CWE-862 · Missing Authorization (page 21)
Page 21 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-54322 | High | 7.7 | 2026-06-23 | Daytona is a secure and elastic infrastructure runtime for AI-generated code execution and agent workflows. Prior to 0.185.0, Daytona's organization role updat… |
CVE-2026-54019 | Medium | 6.5 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI added collection-level ACL checks… |
CVE-2026-54012 | High | 7.1 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets a user who can create, updat… |
CVE-2026-54010 | High | 8.3 | 2026-06-23 | Open WebUI is a self-hosted artificial intelligence platform designed to operate entirely offline. Prior to 0.9.6, Open WebUI lets an authenticated user attach… |
CVE-2026-56115 | High | 8.8 | 2026-06-23 | Bootimus through 0.1.70 contains a broken access control vulnerability that allows authenticated low-privileged users to perform administrative actions by expl… |
CVE-2026-56696 | Medium | 5.4 | 2026-06-23 | OpenHarness /issue and /pr_comments slash commands lack remote_invocable=False protection, allowing remote channel senders to write attacker-controlled Markdow… |
CVE-2026-56695 | Medium | 6.5 | 2026-06-23 | OpenHarness ohmo gateway /resume and /summary slash commands default remote_invocable to True, allowing admitted remote senders to enumerate and load arbitrary… |
CVE-2026-56402 | Medium | 6.5 | 2026-06-23 | NanoClaw before 2.1.17 contains a privilege escalation vulnerability in the handleApprovalsResponse function that fails to verify responder role authorization… |
CVE-2026-27604 | | 2026-06-23 | FOSSBilling is a free, open-source billing and client management system. Starting in version 0.5.4 and prior to version 0.8.0, an authorization bypass in the A… | |
CVE-2026-10609 | Medium | 6.8 | 2026-06-23 | A missing authorization flaw was found in the OpenShift Cluster Logging Operator. The operator creates and forwards ServiceAccount tokens to output destination… |
CVE-2026-56280 | High | 7.1 | 2026-06-22 | Cap-go before 12.128.2 contains a privilege inversion vulnerability in GET /build/logs/:jobId that allows read-only API key holders to cancel running native bu… |
CVE-2026-48500 | Medium | 6.5 | 2026-06-22 | Filament is a collection of full-stack components for accelerated Laravel development. From 3.0.0 until 3.3.52, 4.11.5, and 5.6.5, any schema can contain a fil… |
CVE-2026-8934 | | 2026-06-22 | A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote… | |
CVE-2026-56104 | High | 8.2 | 2026-06-22 | Chainlit before 2.10.1 contains a session hijacking vulnerability that allows unauthenticated attackers to restore and inherit authenticated user sessions by p… |
CVE-2026-5139 | Medium | 5.4 | 2026-06-22 | Mattermost versions 11.7.x <= 11.7.0, 11.6.x <= 11.6.2, 11.5.x <= 11.5.5, 10.11.x <= 10.11.17 fail to enforce administrator authorization on the {{setDefaultIn… |
CVE-2026-56424 | High | 8.8 | 2026-06-22 | MISP core contained multiple broken access-control flaws where authorization checks were performed against the wrong entity, or where ownership/editability che… |
CVE-2026-56423 | High | 8.8 | 2026-06-22 | MISP Core contained broken access-control checks in the bulk deletion flows for Event Reports and Sharing Groups. The affected deleteSelection handlers authori… |
CVE-2026-44914 | High | 7.2 | 2026-06-22 | Apache NiFi 1.12.0 through 2.9.0 are missing authorization when replacing Process Groups that include extension components with specific Required Permissions b… |
CVE-2026-7859 | Medium | 5.3 | 2026-06-22 | The Motors WordPress plugin before 1.4.110 does not have proper authorisation and CSRF checks on one of its AJAX actions, allowing unauthenticated attackers t… |
CVE-2026-56396 | High | 8.8 | 2026-06-21 | phpMyFAQ before 4.1.4 contains missing authorization vulnerabilities in editUser() and updateUserRights() endpoints that allow authenticated administrators to… |
CVE-2026-56384 | Medium | 4.3 | 2026-06-21 | Craft CMS contains a missing authorization vulnerability in the assets/preview-thumb endpoint. A Control Panel user without permission to view a target private… |
CVE-2026-56341 | High | 7.5 | 2026-06-20 | AVideo through version 26.0 contains multiple unauthenticated list.json.php endpoints in payment plugins lacking authorization checks, exposing PayPal tokens… |
CVE-2026-12119 | Medium | 6.5 | 2026-06-20 | The Simple File List plugin for WordPress is vulnerable to unauthorized file operations due to a missing authorization check on the 'frontmanage' shortcode att… |
CVE-2026-11912 | High | 7.5 | 2026-06-20 | The Simple File List plugin for WordPress is vulnerable to arbitrary file modification due to insufficient authorization checks in all versions up to, and incl… |
CVE-2026-56213 | Medium | 5.3 | 2026-06-20 | Capgo before 12.128.2 contains an authorization bypass vulnerability in the public.upsert_version_meta SECURITY DEFINER function exposed via PostgREST RPC, all… |
CVE-2026-48582 | Critical | 9.6 | 2026-06-19 | Missing authorization in Microsoft Exchange Online allows an authorized attacker to elevate privileges over a network. |
CVE-2026-49291 | High | 8.1 | 2026-06-19 | mcp-memory-service is a semantic memory layer for AI applications. Prior to version 10.65.3, the HTTP MCP JSON-RPC endpoint at `/mcp` requires only OAuth `read… |
CVE-2026-49288 | Medium | 4.3 | 2026-06-19 | Statamic is a Laravel and Git powered content management system (CMS). Prior to 5.73.23 and 6.20.0, an authenticated Control Panel user could view metadata and… |
CVE-2026-12238 | Medium | 5.3 | 2026-06-19 | The WP Go Maps – Most Popular Map Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.1.01. This is due… |
CVE-2026-49357 | | 2026-06-19 | Line Desktop MCP is a project that, while unaffiliated with the official line-bot-mcp-server, allows users to directly operate the LINE Desktop application on… | |
CVE-2026-6798 | Medium | 5.3 | 2026-06-19 | The 2Download Connector for 2DL Hosted Checkout plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 0.1.5. This is… |
CVE-2026-3640 | Medium | 5.3 | 2026-06-19 | The STRABL – A checkout solution plugin for WordPress is vulnerable to Missing Authentication in all versions up to and including 4.5. The plugin registers a R… |
CVE-2026-9013 | Medium | 4.3 | 2026-06-19 | The Bogo plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.9.1 via the bogo_rest_create_post_transla… |
CVE-2026-10779 | Medium | 4.3 | 2026-06-19 | The Classified Listing – Classified ads & Business Directory plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including… |
CVE-2026-10034 | Medium | 5.3 | 2026-06-19 | The WP DSGVO Tools (GDPR) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.39. This is due to the plugin no… |
CVE-2026-52866 | Medium | 6.5 | 2026-06-19 | An attacker within BLE communication range can monopolize the device's only available BLE connection slot, preventing legitimate users or applications from e… |
CVE-2026-49205 | Medium | 6.5 | 2026-06-18 | phpMyFAQ is an open source FAQ web application. Versions prior to 4.1.4 have Missing Authorization in the API CategoryController. CVE-2026-24421 addressed thi… |
CVE-2026-11719 | High | 8.1 | 2026-06-18 | An authenticated authorization bypass vulnerability exists in MCP Toolbox for Databases due to missing scope enforcement across older protocol handlers. While… |
CVE-2026-28573 | Medium | 5.5 | 2026-06-18 | In AndroidManifest.xml, there is a possible persistent denial of service due to a missing permission check. This could lead to local denial of service with no… |
CVE-2026-9199 | Medium | 4.3 | 2026-06-18 | The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to authorization bypass in all versio… |
CVE-2026-12093 | Medium | 5.3 | 2026-06-18 | The Simple Membership plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.7.5. This is due to the plugin not pro… |
CVE-2026-10029 | Medium | 5.3 | 2026-06-18 | The Event Koi Lite – Events Calendar, Event Management, RSVP, and Tickets plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions… |
CVE-2026-12407 | High | 8.8 | 2026-06-18 | The E2Pdf – Export Pdf Tool for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.32.26. This is due to… |
CVE-2026-12515 | Medium | 4.3 | 2026-06-17 | A flaw was found in Katello's of Red Hat Satellite. A content upload functionality where insufficient authorization checks in the ContentUploadsController allo… |
CVE-2026-54810 | High | 7.5 | 2026-06-17 | Missing Authorization vulnerability in Nexi Payments Nexi XPay allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Nex… |
CVE-2026-54415 | High | 8.1 | 2026-06-17 | Missing Authorization in the server management routes (routes/admin.php) in Azuriom Azuriom CMS before 1.2.11 on all platforms allows an authenticated attacker… |
CVE-2025-69189 | High | 7.3 | 2026-06-17 | Missing Authorization vulnerability in EMV JobBank allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JobBank: from n… |
CVE-2026-8383 | Medium | 5.3 | 2026-06-17 | The LearnPress WordPress plugin before 4.3.7 does not gate the `edit` context on one of its REST endpoint behind the `edit_users` capability, allowing unauthe… |
CVE-2026-54802 | High | 7.5 | 2026-06-17 | Unauthenticated Broken Authentication in SMS Alert Order Notifications <= 3.9.3 versions. |
CVE-2026-49081 | High | 8.2 | 2026-06-17 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.12 versions. |
CVE-2026-49072 | Medium | 6.5 | 2026-06-17 | Unauthenticated Broken Access Control in WooCommerce Anti-Fraud <= 7.2.6 versions. |
CVE-2026-49057 | High | 7.5 | 2026-06-17 | Unauthenticated Broken Access Control in JobSearch <= 3.2.7 versions. |
CVE-2026-48797 | | 2026-06-17 | Backpropagate is a Python library for fine-tuning large language models on a single GPU. In versions 1.1.0 and 1.1.1, the optional Reflex web UI exposes a trai… | |
CVE-2026-48783 | Medium | 4.8 | 2026-06-17 | Postiz is an AI social media scheduling tool. Versions prior to 2.21.8 contained an unauthenticated endpoint that accepted a signed token and applied subscript… |
CVE-2026-45436 | Medium | 6.5 | 2026-06-17 | Subscriber Broken Access Control in WPBakery Page Builder <= 8.7.2 versions. |
CVE-2026-40726 | High | 8.2 | 2026-06-17 | Unauthenticated Broken Access Control in User Registration Stripe <= 1.3.14 versions. |
CVE-2026-40723 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in Bricks Builder <= 2.1.4 versions. |
CVE-2026-40722 | Medium | 5.5 | 2026-06-17 | Missing Authorization vulnerability in Yoast BV Yoast SEO Premium allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2026-39595 | Medium | 4.7 | 2026-06-17 | Author Broken Access Control in W3 Total Cache <= 2.9.1 versions. |
CVE-2026-39433 | Medium | 6.5 | 2026-06-17 | Subscriber Arbitrary Content Deletion in WPAMS < 49.5.3 versions. |
CVE-2026-28615 | High | 7.8 | 2026-06-17 | In Telecomm, there is a possible way to initiate an unauthorized phone call due to a permissions bypass. This could lead to local escalation of privilege with… |
CVE-2026-28587 | Medium | 5.5 | 2026-06-17 | In MmsSmsProvider of MmsSmsProvider.java, there is a possible way to retrieve sensitive information due to a missing permission check. This could lead to local… |
CVE-2026-24611 | Critical | 9.1 | 2026-06-17 | Unauthenticated Broken Access Control in MetForm Pro <= 3.9.1 versions. |
CVE-2026-24610 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in MetForm Pro <= 3.9.1 versions. |
CVE-2026-24575 | Medium | 4.3 | 2026-06-17 | Subscriber Broken Access Control in WishList Member X <= 3.29.0 versions. |
CVE-2026-22343 | High | 8.6 | 2026-06-17 | Unauthenticated Broken Access Control in WordPress Dating Theme <= 11.2.0 versions. |
CVE-2026-11858 | | 2026-06-17 | Quanos SCHEMA ST4 on-premises contains a local privilege escalation vulnerability in the Client Update Service. The update service runs as NT AUTHORITY\SYSTEM… | |
CVE-2026-0092 | High | 7.8 | 2026-06-17 | In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead to local escalation of privilege with… |
CVE-2026-0081 | High | 7.8 | 2026-06-17 | In NFC, there is a possible way to spoof an NFC event due to a missing permission check. This could lead to local escalation of privilege with no additional ex… |
CVE-2026-0071 | High | 7.8 | 2026-06-17 | In SettingsLib, there is a possible missing permission check due to a logic error in the code. This could lead to local escalation of privilege with no additio… |
CVE-2026-0057 | Low | 3.3 | 2026-06-17 | In Contacts Provider, there is a possible way to access an incoming call's phone number and associated metadata due to a missing permission check. This could l… |
CVE-2025-69137 | Medium | 6.5 | 2026-06-17 | Subscriber Broken Access Control in Genemy <= 1.6.6 versions. |
CVE-2025-69103 | High | 7.5 | 2026-06-17 | Subscriber Arbitrary Content Deletion in Brikk <= 3.0.0 versions. |
CVE-2025-48640 | High | 8.0 | 2026-06-17 | In multiple locations, there is a possible 3rd party passkey entry pairing approval due to a missing permission check. This could lead to remote (proximal/adja… |
CVE-2025-48617 | High | 7.8 | 2026-06-17 | In overrideConfig of CarrierConfigLoader.java, there is a possible way to bypass UID check due to a permissions bypass. This could lead to local escalation of… |
CVE-2024-37496 | Medium | 4.3 | 2026-06-17 | Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2024-37210 | Medium | 6.5 | 2026-06-17 | Missing Authorization vulnerability in ali2woo AliNext allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects AliNext: fr… |
CVE-2024-33909 | Medium | 5.3 | 2026-06-17 | Missing Authorization vulnerability in Avirtum iPages Flipbook allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects iPa… |
CVE-2024-33685 | Medium | 4.3 | 2026-06-17 | Missing Authorization vulnerability in Jegstudio Startupzy startupzy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affec… |
CVE-2024-32949 | High | 8.3 | 2026-06-17 | Missing Authorization vulnerability in Prince Integrate Google Drive allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affec… |
CVE-2024-31435 | Medium | 4.3 | 2026-06-17 | : Missing Authorization vulnerability in Inisev Social Media & Share Icons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue… |
CVE-2024-24709 | Medium | 4.3 | 2026-06-17 | Missing Authorization vulnerability in Shareaholic allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Shareaholic: fr… |
CVE-2026-12105 | Medium | 6.5 | 2026-06-16 | Improper access control in Devolutions Server 2026.2.5, 2026.1.21 allows an authenticated user to access attachments via folder duplication with inherited pe… |
CVE-2026-0158 | Medium | 4.0 | 2026-06-16 | In Camera, there is a possible unauthorized way to access photos due to a missing permission check. This could lead to local information disclosure with no add… |
CVE-2026-0145 | Medium | 4.0 | 2026-06-16 | In keymint, there is a possible Permission Bypass due to a logic error in the code. This could lead to local information disclosure with no additional executio… |
CVE-2026-0133 | High | 7.8 | 2026-06-16 | In smmu_attach_dev of arm-smmu-v3.c, there is a possible way to sign malicious Android Runtime bootclass artifacts due to a missing permission check. This coul… |
CVE-2026-53866 | High | 8.1 | 2026-06-16 | OpenClaw before 2026.5.12 contains an allowlist bypass vulnerability in shell inline-command parsing that allows authenticated operators to execute unapproved… |
CVE-2026-53851 | Medium | 5.3 | 2026-06-16 | OpenClaw before 2026.5.12 contains a notification bypass vulnerability allowing Slack reaction events to enter the agent pipeline despite disabled reaction not… |
CVE-2026-53850 | Medium | 5.5 | 2026-06-16 | OpenClaw before 2026.4.25 contains a control scope enforcement bypass vulnerability in the focus command that allows authenticated callers to execute the comma… |
CVE-2026-53844 | Medium | 6.5 | 2026-06-16 | OpenClaw before 2026.4.29 contains a session visibility check bypass vulnerability in shared memory search that allows authenticated callers to access memory e… |
CVE-2026-10831 | | 2026-06-16 | A denial-of-service vulnerability exists in NPort devices because of improper access control on the command port. The command interface does not properly valid… | |
CVE-2025-14272 | | 2026-06-16 | A security issue was identified in Pavilion due to improper authorization enforcement in API endpoints. This vulnerability can allow an unauthorized actor to e… | |
CVE-2026-54190 | Medium | 6.5 | 2026-06-16 | Unauthenticated Broken Access Control in Envira Photo Gallery <= 1.12.5 versions. |
CVE-2026-52714 | Medium | 5.9 | 2026-06-16 | Unauthenticated Broken Access Control in SEO Plugin by Squirrly SEO <= 12.4.16 versions. |
CVE-2026-52711 | High | 7.5 | 2026-06-16 | Unauthenticated Broken Access Control in WooCommerce POS <= 1.8.14 versions. |
CVE-2026-40809 | Medium | 6.5 | 2026-06-16 | Missing Authorization vulnerability in Rara Themes Metro Magazine allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2026-39490 | High | 7.5 | 2026-06-16 | Unauthenticated Broken Access Control in JupiterX Core <= 4.14.1 versions. |
CVE-2026-2381 | Medium | 6.5 | 2026-06-16 | The WooCommerce Stripe Payment Gateway plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_p… |
CVE-2025-68045 | High | 7.5 | 2026-06-16 | Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.12 versions. |
CVE-2026-9187 | Medium | 5.3 | 2026-06-16 | The Abandoned Contact Form 7 plugin for WordPress is vulnerable to unauthorized arbitrary post deletion in versions up to, and including, 2.2. This is due to a… |