CWE-862 · Missing Authorization (page 21)
Page 21 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-1674 | Medium | 6.5 | 2026-03-04 | The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to unauthorized modificat… |
CVE-2026-2732 | Medium | 5.4 | 2026-03-04 | The Enable Media Replace plugin for WordPress is vulnerable to unauthorized modification of data due to an improper capability check on the 'RemoveBackGroundVi… |
CVE-2026-3266 | Critical | 9.8 | 2026-03-03 | Missing Authorization vulnerability in OpenText™ Filr allows Authentication Bypass. The vulnerability could allow unauthenticated users to get XSRF token and d… |
CVE-2025-13734 | Medium | 5.4 | 2026-03-03 | IBM Engineering Requirements Management DOORS Next 7.1, and 7.2 could allow an authenticated user to view and edit data beyond their authorized access permissi… |
CVE-2026-3351 | Medium | 4.3 | 2026-03-03 | Improper authorization in the API endpoint GET /1.0/certificates in Canonical LXD 6.6 on Linux allows an authenticated, restricted user to enumerate all certif… |
CVE-2026-1336 | Medium | 5.3 | 2026-03-03 | The AI ChatBot with ChatGPT and Content Generator by AYS plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capa… |
CVE-2026-0026 | High | 7.8 | 2026-03-02 | In removePermission of PermissionManagerServiceImpl.java, there is a possible way to override any system permission due to a logic error in the code. This cou… |
CVE-2026-0024 | Medium | 4.0 | 2026-03-02 | In isRedactionNeededForOpenViaContentResolver of MediaProvider.java, there is a possible way to reveal the location of media due to a missing permission check… |
CVE-2025-48634 | High | 7.3 | 2026-03-02 | In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. This could lead to local escalation of pr… |
CVE-2025-48578 | High | 7.8 | 2026-03-02 | In multiple functions of MediaProvider.java, there is a possible way to bypass the WRITE_EXTERNAL_STORAGE permission due to a missing permission check. This co… |
CVE-2025-48574 | High | 8.4 | 2026-03-02 | In validateAddingWindowLw of DisplayPolicy.java, there is a possible way for an app to intercept drag-and-drop events due to a missing permission check. This c… |
CVE-2026-3432 | Critical | 9.1 | 2026-03-02 | On SimStudio version below to 0.5.74, the `/api/auth/oauth/token` endpoint contains a code path that bypasses all authorization checks when provided with `cred… |
CVE-2026-3431 | Critical | 9.8 | 2026-03-02 | On SimStudio version below to 0.5.74, the MongoDB tool endpoints accept arbitrary connection parameters from the caller without authentication or host restrict… |
CVE-2026-28557 | Medium | 6.5 | 2026-02-28 | wpForo Forum 2.4.14 contains a missing capability check vulnerability that allows authenticated users to trigger bulk wpForo usergroup reassignment via the wpf… |
CVE-2026-28556 | Medium | 5.4 | 2026-02-28 | wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to move, merge, or split any forum topic via the topic… |
CVE-2026-28555 | Medium | 4.3 | 2026-02-28 | wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to close or reopen any forum topic via the wpforo_clos… |
CVE-2026-28554 | Medium | 4.3 | 2026-02-28 | wpForo Forum 2.4.14 contains a missing authorization vulnerability that allows authenticated subscribers to approve or unapprove any forum post via the wpforo_… |
CVE-2026-28515 | High | 8.8 | 2026-02-27 | openDCIM version 23.04, through commit 4467e9c4, contains a missing authorization vulnerability in install.php and container-install.php. The installer and upg… |
CVE-2026-28424 | Medium | 6.5 | 2026-02-27 | Statmatic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.11 and 6.4.0, user email addresses were included in responses fr… |
CVE-2026-28408 | Critical | 9.8 | 2026-02-27 | WeGIA is a web manager for charitable institutions. Prior to version 3.6.5, the script in adicionar_tipo_docs_atendido.php does not go through the project's ce… |
CVE-2026-27836 | High | 7.5 | 2026-02-27 | phpMyFAQ is an open source FAQ web application. Prior to version 4.0.18, the WebAuthn prepare endpoint (`/api/webauthn/prepare`) creates new active user accoun… |
CVE-2026-27792 | Medium | 5.4 | 2026-02-27 | Seerr is an open-source media request and discovery manager for Jellyfin, Plex, and Emby. A missing authorization vulnerability has been identified in the appl… |
CVE-2026-28276 | High | 7.5 | 2026-02-26 | Initiative is a self-hosted project management platform. An access control vulnerability exists in Initiative versions prior to 0.32.2 where uploaded documents… |
CVE-2026-28217 | Medium | 6.5 | 2026-02-26 | hoppscotch is an open source API development ecosystem. Prior to version 2026.2.0, the `userCollection` GraphQL query accepts an arbitrary collection ID and re… |
CVE-2026-27638 | High | 7.1 | 2026-02-26 | Actual is a local-first personal finance tool. Prior to version 26.2.1, in multi-user mode (OpenID), the sync API endpoints (`/sync/*`) don't verify that the a… |
CVE-2026-27457 | Medium | 4.3 | 2026-02-26 | Weblate is a web based localization tool. Prior to version 5.16.1, the REST API's `AddonViewSet` (`weblate/api/views.py`, line 2831) uses `queryset = Addon.obj… |
CVE-2026-27151 | Low | 2.7 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the `move_posts` action only checked `can_move_posts?` on… |
CVE-2026-27150 | Low | 3.8 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, missing `validate_before_create` authorization in Data Ex… |
CVE-2026-27021 | Medium | 5.3 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, the voters endpoint in the poll plugin lacked post visibi… |
CVE-2026-26979 | Low | 2.7 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, TL4 users are able to close, archive and pin topics in pr… |
CVE-2026-26207 | Medium | 5.4 | 2026-02-26 | Discourse is an open source discussion platform. Prior to versions 2025.12.2, 2026.1.1, and 2026.2.0, `discourse-policy` plugin allows any authenticated user t… |
CVE-2026-24004 | Medium | 5.3 | 2026-02-26 | Fleet is open source device management software. In versions prior to 4.80.1, a vulnerability in Fleet’s Android MDM Pub/Sub handling could allow unauthenticat… |
CVE-2026-27954 | Medium | 6.5 | 2026-02-26 | Live Helper Chat is an open-source application that enables live support websites. In versions up to and including 4.52, three chat action endpoints (holdacti… |
CVE-2026-27946 | Medium | 6.5 | 2026-02-26 | ZITADEL is an open source identity management platform. Prior to versions 4.11.1 and 3.4.7, a vulnerability in Zitadel's self-management capability allowed use… |
CVE-2025-14103 | Medium | 4.3 | 2026-02-25 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.7 before 18.7.5, 18.8 before 18.8.5, and 18.9 before 18.9.1 that could have allow… |
CVE-2026-25164 | High | 8.1 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the REST API route table in `a… |
CVE-2026-3193 | Low | 3.1 | 2026-02-25 | A vulnerability was detected in Chia Blockchain 2.1.0. Impacted is an unknown function of the file /send_transaction. The manipulation results in cross-site re… |
CVE-2026-28195 | Medium | 4.3 | 2026-02-25 | In JetBrains TeamCity before 2025.11.3 missing authorization allowed project developers to add parameters to build configurations |
CVE-2026-28193 | High | 8.8 | 2026-02-25 | In JetBrains YouTrack before 2025.3.121962 apps were able to send requests to the app permissions endpoint |
CVE-2026-26104 | Medium | 5.5 | 2026-02-25 | A flaw was found in the udisks storage management daemon that allows unprivileged users to back up LUKS encryption headers without authorization. The issue occ… |
CVE-2026-26103 | High | 7.1 | 2026-02-25 | A flaw was found in the udisks storage management daemon that exposes a privileged D-Bus API for restoring LUKS encryption headers without proper authorization… |
CVE-2026-2301 | Medium | 4.3 | 2026-02-25 | The Post Duplicator plugin for WordPress is vulnerable to unauthorized arbitrary protected post meta insertion in all versions up to, and including, 3.0.8. Thi… |
CVE-2026-1916 | High | 7.5 | 2026-02-25 | The WPGSI: Spreadsheet Integration plugin for WordPress is vulnerable to unauthorized modification and loss of data due to missing capability checks and an ins… |
CVE-2026-27608 | High | 8.1 | 2026-02-25 | Parse Dashboard is a standalone dashboard for managing Parse Server apps. In versions 7.3.0-alpha.42 through 9.0.0-alpha.7, the AI Agent API endpoint (`POST /a… |
CVE-2026-25131 | High | 8.8 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, a Broken Access Control vulner… |
CVE-2026-25124 | Medium | 6.5 | 2026-02-25 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0, the OpenEMR application is vul… |
CVE-2026-22765 | High | 8.8 | 2026-02-24 | Dell Wyse Management Suite, versions prior to WMS 5.5, contain a Missing Authorization vulnerability. A low privileged attacker with remote access could potent… |
CVE-2026-27468 | High | 8.2 | 2026-02-24 | Mastodon is a free, open-source social network server based on ActivityPub. FASP registration requires manual approval by an administrator. In versions 4.4.0 t… |
CVE-2026-1787 | Medium | 4.8 | 2026-02-21 | The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability c… |
CVE-2026-27484 | Medium | 4.3 | 2026-02-21 | OpenClaw is a personal AI assistant. In versions 2026.2.17 and below, the Discord moderation action handling (timeout, kick, ban) uses sender identity from req… |
CVE-2025-14339 | Medium | 6.5 | 2026-02-21 | The weMail - Email Marketing, Lead Generation, Optin Forms, Email Newsletters, A/B Testing, and Automation plugin for WordPress is vulnerable to unauthorized f… |
CVE-2026-27471 | Critical | 9.1 | 2026-02-21 | ERP is a free and open source Enterprise Resource Planning tool. In versions up to 15.98.0 and 16.0.0-rc.1 and through 16.6.0, certain endpoints lacked access… |
CVE-2026-2039 | Critical | 9.8 | 2026-02-20 | GFI Archiver MArc.Store Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affec… |
CVE-2026-2038 | Critical | 9.8 | 2026-02-20 | GFI Archiver MArc.Core Missing Authorization Authentication Bypass Vulnerability. This vulnerability allows remote attackers to bypass authentication on affect… |
CVE-2026-27111 | Medium | 5.0 | 2026-02-20 | Kargo manages and automates the promotion of software artifacts. From v1.9.0 to v1.9.2, Kargo's authorization model includes a promote verb -- a non-standard K… |
CVE-2026-24946 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly C… |
CVE-2026-24944 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in weDevs Subscribe2 subscribe2 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-24941 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in wpjobportal WP Job Portal wp-job-portal allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-22351 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in Marcus (aka @msykes) WP FullCalendar wp-fullcalendar allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-22350 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in add-ons.org PDF for Elementor Forms + Drag And Drop Template Builder pdf-for-elementor-forms allows Exploiting Incorrect… |
CVE-2025-69393 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in Jthemes Exzo exzo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Exzo: from… |
CVE-2025-69388 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in cliengo Cliengo – Chatbot cliengo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-69385 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in AgniHD Cartify - WooCommerce Gutenberg WordPress Theme cartify allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-69381 | High | 7.1 | 2026-02-20 | Missing Authorization vulnerability in vanquish WooCommerce Bulk Product Editor woocommerce-quick-product-editor allows Exploiting Incorrectly Configured Acces… |
CVE-2025-69303 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in modeltheme ModelTheme Framework modeltheme-framework allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2025-69298 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in GhostPool Gauge gauge allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gauge… |
CVE-2025-69297 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in GhostPool Aardvark Plugin aardvark-plugin allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-69063 | High | 8.6 | 2026-02-20 | Missing Authorization vulnerability in Saad Iqbal New User Approve new-user-approve allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2025-68837 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in ELEXtensions ELEX WordPress HelpDesk & Customer Ticketing System elex-helpdesk-customer-support-ticket-system allows Exp… |
CVE-2025-68834 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in Saiful Islam Sync Master Sheet – Product Sync with Google Sheet for WooCommerce product-sync-master-sheet allows Exploit… |
CVE-2025-68564 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in sendy Sendy sendy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sendy: from… |
CVE-2025-68542 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in vgdevsolutions Checkout Gateway for IRIS checkout-gateway-iris allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-68534 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in add-ons.org PDF for WPForms pdf-for-wpforms allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-68069 | High | 7.1 | 2026-02-20 | Missing Authorization vulnerability in wpWax Directorist directorist allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-68050 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Leadpages Leadpages leadpages allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2025-68048 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in XLPlugins NextMove Lite woo-thank-you-page-nextmove-lite allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2025-68043 | High | 7.3 | 2026-02-20 | Missing Authorization vulnerability in LottieFiles LottieFiles lottiefiles allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-68042 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Travelpayouts Travelpayouts travelpayouts allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-68032 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Passionate Brains Advanced WC Analytics advance-wc-analytics allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-68028 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Passionate Brains GA4WP: Google Analytics for WordPress ga-for-wp allows Exploiting Incorrectly Configured Access Contro… |
CVE-2025-68026 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Niaj Morshed LC Wizard ghl-wizard allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2025-68025 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Addonify Addonify Floating Cart For WooCommerce addonify-floating-cart allows Exploiting Incorrectly Configured Access C… |
CVE-2025-68024 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Addonify Addonify – WooCommerce Wishlist addonify-wishlist allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-68023 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Addonify Addonify – Compare Products For WooCommerce addonify-compare-products allows Exploiting Incorrectly Configured… |
CVE-2025-68022 | High | 7.3 | 2026-02-20 | Missing Authorization vulnerability in soporteblue Plugin BlueX for WooCommerce bluex-for-woocommerce allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-68021 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in ConveyThis ConveyThis conveythis-translate allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-68005 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in themewant Easy Hotel Booking easy-hotel allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2025-68000 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in PickPlugins Testimonial Slider testimonial allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-67994 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in YayCommerce YayCurrency yaycurrency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2025-67993 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2025-67977 | High | 8.2 | 2026-02-20 | Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-67975 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in aDirectory aDirectory adirectory allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-67974 | High | 7.5 | 2026-02-20 | Missing Authorization vulnerability in WP Legal Pages WPLegalPages wplegalpages allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2025-67973 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-67972 | Medium | 4.3 | 2026-02-20 | Missing Authorization vulnerability in Zoho Mail Zoho ZeptoMail allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Zo… |
CVE-2025-67970 | Medium | 5.9 | 2026-02-20 | Missing Authorization vulnerability in vertim Schedula schedula-smart-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Leve… |
CVE-2025-67969 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Co… |
CVE-2025-67624 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in Arya Dhiratara Optimize More! – Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-67547 | Medium | 6.5 | 2026-02-20 | Missing Authorization vulnerability in uixthemes Konte konte allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Konte… |
CVE-2025-53217 | High | 7.6 | 2026-02-20 | Missing Authorization vulnerability in staviravn AIO WP Builder all-in-one-wp-builder allows Exploiting Incorrectly Configured Access Control Security Levels.T… |