CWE-862 · Missing Authorization (page 10)
Page 10 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-56423 | High | 8.8 | 2026-06-22 | MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authori… |
CVE-2026-44914 | High | 7.2 | 2026-06-22 | Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions b… |
CVE-2026-7859 | Medium | 5.3 | 2026-06-22 | The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on one of its AJAX actions, allowing unauthenticated attackers t… |
CVE-2026-56396 | High | 8.8 | 2026-06-21 | phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to… |
CVE-2026-56384 | Medium | 4.3 | 2026-06-21 | Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private… |
CVE-2026-56341 | High | 7.5 | 2026-06-20 | AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens… |
CVE-2026-12119 | Medium | 6.5 | 2026-06-20 | The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode att… |
CVE-2026-11912 | High | 7.5 | 2026-06-20 | The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and incl… |
CVE-2026-56213 | Medium | 5.3 | 2026-06-20 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER function exposed via PostgREST RPC, all… |
CVE-2026-48582 | Critical | 9.6 | 2026-06-19 | Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network. |
CVE-2026-49291 | High | 8.1 | 2026-06-19 | mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read… |
CVE-2026-49288 | Medium | 4.3 | 2026-06-19 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and… |
CVE-2026-12238 | Medium | 5.3 | 2026-06-19 | The WP Go Maps – Most Popular Map Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.1.01. This is due… |
CVE-2026-49357 | | 2026-06-19 | Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly operate the LINE Desktop application on… | |
CVE-2026-6798 | Medium | 5.3 | 2026-06-19 | The 2Download Connector for 2DL Hosted Checkout plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 0.1.5. This is… |
CVE-2026-3640 | Medium | 5.3 | 2026-06-19 | The STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and including 4.5. The plugin registers a R… |
CVE-2026-9013 | Medium | 4.3 | 2026-06-19 | The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the bogo_rest_create_post_transla… |
CVE-2026-10779 | Medium | 4.3 | 2026-06-19 | The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including… |
CVE-2026-10034 | Medium | 5.3 | 2026-06-19 | The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.39. This is due to the plugin no… |
CVE-2026-52866 | Medium | 6.5 | 2026-06-19 | An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing legitimate users or applications from e… |
CVE-2026-49205 | Medium | 6.5 | 2026-06-18 | phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed thi… |
CVE-2026-11719 | | 2026-06-18 | An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers. While… | |
CVE-2026-28573 | Medium | 5.5 | 2026-06-18 | In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no… |
CVE-2026-9199 | Medium | 4.3 | 2026-06-18 | The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to authorization bypass in all versio… |
CVE-2026-12093 | Medium | 5.3 | 2026-06-18 | The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to the plugin not pro… |
CVE-2026-10029 | Medium | 5.3 | 2026-06-18 | The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions… |
CVE-2026-12407 | High | 8.8 | 2026-06-18 | The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to… |
CVE-2026-12515 | Medium | 4.3 | 2026-06-17 | A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allo… |
CVE-2026-54810 | High | 7.5 | 2026-06-17 | Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Nex… |
CVE-2026-54415 | High | 8.1 | 2026-06-17 | Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker… |
CVE-2025-69189 | High | 7.3 | 2026-06-17 | Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n… |
CVE-2026-8383 | Medium | 5.3 | 2026-06-17 | The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthe… |
CVE-2026-54802 | High | 7.5 | 2026-06-17 | Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions. |
CVE-2026-49081 | High | 8.2 | 2026-06-17 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions. |
CVE-2026-49072 | Medium | 6.5 | 2026-06-17 | Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions. |
CVE-2026-49057 | High | 7.5 | 2026-06-17 | Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions. |
CVE-2026-48797 | | 2026-06-17 | Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, the optional Reflex web UI exposes a trai… | |
CVE-2026-48783 | Medium | 4.8 | 2026-06-17 | Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscript… |
CVE-2026-45436 | Medium | 6.5 | 2026-06-17 | Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions. |
CVE-2026-40726 | High | 8.2 | 2026-06-17 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions. |
CVE-2026-40723 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions. |
CVE-2026-40722 | Medium | 5.5 | 2026-06-17 | Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2026-39595 | Medium | 4.7 | 2026-06-17 | Author Broken Access Control in W3 Total Cache <= 2.9.1 versions. |
CVE-2026-39433 | Medium | 6.5 | 2026-06-17 | Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions. |
CVE-2026-28615 | High | 7.8 | 2026-06-17 | In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with… |
CVE-2026-28587 | Medium | 5.5 | 2026-06-17 | In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local… |
CVE-2026-24611 | Critical | 9.1 | 2026-06-17 | Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions. |
CVE-2026-24610 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in MetForm Pro <= 3.9.1 versions. |
CVE-2026-24575 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in WishList Member X <= 3.29.0 versions. |
CVE-2026-22343 | High | 8.6 | 2026-06-17 | Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions. |
CVE-2026-11858 | | 2026-06-17 | Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\SYSTEM… | |
CVE-2026-0092 | High | 7.8 | 2026-06-17 | In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with… |
CVE-2026-0081 | High | 7.8 | 2026-06-17 | In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escalation of privilege with no additional ex… |
CVE-2026-0071 | High | 7.8 | 2026-06-17 | In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilege with no additio… |
CVE-2026-0057 | Low | 3.3 | 2026-06-17 | In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could l… |
CVE-2025-69137 | Medium | 6.5 | 2026-06-17 | Subscriber Broken Access Control in Genemy <= 1.6.6 versions. |
CVE-2025-69103 | High | 7.5 | 2026-06-17 | Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions. |
CVE-2025-48640 | High | 8.0 | 2026-06-17 | In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adja… |
CVE-2025-48617 | High | 7.8 | 2026-06-17 | In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of… |
CVE-2024-37496 | Medium | 4.3 | 2026-06-17 | Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2024-37210 | Medium | 6.5 | 2026-06-17 | Missing Authorization vulnerability in ali2woo AliNext allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AliNext: fr… |
CVE-2024-33909 | Medium | 5.3 | 2026-06-17 | Missing Authorization vulnerability in Avirtum iPages Flipbook allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects iPa… |
CVE-2024-33685 | Medium | 4.3 | 2026-06-17 | Missing Authorization vulnerability in Jegstudio Startupzy startupzy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affec… |
CVE-2024-32949 | High | 8.3 | 2026-06-17 | Missing Authorization vulnerability in Prince Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affec… |
CVE-2024-31435 | Medium | 4.3 | 2026-06-17 | : Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue… |
CVE-2024-24709 | Medium | 4.3 | 2026-06-17 | Missing Authorization vulnerability in Shareaholic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Shareaholic: fr… |
CVE-2026-12105 | Medium | 6.5 | 2026-06-16 | Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited pe… |
CVE-2026-0158 | Low | 3.3 | 2026-06-16 | In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no add… |
CVE-2026-0145 | Low | 3.3 | 2026-06-16 | In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional executio… |
CVE-2026-0133 | High | 7.8 | 2026-06-16 | In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permission check. This coul… |
CVE-2026-53866 | High | 8.1 | 2026-06-16 | OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved… |
CVE-2026-53851 | Medium | 5.3 | 2026-06-16 | OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction not… |
CVE-2026-53850 | Medium | 5.5 | 2026-06-16 | OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the comma… |
CVE-2026-53844 | Medium | 6.5 | 2026-06-16 | OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory e… |
CVE-2026-10831 | | 2026-06-16 | A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does not properly valid… | |
CVE-2025-14272 | | 2026-06-16 | A security issue was identified in Pavilion due to improper authorization enforcement in API endpoints. This vulnerability can allow an unauthorized actor to e… | |
CVE-2026-54190 | Medium | 6.5 | 2026-06-16 | Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions. |
CVE-2026-52714 | Medium | 5.9 | 2026-06-16 | Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions. |
CVE-2026-52711 | High | 7.5 | 2026-06-16 | Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions. |
CVE-2026-40809 | Medium | 6.5 | 2026-06-16 | Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2026-39490 | High | 7.5 | 2026-06-16 | Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions. |
CVE-2026-2381 | Medium | 6.5 | 2026-06-16 | The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_p… |
CVE-2025-68045 | High | 7.5 | 2026-06-16 | Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions. |
CVE-2026-9187 | Medium | 5.3 | 2026-06-16 | The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a… |
CVE-2026-6964 | Medium | 5.3 | 2026-06-16 | The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plu… |
CVE-2026-49775 | Medium | 6.5 | 2026-06-15 | Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions. |
CVE-2026-49070 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions. |
CVE-2026-49065 | High | 8.2 | 2026-06-15 | Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions. |
CVE-2026-48887 | Medium | 6.5 | 2026-06-15 | Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions. |
CVE-2026-48883 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions. |
CVE-2026-48881 | Critical | 9.1 | 2026-06-15 | Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions. |
CVE-2026-48873 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Montonio for WooCommerce <= 10.1.2 versions. |
CVE-2026-48835 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions. |
CVE-2026-48709 | Low | 3.7 | 2026-06-15 | OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/inter… |
CVE-2026-42666 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions. |
CVE-2026-42664 | High | 8.2 | 2026-06-15 | Unauthenticated Broken Access Control in AI Product Search for WooCommerce – Motive Commerce Search <= 1.38.2 versions. |
CVE-2026-42659 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions. |
CVE-2026-42651 | Medium | 6.3 | 2026-06-15 | Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions. |
CVE-2026-42640 | Medium | 6.5 | 2026-06-15 | Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions. |
CVE-2026-40795 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Access Control in Amelia <= 2.2 versions. |