CWE-862 · Missing Authorization (page 11)
Page 11 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-76257 | Medium | 6.5 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, 10.0.9, and 9.4.14, and Splunk Secure Gateway versions below 3.10.10, 3.9.24, and 3.8.71, a user who holds… |
CVE-2026-76255 | Medium | 6.4 | 2026-08-19 | In Splunk Enterprise versions below 10.4.1, 10.2.6, 10.0.8, and 9.4.13, a user who does not hold the "admin" or "power" Splunk roles could trick another user i… |
CVE-2026-76251 | High | 7.1 | 2026-08-19 | In Splunk Enterprise versions below 10.4.2, 10.2.6, and 10.0.9, a user who does not hold the "admin" or "power" Splunk roles could cause the Splunk App for Spl… |
CVE-2026-59992 | Medium | 5.4 | 2026-08-19 | Tina is a headless content management system. Prior to next-tinacms-s3 23.0.4, next-tinacms-dos 23.0.4, next-tinacms-azure 14.0.4, and next-tinacms-cloudinary… |
CVE-2026-54741 | | 2026-08-19 | Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, Lemmy blocks new private messages from a sender after the recipien… | |
CVE-2026-54740 | Medium | 6.5 | 2026-08-19 | Lemmy is a link aggregator and forum for the fediverse. Prior to 0.19.19 and 1.0.0-alpha.18, a lower-ranked remote moderator can remove a higher-ranked moderat… |
CVE-2026-53547 | High | 8.8 | 2026-08-19 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the POST /database/export endpoin… |
CVE-2026-53546 | Critical | 9.6 | 2026-08-19 | Termix is a web-based server management platform with SSH terminal, tunneling, and file editing capabilities. Prior to 2.3.2, the terminal WebSocket accepts a… |
CVE-2026-18544 | High | 8.1 | 2026-08-19 | IBM Portieris 0.5.0 through 0.14.2 could allow a remote authenticated attacker to bypass image policy enforcement due to improper authorization of pod owner re… |
CVE-2026-76647 | High | 8.8 | 2026-08-19 | Leantime JSON-RPC API through version 3.9.0 contains a missing authorization vulnerability in the JSON-RPC dispatcher in app/Domain/Api/Controllers/Jsonrpc.php… |
CVE-2026-55703 | Medium | 4.3 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.3, any activated account can request /maintenances/{id} and read maintenance records for assets… |
CVE-2026-55483 | High | 8.8 | 2026-08-19 | Snipe-IT is an IT asset/license management system. Prior to 8.6.0, an authenticated user with users.create permission can submit the admin permission while cre… |
CVE-2026-16938 | Medium | 6.9 | 2026-08-19 | IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, FW1060.00 through FW1060.80, and FW950.00 through FW950.H2 is affected by a vulnerability in… |
CVE-2026-16930 | High | 8.2 | 2026-08-19 | IBM Power Systems Firmware FW1120.00, FW1110.00 through FW1110.30, and FW1060.00 through FW1060.80 is affected by a vulnerability in the interface between the… |
CVE-2026-64852 | | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.8, the Grav API plugin intercepts the api… | |
CVE-2026-62670 | Medium | 6.3 | 2026-08-19 | Grav Flex Objects Plugin allows you to build custom collections of objects. Prior to 1.4.3, the Grav Flex Objects Admin Next API requireFlexPermission() method… |
CVE-2026-62667 | High | 8.1 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, the Grav API plugin ApiKeyManager::gen… |
CVE-2026-62666 | High | 8.8 | 2026-08-19 | Grav API Plugin is a RESTful API for Grav CMS that provides full headless access to your site's content. Prior to 1.0.6, Grav API plugin UsersController::creat… |
CVE-2026-58565 | High | 8.8 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentiall… |
CVE-2026-58562 | High | 7.3 | 2026-08-19 | Dell Command Update (DCU), versions prior to 5.7.1, contain a Missing Authorization vulnerability. A low privileged attacker with local access could potentiall… |
CVE-2026-45273 | | 2026-08-19 | MyBooks is an ebook management web server also known as Talebook. In 3.41.2 and earlier, the AdminSettings.post handler for POST /api/admin/settings in webserv… | |
CVE-2026-76223 | High | 7.1 | 2026-08-19 | ArcadeDB (com.arcadedb) versions 26.7.3 and earlier fail to enforce the UPDATE_SCHEMA permission check when a DEFINE FUNCTION statement targets an already-exis… |
CVE-2026-76215 | Medium | 5.3 | 2026-08-19 | phpMyFAQ before 4.1.7 fails to apply parent FAQ visibility checks before returning child resources including comments and attachments. Unauthenticated attacker… |
CVE-2026-76211 | Medium | 4.3 | 2026-08-19 | phpMyFAQ before 4.1.7 fails to properly enforce CONFIGURATION_EDIT permission on admin API read endpoints for LDAP, Elasticsearch, OpenSearch, and dashboard co… |
CVE-2026-76209 | Medium | 4.3 | 2026-08-19 | phpMyFAQ versions before v4.1.6 fail to validate the security.enableRegistration setting in API endpoints, allowing attackers to create user accounts when regi… |
CVE-2026-73394 | High | 7.5 | 2026-08-19 | Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions. |
CVE-2026-73385 | High | 7.5 | 2026-08-19 | Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions. |
CVE-2026-73363 | Medium | 6.5 | 2026-08-19 | Unauthenticated Broken Access Control in Taxi Booking Manager for WooCommerce < 2.0.8 versions. |
CVE-2026-18779 | Medium | 5.3 | 2026-08-19 | The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to delete ar… |
CVE-2026-18777 | Medium | 5.3 | 2026-08-19 | The TrueBooker WordPress plugin before 1.2.7 does not have proper authorisation checks in one of its AJAX actions, allowing unauthenticated users to change th… |
CVE-2026-13173 | Low | 2.7 | 2026-08-19 | The Eventin WordPress plugin before 4.1.21 does not verify the current user's permission to edit other users before assigning roles and updating user metadata… |
CVE-2026-66589 | Medium | 5.4 | 2026-08-18 | Missing Authorization vulnerability in Kings Plugins B2BKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects B2BKi… |
CVE-2026-53453 | | 2026-08-18 | Blueprint Studio is a VS Code-like file editor for Home Assistant configuration files. Prior to 2.5.2, Blueprint Studio exposed administrator-intended backend… | |
CVE-2026-12631 | Medium | 6.5 | 2026-08-18 | The Zephyr kernel validates the k_thread_join() and k_thread_abort() system calls (declared __syscall in include/zephyr/kernel.h) through thread_obj_validate()… |
CVE-2026-76032 | Medium | 4.3 | 2026-08-18 | Pydio Cells 5.0.0 through 5.0.2 returns share-link details to any authenticated user. The REST handler for GET /a/share/link/{Uuid} in idm/share/rest/handler.g… |
CVE-2026-71322 | Medium | 4.3 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, CertificateExport placed its CertificatePermission ownership check inside the plugin.requires_key branc… |
CVE-2026-71317 | Medium | 6.5 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/authorities with type=subca did not require AuthorityPermission on the parent authority whe… |
CVE-2026-71308 | High | 8.1 | 2026-08-18 | Lemur manages TLS certificate creation. From 0.5.0 until 1.9.3, certificate create, upload, and edit requests accepted replaces[] or replacements identifiers t… |
CVE-2026-71307 | High | 7.7 | 2026-08-18 | Lemur manages TLS certificate creation. Prior to 1.9.3, GET /api/1/destinations and GET /api/1/destinations/ relied only on authentication while sibling write… |
CVE-2026-67443 | | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the allowDashboard authorization gate in server/integrations/no… | |
CVE-2026-67440 | | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. In 1.3.2 and earlier, the DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and… | |
CVE-2026-47721 | Medium | 6.3 | 2026-08-18 | FUXA is a web-based Process Visualization (SCADA/HMI/Dashboard) software. Prior to 1.3.2, POST /api/scheduler and DELETE /api/scheduler in server/api/scheduler… |
CVE-2026-65959 | Medium | 5.3 | 2026-08-18 | Vitess is a database clustering system for horizontal scaling of MySQL. In 24.0.2 and earlier, the /debug/vrlog endpoint registered by addHttpEndpoint() in go/… |
CVE-2026-67262 | High | 8.1 | 2026-08-18 | Dell PowerStore contains a Missing Authorization vulnerability. An attacker with access to a mapped host could exploit this vulnerability to read from or write… |
CVE-2026-55106 | Medium | 5.3 | 2026-08-18 | authentik is an open-source identity provider. Prior to 2026.2.6 and 2026.5.5, a diagnostic action on the LDAP Source API does not enforce the object-level rea… |
CVE-2026-45124 | Medium | 4.3 | 2026-08-18 | MyBB is free and open source forum software. Prior to 1.8.40, the Mod CP Report Center does not check permissions consistently, allowing moderators without rep… |
CVE-2026-74006 | Medium | 4.3 | 2026-08-18 | Contributor Broken Access Control in WP Table Builder <= 2.2.0 versions. |
CVE-2026-74004 | Medium | 5.4 | 2026-08-18 | Subscriber Broken Access Control in Gravity Booster – Styles & Layouts for Gravity Forms <= 6.0 versions. |
CVE-2026-74003 | Medium | 4.3 | 2026-08-18 | Contributor Broken Access Control in RomethemeForm For Elementor <= 1.2.6 versions. |
CVE-2026-73994 | High | 7.5 | 2026-08-18 | Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions. |
CVE-2026-73404 | Medium | 6.5 | 2026-08-18 | Subscriber Broken Access Control in MasterStudy LMS <= 3.7.41 versions. |
CVE-2026-73377 | High | 7.5 | 2026-08-18 | Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions. |
CVE-2026-73356 | High | 8.2 | 2026-08-18 | Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions. |
CVE-2026-73352 | Medium | 6.5 | 2026-08-18 | Unauthenticated Broken Access Control in GiveWP <= 4.16.5.1 versions. |
CVE-2026-73348 | Medium | 6.5 | 2026-08-18 | Unauthenticated Broken Access Control in GiveWP < 4.16.6 versions. |
CVE-2026-69189 | High | 7.6 | 2026-08-18 | Hoppscotch is an open source API development ecosystem. Prior to 2026.6.0, the team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLS… |
CVE-2026-66651 | Medium | 6.5 | 2026-08-18 | Missing Authorization vulnerability in MultiVendorX MultiVendorX dc-woocommerce-multi-vendor allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2026-32549 | High | 7.5 | 2026-08-18 | Unauthenticated Broken Access Control in ThumbPress < 6.5 versions. |
CVE-2026-32472 | High | 7.5 | 2026-08-18 | Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions. |
CVE-2026-28571 | High | 7.5 | 2026-08-18 | Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions. |
CVE-2026-28567 | High | 7.5 | 2026-08-18 | Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions. |
CVE-2026-75853 | High | 8.8 | 2026-08-18 | ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorizatio… |
CVE-2026-75850 | Medium | 4.2 | 2026-08-18 | ArcadeDB before 26.8.1 fails to bind the authenticated principal (setCurrentUser) on its batch and time-series HTTP handlers. Because no principal is bound on… |
CVE-2026-75846 | High | 7.1 | 2026-08-18 | ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement. DeleteFunctionStateme… |
CVE-2026-75836 | High | 8.8 | 2026-08-18 | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarCont… |
CVE-2026-75835 | Medium | 4.3 | 2026-08-18 | Grav API plugin (getgrav/grav-plugin-api) before 1.0.14 contains a missing authorization vulnerability in userPassesAuthorize() (AbstractApiController.php). Th… |
CVE-2026-75832 | Medium | 4.3 | 2026-08-18 | The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav 2.0) before version 1.0.14 (fixed in 1.0.15) contains a missing authorization vulnerability in… |
CVE-2026-74904 | High | 7.5 | 2026-08-18 | SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and… |
CVE-2026-75151 | Medium | 4.3 | 2026-08-18 | A vulnerability has been found in SourceCodester Onlne Examination & Learning Management System 1.0. Affected by this vulnerability is an unknown functionality… |
CVE-2026-11801 | High | 7.5 | 2026-08-18 | The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2. This is due to the p… |
CVE-2026-69148 | High | 7.1 | 2026-08-17 | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. Prior to 3.15.0, CreateModelVersion accepts a… |
CVE-2026-69146 | Medium | 6.5 | 2026-08-17 | MLflow is an open source AI engineering platform for agents, large language models, and machine learning models. From 3.13.0 until 3.15.0, LogInputs is absent… |
CVE-2026-75109 | High | 7.1 | 2026-08-17 | Determined fails to authorize requests on the generic task kill, pause, and unpause endpoints in the API handlers. Authenticated attackers can disrupt other us… |
CVE-2026-75108 | Medium | 5.4 | 2026-08-17 | Next Terminal fails to enforce per-asset authorization checks on the portal ping and wake-on-LAN endpoints, allowing any authenticated user to probe and wake a… |
CVE-2026-54356 | High | 7.1 | 2026-08-17 | Budibase is an open-source low-code platform. Prior to 3.41.3, POST /api/attachments/:datasourceId/url in packages/server/src/api/routes/static.ts and packages… |
CVE-2026-63669 | Medium | 6.5 | 2026-08-17 | ApostropheCMS is an open-source Node.js content management system. Prior to 4.32.0, the page module's move() operation fails to enforce the destination parent'… |
CVE-2026-73424 | Medium | 6.5 | 2026-08-17 | Astro is a web framework for content-driven websites. From 10.0.3 until 11.0.3, the Astro Vercel adapter in packages/integrations/vercel/src/serverless/entrypo… |
CVE-2026-9771 | High | 8.8 | 2026-08-17 | The flash_copy() system call is verified by z_vrfy_flash_copy() in drivers/flash/flash_util.c. On builds with CONFIG_USERSPACE enabled, this handler is the ker… |
CVE-2026-75051 | High | 8.1 | 2026-08-17 | In JetBrains YouTrack before 2026.2.17917 unauthorised project transfer between organisations was possible |
CVE-2026-75049 | Medium | 6.5 | 2026-08-17 | In JetBrains YouTrack before 2026.1.13903, 2026.2.17950 an authenticated user could read restricted articles from other projects via the draft creation endpoi… |
CVE-2026-75046 | Medium | 4.3 | 2026-08-17 | In JetBrains YouTrack before 2026.2.18112 an authenticated user could enumerate accounts via the users search endpoint |
CVE-2026-75044 | High | 8.1 | 2026-08-17 | In JetBrains YouTrack before 2025.3.156085, 2026.1.13914, 2026.2.18095 missing authorisation allowed an authenticated user to delete arbitrary entities via t… |
CVE-2026-64866 | | 2026-08-17 | New API is a large language mode (LLM) gateway and artificial intelligence (AI) asset management system. From 0.9.1.3 until 1.0.0-rc.7, AdminResetPasskey in co… | |
CVE-2026-59829 | Medium | 4.3 | 2026-08-17 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.1, on sites with category group moderation enabled, the revi… |
CVE-2026-55704 | Medium | 4.3 | 2026-08-17 | Discourse is an open-source discussion platform. Prior o 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, users who were allowed to view a group’s activity, but wer… |
CVE-2026-53960 | Medium | 5.3 | 2026-08-17 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, hidden or otherwise unviewable first-post content was lea… |
CVE-2026-16049 | Medium | 4.3 | 2026-08-17 | Mattermost Plugins versions <=11.8 10.20.11 11.5.7.0 _The Mattermost GitLab plugin fails to verify channel permissions when processing API requests with a call… |
CVE-2026-16047 | Medium | 4.3 | 2026-08-17 | Mattermost versions 11.7.x <= 11.7.6, 10.11.x <= 10.11.21, 11.8.x <= 11.8.3 fail to validate that users have read access to a channel before linking a board to… |
CVE-2026-16471 | High | 7.5 | 2026-08-17 | Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue af… |
CVE-2026-16467 | High | 7.5 | 2026-08-17 | Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Properly Constrained by ACLs. This issue… |
CVE-2026-74869 | High | 7.7 | 2026-08-17 | stoatchat before 0.15.0 contains a missing authorization vulnerability in the Subscribe message handler that allows authenticated attackers to enumerate member… |
CVE-2026-18347 | Medium | 4.3 | 2026-08-16 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-17087 | High | 7.5 | 2026-08-16 | The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inclu… |
CVE-2026-19728 | High | 7.5 | 2026-08-16 | The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is entitled to a customer-uploaded file be… |
CVE-2026-18316 | Critical | 9.1 | 2026-08-16 | The Solace Extra plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the import_zip() functio… |
CVE-2026-15345 | Medium | 4.3 | 2026-08-16 | The ShortPixel Adaptive Images – WebP, AVIF, CDN, Image Optimization plugin for WordPress is vulnerable to authorization bypass in all versions up to, and incl… |
CVE-2026-16779 | Medium | 4.3 | 2026-08-16 | The Kubio AI Page Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.5. This is due to the plugin not… |
CVE-2026-13167 | Medium | 4.3 | 2026-08-16 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder with AI plugin for WordPress is vulnerable to authorization bypass in all ve… |
CVE-2026-18807 | Medium | 4.3 | 2026-08-15 | The ECS WordPress plugin before 4.3.8 does not have capability or ownership checks on its dynamic repeater actions, relying only on a nonce available to any u… |
CVE-2026-8840 | Medium | 5.3 | 2026-08-15 | The Booking calendar, Appointment Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.36. This… |