CWE-862 · Missing Authorization (page 2)
Page 2 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-66379 | Medium | 4.3 | 2026-08-12 | An authenticated user may view private Puppet module metadata without repository read access. |
CVE-2026-66378 | Medium | 4.3 | 2026-08-12 | An authenticated user without repository read permission may access private NuGet metadata under specific conditions. |
CVE-2026-66377 | Medium | 5.3 | 2026-08-12 | An unauthenticated user may access restricted repository information under specific conditions. |
CVE-2026-66375 | High | 8.1 | 2026-08-12 | A low-privilege authenticated user may permanently remove protected internal metadata across repositories under specific conditions. |
CVE-2026-47233 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. Version 5.0.9 added a missing `isAdministratorInventory()` gate to `case 'item_delete':` in `modules/invent… |
CVE-2026-53996 | High | 7.0 | 2026-08-12 | NetBSD's hdaudio(4) driver in sys/dev/hdaudio/hdaudio.c contains a missing access control vulnerability that allows unprivileged local attackers to invoke the… |
CVE-2026-47226 | Medium | 6.5 | 2026-08-12 | Admidio is an open-source user management solution. Prior to version 5.0.10, an authenticated Admidio member with upload rights on any one folder can permanent… |
CVE-2026-18652 | Medium | 4.9 | 2026-08-12 | Velociraptor allows reading Stacked result sets from the GUI. Velociraptor's multi-tenant design stores sub orgs within the datastore directory. The path requ… |
CVE-2026-19052 | Medium | 4.3 | 2026-08-12 | The ProSolution WP Client WordPress plugin before 2.0.9 does not perform capability checks on two administrative AJAX actions, and the nonce they rely on is pu… |
CVE-2026-18789 | High | 7.5 | 2026-08-12 | The Ezoic WordPress plugin before 2.23.1 does not properly restrict access to some of its content export functionality, allowing unauthenticated attackers to t… |
CVE-2026-18035 | Medium | 5.3 | 2026-08-12 | The User Access Manager WordPress plugin before 2.3.15 does not apply its access restrictions to REST API requests, allowing unauthenticated attackers to read… |
CVE-2026-64954 | High | 8.2 | 2026-08-12 | Velociraptor allows scheduling new collections via VQL queries in notebooks. For a user to schedule a new collection, they require the COLLECT_CLIENT permissio… |
CVE-2026-73249 | High | 7.5 | 2026-08-11 | calibre is an e-book manager. Prior to 9.12.0, the calibre Content Server endpoint POST /book-update-annotations/{library_id}/{book_id}/{fmt} in src/calibre/sr… |
CVE-2026-48763 | High | 8.2 | 2026-08-11 | TypeBot is a chatbot builder tool. Versions prior to 3.17.0 expose a deprecated public upload endpoint at `GET /api/v1/typebots/{typebotId}/blocks/{blockId}/st… |
CVE-2026-15606 | High | 8.8 | 2026-08-11 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.9. This is due to the pl… |
CVE-2026-69115 | Medium | 6.5 | 2026-08-11 | OpenIM Server v3.8.3 contains a missing authorization vulnerability that allows any authenticated user to access admin-only management API endpoints by submitt… |
CVE-2026-18709 | Medium | 6.4 | 2026-08-11 | An issue in MongoDB Server could allow an authenticated user with direct network access to a shard to improperly commit or abort an in-progress prepared transa… |
CVE-2026-18704 | Medium | 6.5 | 2026-08-11 | An issue in MongoDB Server's aggregation framework could allow an authenticated user with only read privileges to perform write operations against collections… |
CVE-2026-69113 | Medium | 5.4 | 2026-08-11 | Cap v0.3.1 contains a broken access control vulnerability in the POST /api/video/comment endpoint that allows authenticated users to post comments on any priva… |
CVE-2026-70340 | High | 8.1 | 2026-08-11 | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. |
CVE-2026-65806 | Medium | 6.5 | 2026-08-11 | Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network. |
CVE-2026-62915 | Medium | 6.5 | 2026-08-11 | Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network. |
CVE-2026-61936 | Medium | 5.5 | 2026-08-11 | Missing authorization in Windows Defender Firewall Service allows an authorized attacker to bypass a security feature locally. |
CVE-2026-59113 | High | 8.8 | 2026-08-11 | Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network. |
CVE-2026-40375 | Medium | 6.5 | 2026-08-11 | Missing authorization in Dynamics Business Central allows an authorized attacker to disclose information over a network. |
CVE-2026-56720 | Medium | 4.3 | 2026-08-11 | CamaleonCMS version 2.9.2 and earlier contains a missing authorization vulnerability in the admin users controller that allows any authenticated user to access… |
CVE-2026-48495 | High | 7.1 | 2026-08-11 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, the Google Sheets OAuth callback decodes a base64-encoded JSON `state` parameter and trusts the emb… |
CVE-2026-42142 | High | 7.1 | 2026-08-11 | TypeBot is a chatbot builder tool. Prior to version 3.17.0, the `handleGetSheets` API handler (`POST /api/sheets/getSheets`) does not validate workspace member… |
CVE-2026-19539 | | 2026-08-11 | Authorization Bypass Through User-Controlled Key in the ticket management component in Roskus Prospero Flow CRM before 5.4.9 allows authenticated users of any… | |
CVE-2026-73155 | | 2026-08-11 | Affected versions of cti-transmute allow authenticated users to add or remove emoji reactions on comments without first checking whether those users are author… | |
CVE-2026-73140 | | 2026-08-11 | Affected versions of cti-transmute fail to apply comment-level access-control rules when generating evaluation report exports. Although normal comment retrieva… | |
CVE-2026-14549 | Medium | 4.3 | 2026-08-11 | The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenti… |
CVE-2026-14548 | Medium | 6.5 | 2026-08-11 | The Ray Enterprise Translation WordPress plugin through 1.7.3 does not perform any capability or nonce checks on one of its AJAX actions, allowing any authenti… |
CVE-2026-66772 | Medium | 4.3 | 2026-08-11 | SAP BusinessObjects Business Intelligence Platform (Admin Tools) does not perform sufficient authorization check on certain administrative functionality. An a… |
CVE-2026-58244 | Medium | 4.3 | 2026-08-11 | SAP Manufacturing Integration and Intelligence (MII) does not perform necessary authorization check on certain application function, allowing a low-privileged… |
CVE-2026-58243 | High | 8.8 | 2026-08-11 | SAP ABAP Development Tools does not perform necessary authorization checks for certain functionality, allowing an attacker with low privileges to execute unaut… |
CVE-2026-58241 | Medium | 4.2 | 2026-08-11 | SAP NetWeaver and ABAP Platform (Change and Transport System - Customer Transport Integration Wizard) allows a low-privileged user to modify configuration tabl… |
CVE-2026-58237 | Medium | 5.9 | 2026-08-11 | WebSocket of SAP Approuter does not perform sufficient authorization checks in certain functionality. An attacker with low privileges could exploit this to acc… |
CVE-2026-44765 | High | 7.3 | 2026-08-11 | Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated remote attacker could access schedulin… |
CVE-2026-44764 | High | 7.3 | 2026-08-11 | Due to a Missing Authorization Check vulnerability in SAP Manufacturing Integration and Intelligence, an unauthenticated attacker could send crafted requests t… |
CVE-2025-30237 | | 2026-08-10 | The affected TP-Link Aginet devices contain a flaw in the web management interface where authentication checks are not consistently enforced on certain endpoin… | |
CVE-2026-72919 | Medium | 4.3 | 2026-08-10 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the c… |
CVE-2026-72918 | Medium | 5.4 | 2026-08-10 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 7.10.14, 8.0.8, 8.1.7, 8.2.7, 8.3.7, 8.4.5, 8.5.2, and 8.6.1, the s… |
CVE-2026-72910 | High | 7.1 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.112.0 and 16.22.0, the merge_account, pause_job_for_doc, trigger_job_for_doc… |
CVE-2026-72906 | Medium | 4.3 | 2026-08-10 | ERPNext is a free and open source Enterprise Resource Planning tool. Prior to 15.111.0 and 16.22.0, the send_auto_email function in erpnext/accounts/doctype/pr… |
CVE-2026-18947 | High | 8.5 | 2026-08-10 | A flaw was found in Feast. An authorization bypass vulnerability exists in the /materialize and /materialize-incremental endpoints. By sending a specially craf… |
CVE-2026-72883 | High | 8.8 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handlers in apps/dokploy/server/wss/terminal.ts, apps/dokploy/se… |
CVE-2026-72876 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, swarm.getNodes, swarm.getNodeInfo, swarm.getNodeApps, and swarm.getAppInfos in… |
CVE-2026-14886 | High | 8.2 | 2026-08-10 | Vault Enterprise's identity entity batch-delete endpoint is vulnerable to a cross-namespace authorization bypass that may allow an authenticated caller in one… |
CVE-2026-72868 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, apps/dokploy/server/api/routers/destination.ts interpolates the accessKey, sec… |
CVE-2026-72866 | High | 8.8 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the WebSocket handler in apps/dokploy/server/wss/terminal.ts validates a sessi… |
CVE-2026-72864 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, the local branch of /docker-container-terminal in apps/dokploy/server/wss/dock… |
CVE-2026-72863 | Critical | 9.9 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy's WebSocket handlers (in-app terminals and log streamers) authenticate… |
CVE-2026-71962 | High | 7.5 | 2026-08-10 | Flowise versions 2.2.4 through 3.1.4 contain a missing authorization vulnerability in the POST /api/v1/openai-assistants-file/download endpoint that allows una… |
CVE-2026-72900 | Medium | 6.5 | 2026-08-10 | Metabase allows an authenticated, low-privileged attacker to read the entire Metabase application database. |
CVE-2026-72737 | Critical | 9.6 | 2026-08-10 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.29.8 and earlier, backup.create, backup.update, and backup.restoreBackupWithLogs in apps/do… |
CVE-2026-72732 | Medium | 4.3 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, the discourse_templates endpoint exposed hidden tag names… |
CVE-2026-72723 | Medium | 5.3 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, SiteSerializer.anonymous_default_navigation_menu_tags ser… |
CVE-2026-72722 | Medium | 4.3 | 2026-08-10 | Discourse is an open-source discussion platform. Prior to 2026.1.6, 2026.5.2, 2026.6.1, and 2026.7.0, TopicLink.extract_from, TopicLink.ensure_entry_for, and T… |
CVE-2026-47754 | Critical | 9.3 | 2026-08-10 | Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unau… |
CVE-2026-72759 | | 2026-08-10 | In affected versions of MISP cti-transmute, the conversion-history details endpoint performs an incomplete authorization check. When a history record reference… | |
CVE-2026-71959 | Medium | 5.8 | 2026-08-10 | Bitwarden Server before 2026.7.2 does not verify that the caller is a member of the organization identified in a POST /collect request body, allowing any authe… |
CVE-2026-15060 | Medium | 4.7 | 2026-08-10 | When systemd-machined >= v259 (or v258 with a custom `polkit` policy that allows `register-machine` access) is running on a desktop system, an unprivileged use… |
CVE-2026-72692 | High | 7.5 | 2026-08-10 | A missing authorization vulnerability in OpenSignLabs opensignserver through 2.37.0 allows an unauthenticated remote attacker to irreversibly decline any in-fl… |
CVE-2026-19404 | Medium | 6.5 | 2026-08-10 | A flaw was found in 389 Directory Server. The CleanAllRUV and Abort CleanAllRUV replication-maintenance extended operations perform no authorization check, all… |
CVE-2026-18030 | High | 8.1 | 2026-08-10 | The BricksForge WordPress plugin before 3.1.8.8 does not verify the identity of the requester when processing a password change submitted through one of its fo… |
CVE-2026-17021 | Medium | 5.3 | 2026-08-10 | The Salon Booking System WordPress plugin before 10.30.34 does not properly restrict access to some of its booking-modification AJAX actions and does not verif… |
CVE-2026-15237 | Medium | 5.3 | 2026-08-10 | The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records… |
CVE-2026-14941 | Medium | 5.4 | 2026-08-10 | The Customer Reviews for WooCommerce WordPress plugin before 5.116.0 does not perform nonce or capability checks on several settings-related AJAX actions, allo… |
CVE-2026-19350 | Medium | 6.3 | 2026-08-09 | A vulnerability has been found in Dolibarr ERP up to 23.0.3. Affected is the function fail of the file htdocs/takepos/invoice.php of the component TakePOS Modu… |
CVE-2026-19345 | Medium | 6.5 | 2026-08-09 | A vulnerability was found in code-projects Task Management System 1.0. This affects an unknown part of the file /user/UpdateTaskStatus.php. The manipulation of… |
CVE-2026-18603 | Medium | 6.5 | 2026-08-09 | The PiWeb Cancel order / Refund request for WooCommerce WordPress plugin before 1.3.4.34 does not have authorization or ownership checks when adding the conten… |
CVE-2026-18037 | Medium | 6.5 | 2026-08-09 | The Create WordPress plugin before 2.5.4 does not perform an authorization check before rendering content over one of its public REST API routes, and that rout… |
CVE-2026-16992 | Medium | 6.5 | 2026-08-09 | The Create WordPress plugin before 2.5.4 does not perform an authorization check before returning content over one of its REST API routes, and that route addit… |
CVE-2026-16965 | Medium | 4.3 | 2026-08-09 | The Solace Extra WordPress plugin before 1.6.1 does not perform capability or nonce checks in one of its AJAX actions, allowing any authenticated user such as… |
CVE-2026-16608 | Medium | 5.3 | 2026-08-08 | The Download Monitor WordPress plugin before 5.2.6 does not perform authorization checks on one of its download-logging AJAX actions, and exposes the nonce pro… |
CVE-2026-47127 | Medium | 6.5 | 2026-08-07 | Ghostfolio is an open source wealth management software. Prior to version 3.4.0, Ghostfolio's Stripe checkout success-URL handler at `GET /api/v1/subscription/… |
CVE-2026-64676 | Medium | 5.7 | 2026-08-07 | Kata Containers is an open source implementation of lightweight Virtual Machines (VMs) that perform like containers. In versions prior to 4.0.0, the kata-agent… |
CVE-2026-48169 | High | 8.8 | 2026-08-07 | PraisonAI is a multi-agent teams system. Versions prior to 0.1.4 of the PraisonAI Platform API have two authorization failures that together break workspace is… |
CVE-2026-66061 | High | 7.1 | 2026-08-07 | Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.0, the iOS Companion app treats tag links (NFC or… |
CVE-2026-66060 | High | 7.1 | 2026-08-07 | Home Assistant is open source home automation software focused on local control and privacy. Prior to 2026.5.3, the Companion app treats tag links (NFC or QR… |
CVE-2026-19017 | Medium | 6.8 | 2026-08-07 | Consul Community Edition and Consul Enterprise 1.18.21 through 2.0.2 are vulnerable to a partial arbitrary file read when configured to use the Vault Connect C… |
CVE-2026-66058 | | 2026-08-07 | Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.112.0, unrestricted access to a Document Follow API (update_follow) is possible for a… | |
CVE-2026-17601 | | 2026-08-07 | A user holding a permission to update privilege definitions could modify a wildcard privilege already assigned to their own role to grant broader permissions t… | |
CVE-2026-54201 | | 2026-08-07 | Tobit Laboratories AG TeamDavid's Webbox does not enforce authentication or authorization checks when serving these log files. As a result, attackers can obt… | |
CVE-2026-16041 | High | 7.5 | 2026-08-07 | The MStore API WordPress plugin before 4.21.0 does not perform authorization or purchase-ownership checks on its REST product-review creation route, allowing… |
CVE-2026-16038 | Critical | 9.1 | 2026-08-07 | The MStore API WordPress plugin before 4.21.0 does not verify the payment with the payment gateway before marking an order as paid on several of its payment-c… |
CVE-2026-15359 | Medium | 6.5 | 2026-08-07 | The Templately WordPress plugin before 3.7.1 does not have an authorisation check on one of its request handlers, allowing unauthenticated attackers to overwr… |
CVE-2026-14365 | Critical | 9.8 | 2026-08-07 | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2… |
CVE-2026-11907 | Medium | 6.5 | 2026-08-07 | The Stream plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.2.0. This is due to the plugin not properly verif… |
CVE-2026-65667 | Critical | 10.0 | 2026-08-07 | Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-62830 | Critical | 9.9 | 2026-08-07 | Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network. |
CVE-2026-70636 | High | 7.5 | 2026-08-06 | Flowise through 3.1.4 contains an authentication bypass vulnerability that allows unauthenticated attackers to access the OAuth2 credential refresh endpoint by… |
CVE-2026-67621 | High | 7.6 | 2026-08-06 | Flowise through 3.1.4 contains a missing authorization vulnerability that allows authenticated workspace members to perform unauthorized document store operati… |
CVE-2026-64664 | Medium | 4.3 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could use an endpoint in… |
CVE-2026-64662 | Medium | 6.5 | 2026-08-06 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.74.1 and 6.24.0, an authenticated Control Panel user could view content from… |
CVE-2026-48088 | Critical | 9.4 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.4, the route `POST /api/tenant… |
CVE-2026-48085 | Critical | 9.8 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.1, a fully provisioned OpenRec… |
CVE-2026-48077 | Medium | 5.3 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.1.0, the GET handler at `/api/te… |
CVE-2026-48075 | Medium | 6.5 | 2026-08-06 | OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.5, the `add-to-tunnel` endpoin… |