CWE-862 · Missing Authorization (page 16)
Page 16 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27769 | Low | 2.7 | 2026-04-15 | Mattermost versions 10.11.x <= 10.11.12 fail to validate whether users were correctly owned by the correct Connected Workspace which allows a malicious remote… |
CVE-2026-3649 | Medium | 5.3 | 2026-04-15 | The Katalogportal PDF Sync plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.0. The katalogportal_popup_short… |
CVE-2026-3642 | Medium | 5.3 | 2026-04-15 | The e-shot™ form builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.0.2. The eshot_form_builder_update_f… |
CVE-2026-4812 | Medium | 5.3 | 2026-04-15 | The Advanced Custom Fields (ACF) plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Post/Page Disclosure in versions up to and including… |
CVE-2026-1314 | Medium | 5.3 | 2026-04-15 | The 3D FlipBook – PDF Embedder, PDF Flipbook Viewer, Flipbook Image Gallery plugin for WordPress is vulnerable to unauthorized access of data due to a missing… |
CVE-2026-35033 | Critical | 9.1 | 2026-04-14 | Jellyfin is an open source self hosted media server. Versions prior to 10.11.7 contain an unauthenticated arbitrary file read vulnerability via ffmpeg argument… |
CVE-2025-15565 | Medium | 5.3 | 2026-04-14 | The Nexi XPay plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization checks on the redirect function in all versi… |
CVE-2026-23708 | High | 7.5 | 2026-04-14 | A improper authentication vulnerability in Fortinet FortiSOAR PaaS 7.6.0 through 7.6.3, FortiSOAR PaaS 7.5.0 through 7.5.2, FortiSOAR on-premise 7.6.0 through… |
CVE-2026-4109 | Medium | 4.3 | 2026-04-14 | The Eventin – Events Calendar, Event Booking, Ticket & Registration (AI Powered) plugin for WordPress is vulnerable to unauthorized access of data due to a imp… |
CVE-2026-4365 | Critical | 9.1 | 2026-04-14 | The LearnPress plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the `delete_question_answer()` function in… |
CVE-2026-34261 | Medium | 6.5 | 2026-04-14 | Due to a missing authorization check in SAP Business Analytics and SAP Content Management, an authenticated user could make unauthorized calls to certain remot… |
CVE-2026-34256 | High | 7.1 | 2026-04-14 | Due to a missing authorization check in SAP ERP and SAP S/4HANA (Private Cloud and On-Premise), an authenticated attacker could execute a particular ABAP repor… |
CVE-2026-27679 | Medium | 6.5 | 2026-04-14 | Due to missing authorization checks in the SAP S/4HANA frontend OData Service (Manage Reference Structures), an attacker could update and delete child entities… |
CVE-2026-27678 | Medium | 6.5 | 2026-04-14 | Due to missing authorization checks in the SAP S/4HANA backend OData Service (Manage Reference Structures), an attacker could update and delete child entities… |
CVE-2026-27677 | Medium | 6.5 | 2026-04-14 | Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Reference Equipment), an attacker could update and delete child entities via OData… |
CVE-2026-27676 | Medium | 4.3 | 2026-04-14 | Due to missing authorization checks in the SAP S/4HANA OData Service (Manage Technical Object Structures), an attacker could update and delete child entities v… |
CVE-2026-27673 | Medium | 4.9 | 2026-04-14 | Due to a missing authorization check, SAP S/4HANA (Private Cloud and On-Premise) allows an authenticated user to delete files on the operating system and gain… |
CVE-2026-27672 | Medium | 4.3 | 2026-04-14 | The Material Master application does not enforce authorization checks for authenticated users when executing reports, resulting in the disclosure of sensitive… |
CVE-2026-32270 | | 2026-04-13 | Craft Commerce is an ecommerce platform for Craft CMS. In versions 4.0.0 through 4.10.2 and 5.0.0 through 5.5.4, the PaymentsController::actionPay discloses so… | |
CVE-2026-6109 | Medium | 4.3 | 2026-04-12 | A vulnerability was determined in FoundationAgents MetaGPT up to 0.8.1. The impacted element is the function evaluateCode of the file metagpt/environment/minec… |
CVE-2026-3358 | Medium | 5.4 | 2026-04-11 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized private course enrollment in all versions up to, and in… |
CVE-2026-40189 | Critical | 9.8 | 2026-04-10 | goshs is a SimpleHTTPServer written in Go. Prior to 2.0.0-beta.4, goshs enforces the documented per-folder .goshs ACL/basic-auth mechanism for directory listin… |
CVE-2026-40185 | High | 7.1 | 2026-04-10 | TREK is a collaborative travel planner. Prior to 2.7.2, TREK was missing authorization checks on the Immich trip photo management routes. This vulnerability is… |
CVE-2026-33708 | Medium | 6.5 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 1.11.38, the get_user_info_from_username REST API endpoint returns personal information (email, first nam… |
CVE-2026-33141 | Medium | 6.5 | 2026-04-10 | Chamilo LMS is a learning management system. Prior to 2.0.0-RC.3, an Insecure Direct Object Reference (IDOR) vulnerability in the REST API stats endpoint allow… |
CVE-2026-35662 | Medium | 4.3 | 2026-04-10 | OpenClaw before 2026.3.22 fails to enforce controlScope restrictions on the send action, allowing leaf subagents to message controlled child sessions beyond th… |
CVE-2026-35660 | High | 8.1 | 2026-04-10 | OpenClaw before 2026.3.23 contains an insufficient access control vulnerability in the Gateway agent /reset endpoint that allows callers with operator.write pe… |
CVE-2026-35621 | Medium | 6.5 | 2026-04-10 | OpenClaw before 2026.3.24 contains a privilege escalation vulnerability where the /allowlist command fails to re-validate gateway client scopes for internal ca… |
CVE-2026-35620 | Medium | 5.4 | 2026-04-10 | OpenClaw before 2026.3.24 contains missing authorization vulnerabilities in the /send and /allowlist chat command handlers. The /send command allows non-owner… |
CVE-2026-35598 | Medium | 4.3 | 2026-04-10 | Vikunja is an open-source self-hosted task management platform. Prior to 2.3.0, the CalDAV GetResource and GetResourcesByList methods fetch tasks by UID from t… |
CVE-2026-4162 | High | 7.1 | 2026-04-10 | The Gravity SMTP plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.4. This is due to the plugin not properly ve… |
CVE-2026-4977 | Medium | 4.3 | 2026-04-10 | The UsersWP – Front-end login form, User Registration, User Profile & Members Directory plugin for WordPress is vulnerable to Improper Access Control in all ve… |
CVE-2026-4057 | Medium | 4.3 | 2026-04-10 | The Download Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `makeMediaPublic()` and `… |
CVE-2026-3360 | High | 7.5 | 2026-04-10 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to an Insecure Direct Object Reference in all versions up to, and inclu… |
CVE-2026-40117 | Medium | 6.2 | 2026-04-09 | PraisonAIAgents is a multi-agent teams system. Prior to 1.5.128, read_skill_file() in skill_tools.py allows reading arbitrary files from the filesystem by acce… |
CVE-2026-35631 | Medium | 6.5 | 2026-04-09 | OpenClaw before 2026.3.22 fails to enforce operator.admin scope on mutating internal ACP chat commands, allowing unauthorized modifications. Attackers without… |
CVE-2026-33785 | High | 8.8 | 2026-04-09 | A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on MX Series allows a local, authenticated user with low privileges to execute sp… |
CVE-2026-33776 | Medium | 5.5 | 2026-04-09 | A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS and Junos OS Evolved allows a local user with low privileges to read sensitive in… |
CVE-2026-35063 | High | 8.8 | 2026-04-09 | OpenPLC_V3 REST API endpoint checks for JWT presence but never verifies the caller's role. Any authenticated user with role=user can delete any other user, inc… |
CVE-2026-34184 | Critical | 9.1 | 2026-04-09 | AlanWeb SCADA does not enforce authorization for some directories. This allows an unauthorized attacker to read all files in these directories and even execute… |
CVE-2026-1830 | Critical | 9.8 | 2026-04-09 | The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient autho… |
CVE-2026-4124 | Medium | 5.4 | 2026-04-09 | The Ziggeo plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1. The wp_ajax_ziggeo_ajax handler only verif… |
CVE-2026-4326 | High | 8.8 | 2026-04-09 | The Vertex Addons for Elementor plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.6.4. This is due to improper… |
CVE-2026-4916 | Low | 2.7 | 2026-04-08 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.2 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that could have all… |
CVE-2025-9484 | Medium | 4.3 | 2026-04-08 | GitLab has remediated an issue in GitLab EE affecting all versions from 16.6 before 18.8.9, 18.9 before 18.9.5, and 18.10 before 18.10.3 that under certain cir… |
CVE-2026-39429 | High | 8.2 | 2026-04-08 | kcp is a Kubernetes-like control plane for form-factors and use-cases beyond Kubernetes and container workloads. Prior to 0.30.3 and 0.29.3, the cache server i… |
CVE-2026-34837 | Medium | 4.3 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1, he REST endpoint POST /api/v1/ai_assistance/text_tools/:id contains an auth… |
CVE-2026-34782 | Medium | 4.3 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the REST endpoint POST /api/v1/ai_assistance/text_tools/:id was n… |
CVE-2026-34722 | Medium | 4.3 | 2026-04-08 | Zammad is a web based open source helpdesk/customer support system. Prior to 7.0.1 and 6.5.4, the used endpoint for ticket creation was missing authorization i… |
CVE-2026-0814 | Medium | 4.3 | 2026-04-08 | The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_ex… |
CVE-2026-33229 | Critical | 9.8 | 2026-04-08 | XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Prior to 17.4.8 and 17.10.1, an improperly protected s… |
CVE-2026-39716 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in CKThemes Flipmart flipmart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Fl… |
CVE-2026-39715 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in AnyTrack AnyTrack Affiliate Link Manager anytrack-affiliate-link-manager allows Exploiting Incorrectly Configured Access… |
CVE-2026-39714 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in G5Theme G5Plus April g5plus-april allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-39713 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in mailercloud Mailercloud – Integrate webforms and synchronize website contacts mailercloud-integrate-webforms-synchronize… |
CVE-2026-39707 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in ZealousWeb Accept PayPal Payments using Contact Form 7 contact-form-7-paypal-extension allows Exploiting Incorrectly Con… |
CVE-2026-39706 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Netro Systems Make My Trivia trivialy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-39705 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Mulika Team MIPL WC Multisite Sync mipl-wc-multisite-sync allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-39704 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in nfusionsolutions Precious Metals Automated Product Pricing – Pro precious-metals-automated-product-pricing-pro allows Ex… |
CVE-2026-39701 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Andrew ShopWP wpshopify allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects ShopW… |
CVE-2026-39700 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in WPXPO WowOptin optin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WowOptin… |
CVE-2026-39699 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in massiveshift AI Workflow Automation ai-workflow-automation-lite allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-39698 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in PublisherDesk The Publisher Desk ads.txt the-publisher-desk-ads-txt allows Exploiting Incorrectly Configured Access Cont… |
CVE-2026-39697 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in HBSS Technologies MAIO – The new AI GEO / SEO tool maio-the-new-ai-geo-seo-tool allows Exploiting Incorrectly Configured… |
CVE-2026-39694 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-39691 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in AdAstraCrypto Cryptocurrency Donation Box – Bitcoin & Crypto Donations cryptocurrency-donation-box allows Exploiting Inc… |
CVE-2026-39690 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Paul Bearne Author Avatars List/Block author-avatars allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-39689 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in eshipper eShipper Commerce eshipper-commerce allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-39688 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Glowlogix WP Frontend Profile wp-front-end-profile allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2026-39687 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Rapid Car Check Rapid Car Check Vehicle Data free-vehicle-data-uk allows Exploiting Incorrectly Configured Access Contro… |
CVE-2026-39685 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in lvaudore The Moneytizer the-moneytizer allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-39682 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Arjan Pronk linkPizza-Manager linkpizza-manager allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-39680 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in MWP Development Diet Calorie Calculator diet-calorie-calculator allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-39678 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in DOTonPAPER Pinpoint Booking System booking-system allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2026-39676 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Shahjada Download Manager download-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2026-39675 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in webmuehle Court Reservation court-reservation allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-39673 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in shrikantkale iZooto izooto-web-push allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-39672 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in shiptime ShipTime: Discounted Shipping Rates shiptime-discount-shipping allows Exploiting Incorrectly Configured Access… |
CVE-2026-39669 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in NitroPack allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects NitroPack: from n/a… |
CVE-2026-39668 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in g5theme Book Previewer for Woocommerce book-previewer-for-woocommerce allows Exploiting Incorrectly Configured Access Co… |
CVE-2026-39664 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in leadrebel Leadrebel leadrebel allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-39663 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in themetechmount TrueBooker truebooker-appointment-booking allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-39662 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in ProWCPlugins Product Price by Formula for WooCommerce product-price-by-formula-for-woocommerce allows Exploiting Incorre… |
CVE-2026-39658 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Coding Panda Panda Pods Repeater Field panda-pods-repeater-field allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-39657 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in leadlovers leadlovers forms leadlovers-forms allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-39656 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Razorpay Razorpay for WooCommerce woo-razorpay allows Exploiting Incorrectly Configured Access Control Security Levels.T… |
CVE-2026-39653 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in Deepen Bajracharya Video Conferencing with Zoom video-conferencing-with-zoom-api allows Exploiting Incorrectly Configure… |
CVE-2026-39652 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in igms iGMS Direct Booking igms-direct-booking allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-39651 | Medium | 6.5 | 2026-04-08 | Missing Authorization vulnerability in TotalSuite Total Poll Lite totalpoll-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-39650 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Unitech Web UnitechPay unitechpay-paiements-mobile-money allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-39649 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in themebeez Royale News royale-news allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-39648 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in themebeez Cream Blog cream-blog allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2026-39644 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Roxnor Wp Ultimate Review wp-ultimate-review allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-39643 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Payment Plugins Payment Plugins for PayPal WooCommerce pymntpl-paypal-woocommerce allows Exploiting Incorrectly Configur… |
CVE-2026-39639 | Medium | 6.5 | 2026-04-08 | Missing Authorization vulnerability in redpixelstudios RPS Include Content rps-include-content allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-39637 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in SpabRice Mogi mogi allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mogi: from… |
CVE-2026-39631 | Medium | 4.9 | 2026-04-08 | Missing Authorization vulnerability in Ronik@UnlimitedWP WPSchoolPress wpschoolpress allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-39627 | Medium | 4.3 | 2026-04-08 | Missing Authorization vulnerability in wproyal Ashe ashe allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ashe: from… |
CVE-2026-39624 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in kutethemes Biolife biolife allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Bi… |
CVE-2026-39622 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in acmethemes Education Base education-base allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |