-level visibility flag to hide the edit form for company records a visitor does not own… | |
CVE-2026-77141 | | 2026-08-25 | The extension resolves the targeted club record from a user-supplied request argument in its frontend edit, update, and activate actions, but performs no owner… | |
CVE-2026-77140 | | 2026-08-25 | The extension validates the HMAC of a frontend employee edit link only in the action that renders the edit form, not in the action that persists the change. An… | |
CVE-2026-77133 | | 2026-08-25 | The extension fails to restrict which frontend usergroups a logged-in user may assign to their own account when the profile edit plugin uses its default field… | |
CVE-2026-77128 | | 2026-08-25 | The extension fails to enforce enable-field restrictions on a repository query parameter. An unauthenticated remote user can pass a demand-override parameter t… | |
CVE-2026-56092 | | 2026-08-25 | The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persist… | |
CVE-2026-17548 | | 2026-08-25 | Missing authorization in Checkmk <2.5.0p12, <2.4.0p36, <2.3.0p50 and all 2.2.0 versions allows an authenticated user who knows the ID of a background job to vi… | |
CVE-2026-66109 | High | 7.8 | 2026-08-25 | A missing authorization vulnerability exists in SKYSEA Client View and SKYMEC IT Manager. If this vulnerability is exploited, an attacker who can log in to the… |
CVE-2026-75930 | Medium | 4.3 | 2026-08-25 | The FundEngine – Donation and Crowdfunding Platform plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.8.1. Thi… |
CVE-2026-19892 | High | 8.8 | 2026-08-25 | The InfusedWoo Pro plugin for WordPress is vulnerable to Privilege Escalation via Account Takeover in all versions up to, and including, 5.1.17. This is due to… |
CVE-2026-75982 | Medium | 4.4 | 2026-08-25 | The LearnPress plugin for WordPress is vulnerable to unauthorized modification of arbitrary WordPress options in versions up to, and including, 4.4.4 via the l… |
CVE-2026-10627 | Medium | 5.3 | 2026-08-25 | The Events Manager – Calendar, Bookings, Tickets, and more! plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7… |
CVE-2026-56707 | High | 7.7 | 2026-08-25 | Grav Flex Objects plugin versions 1.4.0 through 1.4.7 contain an authorization bypass vulnerability in the flex-objects shortcode that allows users with page-e… |
CVE-2026-19801 | Medium | 4.3 | 2026-08-25 | The BetterLinks – Link Shortener, Link Cloaking, Redirects, Affiliate Link Manager & MCP plugin for WordPress is vulnerable to authorization bypass in all vers… |
CVE-2026-78266 | Medium | 6.5 | 2026-08-24 | Subscriber Broken Access Control in AutomatorWP <= 5.8.3 versions. |
CVE-2026-27364 | Medium | 6.5 | 2026-08-24 | Subscriber Broken Access Control in Style Kits <= 2.6.5 versions. |
CVE-2026-71509 | Medium | 6.5 | 2026-08-24 | Dolibarr before 24.0.0 contains an improper authorization vulnerability in the expense report REST API update endpoint that allows authenticated attackers with… |
CVE-2026-71508 | Medium | 6.5 | 2026-08-24 | Dolibarr before 24.0.0 contains an improper authorization vulnerability in the user REST API update endpoint that allows attackers with user-write rights to mo… |
CVE-2026-71504 | High | 8.1 | 2026-08-24 | Dolibarr before 24.0.0 contains an improper authorization vulnerability in the Members REST API that allows attackers with only member-creation rights to reset… |
CVE-2026-71933 | Critical | 9.1 | 2026-08-24 | Multiple DrayTek VigorSwitch models contain unauthorized operation vulnerabilities in multiple syslog functions. The vulnerability is caused by missing authori… |
CVE-2026-78387 | | 2026-08-24 | RansomLook contains an authorization weakness in the web-based configuration editor exposed through the /admin/config endpoint. The endpoint requires an authen… | |
CVE-2026-39914 | Medium | 6.5 | 2026-08-24 | TIM Flow before 26.0.6 contains an improper authorization vulnerability that allows any authenticated user to submit arbitrary SQL queries to a privileged dash… |
CVE-2026-78380 | | 2026-08-24 | RansomLook fails to enforce the privacy status of ransomware groups and markets when distributing newly collected victim posts to external notification channel… | |
CVE-2026-78372 | | 2026-08-24 | RansomLook does not consistently enforce authorization checks when accessing groups, markets, and ransom notes marked as private. An unauthenticated or other… | |
CVE-2026-78370 | | 2026-08-24 | RansomLook contains an authorization flaw in its legacy database export functionality that can allow unauthenticated remote users to retrieve information inten… | |
CVE-2026-76847 | High | 8.8 | 2026-08-24 | act starts an HTTP Artifacts V4 backend whenever a workflow uses actions/upload-artifact@v4 or actions/download-artifact@v4. The control-plane RPCs of that bac… |
CVE-2026-78365 | | 2026-08-24 | Authorization Bypass Through User-Controlled Key in the supplier API in Roskus Prospero Flow CRM 4.0.0 through 5.3.1 allows any authenticated user to read and… | |
CVE-2026-78291 | Medium | 5.3 | 2026-08-24 | Unauthenticated Broken Access Control in RepairBuddy <= 4.1223 versions. |
CVE-2026-78272 | Medium | 5.4 | 2026-08-24 | Subscriber Broken Access Control in Fluent Support Pro <= 2.3.1 versions. |
CVE-2026-78258 | Medium | 5.3 | 2026-08-24 | Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.5 versions. |
CVE-2026-28190 | High | 7.1 | 2026-08-24 | Subscriber Broken Access Control in ProLancer Element <= 1.4.8 versions. |
CVE-2026-28153 | High | 7.5 | 2026-08-24 | Unauthenticated Broken Access Control in Notification Master – Real-Time WordPress Notifications With Email, SMS, Webhooks & More <= 1.7.1 versions. |
CVE-2026-19200 | High | 8.9 | 2026-08-24 | The Velociraptor verify() VQL function allows a user to verify an artifact for syntatic and other issues. Due to an implementation fault in this VQL function… |
CVE-2026-78204 | Medium | 5.4 | 2026-08-24 | Ghostwriter through 7.2.6 does not apply per-object authorization on its report template lint endpoints. RoleBasedAccessControlMixin.test_func returns only req… |
CVE-2026-14853 | Medium | 4.3 | 2026-08-23 | The WooCommerce Bookings WordPress plugin before 3.9.0 does not perform a capability check on one of its AJAX actions, and its nonce check can be bypassed by o… |
CVE-2026-75866 | Critical | 9.1 | 2026-08-22 | Punk::OAuth2::Server versions through 0.03 for Perl issue access tokens outside a client's registered scopes and grant types because no authorization path read… |
CVE-2026-5093 | Medium | 4.3 | 2026-08-22 | The GreenShift – Animation and Page Builder Blocks plugin for WordPress is vulnerable to unauthorized modification of data in versions up to, and including, 12… |
CVE-2026-4244 | Medium | 4.3 | 2026-08-22 | The Post Duplicator plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `duplicate_post()` functio… |
CVE-2026-12710 | | 2026-08-22 | A Missing Authorization vulnerability in the QueryEngineTask of Google Cloud Application Integration (versions from 2025-04-28 to 2026-04-04) allows an externa… | |
CVE-2026-76074 | Medium | 4.3 | 2026-08-22 | The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization byp… |
CVE-2026-76057 | Medium | 4.3 | 2026-08-22 | The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to authorization byp… |
CVE-2026-75027 | Medium | 5.3 | 2026-08-22 | The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.8.0. This is due to the plugin not prope… |
CVE-2026-53487 | Medium | 4.3 | 2026-08-21 | Kite is a Kubernetes dashboard. Prior to version 0.12.3, authenticated Kite users with any role can request `/api/v1/overview` for a cluster that their roles d… |
CVE-2026-34836 | Medium | 6.5 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, improper access control in ajax.render.php and ajax.document.php allows for document ac… |
CVE-2026-33047 | Medium | 4.3 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, an object can be locked by a user who is not assigned write permissions. This issue has… |
CVE-2026-31936 | High | 8.8 | 2026-08-21 | Combodo iTop is a web based IT service management tool. Prior to 3.2.3, users can access to unauthorized object information through the search operation. This… |
CVE-2026-62283 | Critical | 9.9 | 2026-08-21 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. Nezha versions 1.14.13 through 1.14.14 and 2.0.0 through 2.0.9… |
CVE-2026-76876 | Medium | 5.9 | 2026-08-21 | Craftplan before 0.5.1 contains a broken access control vulnerability that allows unauthenticated attackers to read sensitive credentials by exploiting an unco… |
CVE-2026-75932 | High | 8.6 | 2026-08-21 | Jet Admin allows an attacker to create a malicious app and connect it to a target user's custom domain, edit the authentication configuration, and reroute traf… |
CVE-2026-77087 | Critical | 9.6 | 2026-08-21 | Paperclip before 0.3.1 in default local_trusted mode fails to validate Host headers, allowing attackers to execute arbitrary commands via DNS rebinding. An att… |
CVE-2026-62940 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.3.0, when migrating an instance to another cluster member, user-supplied configurat… |
CVE-2026-48751 | Critical | 9.9 | 2026-08-21 | Incus is a system container and virtual machine manager. Prior to version 7.2.0, instance snapshots ignore the `restricted.containers.lowlevel=block` setting… |
CVE-2026-77767 | High | 7.5 | 2026-08-21 | Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user holding the administrator role, so contro… |
CVE-2026-66721 | Low | 2.7 | 2026-08-21 | Missing authorization issue for domain admins in CloudStack's host tags listing functionality. Domain Admins, by default, have permission to call the listH… |
CVE-2026-50222 | High | 7.5 | 2026-08-21 | Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's Userdata reference APIs. Several userda… |
CVE-2026-16962 | Medium | 5.3 | 2026-08-21 | The Tamara Checkout WordPress plugin through 1.9.9.20 does not verify the order key, a nonce, or any capability on its public payment cancel/fail return URLs… |
CVE-2026-77391 | Medium | 4.3 | 2026-08-21 | A security flaw has been discovered in SourceCodester Dynamic Input Field Generator Using HTML, CSS, and PHP 1.0. This affects an unknown function. The manipul… |
CVE-2026-72843 | Critical | 9.8 | 2026-08-20 | The customer update route in EverShop is declared with "access": "public" in packages/evershop/src/modules/customer/api/updateCustomer/route.json, which causes… |
CVE-2026-54509 | Medium | 6.5 | 2026-08-20 | TREK is a collaborative travel planner. From 3.0.0 until 3.1.0, the GET /api/journeys/:id/share-link route in server/src/routes/journey.ts returns the result o… |
CVE-2026-19755 | | 2026-08-20 | NoSleep 1.5.1 exposes a privileged XPC Mach service and accepts raw dictionary messages containing attacker-controlled command and NSBundlePath values.This iss… | |
CVE-2026-63003 | Medium | 6.5 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, page duplication lacks an object-le… |
CVE-2026-61663 | Medium | 4.3 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.9, render_object_structure fails to au… |
CVE-2026-54624 | Medium | 6.5 | 2026-08-20 | django CMS is an easy-to-use and developer-friendly enterprise content management system powered by Django. Prior to 5.0.8, render_object_structure in cms/view… |
CVE-2026-53569 | | 2026-08-20 | Frappe is a full-stack web application framework. In version 16.31.0 and earlier, the whitelisted toggle_like and mark_as_seen endpoints in frappe/desk/like.py… | |
CVE-2026-55095 | | 2026-08-20 | OpenProject is open-source, web-based project management software. In version 17.5.1 and earlier, an authenticated non-admin project member can request the inp… | |
CVE-2026-76633 | High | 8.1 | 2026-08-20 | WeGIA before 3.9.2 contains an authorization bypass vulnerability in the password change flow that allows any authenticated user to change their account passwo… |
CVE-2026-64965 | | 2026-08-20 | ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user (e.g. a student) enrolled in a… | |
CVE-2026-28163 | Medium | 5.3 | 2026-08-20 | Missing Authorization vulnerability in myCred New User Approve allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects New… |
CVE-2026-74021 | High | 7.5 | 2026-08-20 | Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions. |
CVE-2026-74020 | High | 7.5 | 2026-08-20 | Unauthenticated Broken Access Control in Koji <= 2.2.1 versions. |
CVE-2026-74019 | High | 7.1 | 2026-08-20 | Unauthenticated Broken Access Control in EPROLO Dropshipping <= 2.4.2 versions. |
CVE-2026-66647 | Medium | 6.5 | 2026-08-20 | Subscriber Broken Access Control in Homlisti <= 3.1.2 versions. |
CVE-2026-66595 | Medium | 5.9 | 2026-08-20 | Unauthenticated Broken Access Control in WP Data Access <= 5.5.80 versions. |
CVE-2025-53999 | Medium | 6.5 | 2026-08-20 | Unauthenticated Broken Access Control in Altair <= 5.2.2 versions. |
CVE-2026-17153 | Medium | 5.3 | 2026-08-20 | The AI Agent by SiteGround plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2.7. This is due to the plugin no… |
CVE-2026-76398 | Medium | 4.3 | 2026-08-19 | In Splunk AI Toolkit versions below 6.0.1, a user who does not hold the "admin" or "power" Splunk roles could delete the experiment history of another user wit… |
CVE-2026-76394 | High | 8.3 | 2026-08-19 | In Splunk AI Toolkit versions below 6.0.0, a low-privileged user who does not hold the "admin" or "power" Splunk roles could start, stop, and configure contain… |
CVE-2026-76368 | Low | 2.7 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, a user who holds a role that contains the playbooks:view permission could view metadata about a playbook repository that t… |
CVE-2026-76360 | Medium | 4.3 | 2026-08-19 | In Splunk SOAR versions below 8.6.0, an authenticated user with no role assigned could use the /rest/health endpoint to gather system and cluster telemetry tha… |
CVE-2026-76348 | Low | 3.8 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds a Splunk role that contains the high-privilege list_search_head_cluste… |
CVE-2026-76340 | Medium | 5.3 | 2026-08-19 | In Splunk Enterprise 10.4 versions below 10.4.2, an unauthenticated user could cause Splunk Enterprise to reload token-signing keys through the Representationa… |
CVE-2026-76336 | High | 7.1 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2 and 10.2.6, a user who does not hold the "admin" or "power" Splunk roles could delete all Search Processing Language… |
CVE-2026-76322 | Medium | 6.7 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a user who holds the "user" Splunk role could craft a Dashboard Studio dashboard that r… |
CVE-2026-76319 | High | 8.8 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, a low-privileged user that does not hold the fsh_manage capability could perform Remote… |