CWE-862 · Missing Authorization (page 20)
Page 20 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-12432 | Medium | 5.3 | 2026-06-27 | The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_… |
CVE-2026-11773 | Medium | 4.3 | 2026-06-27 | The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-11364 | Medium | 4.3 | 2026-06-27 | The Product Specifications for WooCommerce plugin for WordPress is vulnerable to unauthorized modification, creation, and deletion of data in versions up to an… |
CVE-2026-12404 | Medium | 5.3 | 2026-06-27 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. Thi… |
CVE-2026-50137 | Critical | 9.4 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id (app_...) and an S3-source datas… |
CVE-2026-55838 | Medium | 4.3 | 2026-06-26 | RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.7 and earlier, the real-time metrics endpoint at /rustfs/admin/v3/metrics is accessi… |
CVE-2026-55189 | High | 7.7 | 2026-06-26 | RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, when the FTP frontend is enabled, the FTP read and probe ha… |
CVE-2026-55188 | High | 8.2 | 2026-06-26 | RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket repli… |
CVE-2026-49991 | High | 8.6 | 2026-06-26 | RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploi… |
CVE-2026-47193 | High | 7.5 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field valu… |
CVE-2026-44734 | Medium | 6.5 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization vulnerability exists in OpenProject's Co… |
CVE-2026-57518 | High | 8.8 | 2026-06-26 | Pagekit CMS 1.0.18 contains a privilege escalation vulnerability that allows authenticated users with the 'user: manage users' permission to escalate privilege… |
CVE-2026-12411 | High | 8.4 | 2026-06-26 | Broken Access Control in the devLXDInstancePatchHandler component of Canonical LXD allows an untrusted guest to mount, read, and overwrite another guest's cust… |
CVE-2026-57661 | Medium | 5.4 | 2026-06-26 | Subscriber Broken Access Control in WPComplete <= 2.9.5.5 versions. |
CVE-2026-57660 | Medium | 5.3 | 2026-06-26 | Unauthenticated Broken Access Control in Booking and Rental Manager <= 2.7.1 versions. |
CVE-2026-57654 | Medium | 6.5 | 2026-06-26 | Affiliate Broken Access Control in Affiliates Manager <= 2.9.49 versions. |
CVE-2026-57649 | Medium | 4.3 | 2026-06-26 | Subscriber Broken Access Control in Shoppable Images Lite <= 1.3 versions. |
CVE-2026-57648 | Medium | 4.3 | 2026-06-26 | Contributor Broken Access Control in Nelio Content <= 4.3.4 versions. |
CVE-2026-57645 | High | 8.1 | 2026-06-26 | newsletters_subscribers Broken Access Control in Newsletters <= 4.13 versions. |
CVE-2026-57640 | Medium | 4.3 | 2026-06-26 | Subscriber Broken Access Control in MasterStudy LMS <= 3.7.30 versions. |
CVE-2026-57632 | Medium | 5.4 | 2026-06-26 | Subscriber Broken Access Control in Email Marketing for WooCommerce by Omnisend <= 1.19.0 versions. |
CVE-2026-57622 | Medium | 4.3 | 2026-06-26 | Subscriber Broken Access Control in WPCafe <= 3.0.14 versions. |
CVE-2026-57430 | Medium | 4.3 | 2026-06-26 | Contributor Broken Access Control in SEOPress PRO <= 9.1.1 versions. |
CVE-2026-57324 | Medium | 6.5 | 2026-06-26 | Unauthenticated Broken Access Control in GIFT4U <= 1.0.10 versions. |
CVE-2026-57323 | Medium | 5.8 | 2026-06-26 | Unauthenticated Broken Access Control in Flash & HTML5 Video <= 2.11.0 versions. |
CVE-2026-56773 | High | 8.8 | 2026-06-26 | Teable's v2 REST API controller lacks @Permissions metadata on ORPC endpoints, allowing any authenticated user to bypass authorization checks. Attackers can re… |
CVE-2026-56063 | High | 8.3 | 2026-06-26 | Unauthenticated Broken Access Control in MailChimp Block <= 1.1.15 versions. |
CVE-2026-56061 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Subscriptions for WooCommerce <= 1.9.5 versions. |
CVE-2026-56038 | High | 8.8 | 2026-06-26 | Contributor Privilege Escalation in Frisbii Pay <= 1.8.2 versions. |
CVE-2026-56025 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Paymob for WooCommerce <= 4.1.2 versions. |
CVE-2026-54847 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Stylish Cost Calculator <= 8.3.9 versions. |
CVE-2026-54846 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Syncee Premium Dropshipping & Wholesale <= 1.0.27 versions. |
CVE-2026-54840 | High | 7.3 | 2026-06-26 | Unauthenticated Broken Access Control in Newsletters <= 4.13 versions. |
CVE-2026-54837 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Intranet & Private Site – All-In-One Intranet <= 1.8.1 versions. |
CVE-2026-54835 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions. |
CVE-2026-54832 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Gutenverse Companion <= 2.5.0 versions. |
CVE-2026-52701 | Medium | 6.5 | 2026-06-26 | Unauthenticated Broken Access Control in User Registration <= 5.2.2 versions. |
CVE-2026-24547 | Medium | 5.3 | 2026-06-26 | Unauthenticated Broken Access Control in SiteGround Email Marketing <= 1.7.5 versions. |
CVE-2025-64636 | Medium | 5.3 | 2026-06-26 | Unauthenticated Broken Access Control in Donation Thermometer <= 2.2.7 versions. |
CVE-2025-63079 | Medium | 4.3 | 2026-06-26 | Contributor Broken Access Control in Live Copy Paste for Elementor <= 1.5.3 versions. |
CVE-2025-63078 | Medium | 4.3 | 2026-06-26 | Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions. |
CVE-2025-63041 | Medium | 5.4 | 2026-06-26 | Contributor Broken Access Control in Forget About Shortcode Buttons <= 2.1.3 versions. |
CVE-2026-57925 | Medium | 4.3 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading saved queries and tags |
CVE-2026-57923 | Medium | 5.3 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 improper authorisation in the app configurations endpoint allowed modifying project settings |
CVE-2026-57922 | Low | 3.1 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 project settings disclosure via the MCP was possible |
CVE-2026-57921 | Medium | 4.3 | 2026-06-26 | In JetBrains YouTrack before 2026.2.16593 improper access control allowed reading users' private data via the comment templates endpoint |
CVE-2026-1869 | Medium | 6.5 | 2026-06-26 | The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin… |
CVE-2026-57521 | Medium | 4.3 | 2026-06-25 | Bitwarden Server before 2026.5.0 contains a broken access control vulnerability that allows any authenticated user to access arbitrary organization billing dat… |
CVE-2026-57520 | High | 7.1 | 2026-06-25 | Bitwarden Server before 2026.5.0 contains a privilege escalation vulnerability that allows authenticated Custom users with ManageUsers permission to remove Adm… |
CVE-2026-2299 | Medium | 4.2 | 2026-06-25 | The Mattermost Google Drive plugin before version 1.1.0 fails to validate channel membership in the file creation endpoint, allowing authenticated users with a… |
CVE-2026-56768 | High | 8.8 | 2026-06-25 | Seahub before 13.0.23 does not enforce SHARE_LINK_LOGIN_REQUIRED on GET /api/v2.1/share-link-zip-task/, allowing unauthenticated users to bypass authentication… |
CVE-2026-56767 | High | 8.8 | 2026-06-25 | Maxun before 0.0.42 contains a cross-tenant insecure direct object reference vulnerability in storage and webhook API handlers that allows authenticated users… |
CVE-2026-54029 | Medium | 5.3 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the DELETE /api/messages/:conversationId/:messageId endpoint al… |
CVE-2026-54027 | Medium | 6.5 | 2026-06-25 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. Prior to 0.8.4-rc1, the POST /api/files/images endpoint allows any authenticated us… |
CVE-2026-48941 | Medium | 6.5 | 2026-06-25 | The K2 frontend `item.checkin` task accepts an unauthenticated `sigProFolder` query parameter and uses it directly to address a `JFolder::delete()` call under… |
CVE-2026-57619 | Medium | 6.5 | 2026-06-25 | Contributor Sensitive Data Exposure in Elementor Website Builder <= 4.1.3 versions. |
CVE-2026-57429 | Medium | 6.5 | 2026-06-25 | Contributor Broken Access Control in Slim SEO <= 4.6.2 versions. |
CVE-2026-56023 | Medium | 5.4 | 2026-06-25 | Customer Broken Access Control in UPI QR Code Payment Gateway for WooCommerce <= 1.6.2 versions. |
CVE-2026-54844 | High | 7.5 | 2026-06-25 | Unauthenticated Broken Access Control in CheckView Automated Testing <= 2.1.0 versions. |
CVE-2026-54842 | High | 8.1 | 2026-06-25 | Missing Authorization vulnerability in Royal Plugins Royal MCP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Roy… |
CVE-2026-54830 | High | 7.5 | 2026-06-25 | Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions. |
CVE-2026-54828 | High | 7.5 | 2026-06-25 | Unauthenticated Broken Access Control in Motors <= 1.4.109 versions. |
CVE-2026-27366 | High | 7.5 | 2026-06-25 | Unauthenticated Broken Access Control in MainWP Child <= 6.1.1 versions. |
CVE-2026-3176 | Low | 3.1 | 2026-06-25 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.6 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain cond… |
CVE-2026-2238 | Medium | 5.3 | 2026-06-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.5 before 18.11.6, 19.0 before 19.0.3, and 19.1 before 19.1.1 that under certain c… |
CVE-2026-55762 | High | 8.1 | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.1, 8.4.4, 8.3.6, 8.2.6, 8.1.6, 8.0.7, and 7.10.13, the POST /ap… |
CVE-2026-52812 | | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, Git LFS storage is content-addressed by OID alone (<LFS-root>/<oid[0]>/<oid[1]>/<oid>) but per… | |
CVE-2026-52799 | High | 7.5 | 2026-06-24 | Gogs is an open source self-hosted Git service. Prior to 0.14.3, GET /attachments/:uuid returns the raw attachment file without verifying whether the requester… |
CVE-2026-45677 | | 2026-06-24 | Rocket.Chat is an open-source, secure, fully customizable communications platform. Prior to 8.5.0, 8.4.1, 8.3.3, 8.2.3, 8.1.4, 8.0.5, 7.13.7, and 7.10.11, Rock… | |
CVE-2026-27708 | | 2026-06-24 | FOSSBilling is a free, open-source billing and client management system. In versions 0.7.2 and prior, the Servicecustom Client API's __call method accepts an o… | |
CVE-2026-57307 | Medium | 4.2 | 2026-06-24 | A missing permission check in Jenkins Zowe zDevOps Plugin 1.1.3.50.ve350c9b_450b_1 and earlier allows attackers with Overall/Read permission to connect to an a… |
CVE-2026-57304 | Medium | 5.4 | 2026-06-24 | A missing permission check in Jenkins Assembla Plugin 1.4 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL usi… |
CVE-2026-57300 | Medium | 4.3 | 2026-06-24 | A missing permission check in Jenkins MCP Server Plugin 0.177.v629fdb_2557fe and earlier allows attackers with Item/Read permission to read the Pipeline replay… |
CVE-2026-57299 | Medium | 4.3 | 2026-06-24 | Missing permission checks in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allow attackers with Overall/Read permission to enumerate… |
CVE-2026-57297 | Medium | 4.3 | 2026-06-24 | A missing permission check in Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier allows attackers with Overall/Read permission to connect… |
CVE-2026-57294 | Medium | 5.4 | 2026-06-24 | A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an atta… |
CVE-2026-57293 | Medium | 4.3 | 2026-06-24 | An incorrect permission check in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allows attackers with global Item/Configure permission (while lacking I… |
CVE-2026-57291 | Medium | 5.4 | 2026-06-24 | Missing permission checks in Jenkins Gitee Plugin 1288.v18b_deb_c9069b_ and earlier allow attackers with Overall/Read permission to connect to an attacker-spec… |
CVE-2026-57286 | Medium | 4.3 | 2026-06-24 | A missing permission check in Jenkins Git Parameter Plugin 462.vdcf3df2ed2ca_ and earlier allows attackers with Item/Read permission to obtain information abou… |
CVE-2026-57285 | Medium | 4.3 | 2026-06-24 | A missing permission check in Jenkins GitHub Branch Source Plugin 1967.1969.v205fd594c821 and earlier allows attackers with Overall/Read permission to obtain t… |
CVE-2026-7761 | High | 8.8 | 2026-06-24 | The Ultimate Member plugin for WordPress is vulnerable to Account Takeover via Password Reset Link Disclosure in all versions up to and including 2.11.4. This… |
CVE-2026-9619 | Medium | 4.3 | 2026-06-24 | The Reviews and Rating – Docplanner plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the… |
CVE-2026-9616 | Medium | 4.3 | 2026-06-24 | The Generate Security.txt plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.0.12. This is due to the plugin no… |
CVE-2026-9184 | Medium | 4.3 | 2026-06-24 | The 24liveblog - live blog tool plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update_lb24_to… |
CVE-2026-9178 | High | 7.5 | 2026-06-24 | The WP Forms Connector plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 1.8. The plugin registers the REST rout… |
CVE-2026-9175 | Medium | 5.3 | 2026-06-24 | The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including… |
CVE-2026-9172 | Medium | 5.3 | 2026-06-24 | The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to unauthorized modification/deletion of data due to a missin… |
CVE-2026-8690 | Medium | 5.3 | 2026-06-24 | The RentMy Real-Time Rental Management Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.4.1. This is… |
CVE-2026-8688 | Medium | 4.3 | 2026-06-24 | The Advance Nav Menu Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.3. This is due to the plugin no… |
CVE-2026-8617 | Medium | 5.3 | 2026-06-24 | The SearchPlus plugin for WordPress is vulnerable to unauthorized modification and deletion of data in versions up to, and including, 1.7.1. This is due to a m… |
CVE-2026-8614 | Medium | 4.3 | 2026-06-24 | The Assistio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verification on the as… |
CVE-2026-7617 | Medium | 5.3 | 2026-06-24 | The Secufor_OAuth plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.7. This is due to the plugin not properly… |
CVE-2026-4297 | High | 8.8 | 2026-06-24 | The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This is due to a mis… |
CVE-2026-12094 | Medium | 5.3 | 2026-06-24 | The Advanced Contact Form 7 - Compact DB plugin for WordPress is vulnerable to unauthorized deletion of data due to a missing capability check on the cf7cdb_aj… |
CVE-2026-11807 | Critical | 9.6 | 2026-06-23 | A missing authorization vulnerability was found in the Event-Driven Ansible (EDA) websocket API. The /api/eda/ws/ansible-rulebook endpoint does not verify user… |
CVE-2026-54322 | High | 7.7 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role updat… |
CVE-2026-54019 | Medium | 6.5 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI added collection-level ACL checks… |
CVE-2026-54012 | High | 7.1 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets a user who can create, updat… |
CVE-2026-54010 | High | 8.3 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated user attach… |
CVE-2026-56115 | High | 8.8 | 2026-06-23 | Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by expl… |