CWE-862 · Missing Authorization (page 22)
Page 22 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6964 | Medium | 5.3 | 2026-06-16 | The Video Conferencing with Zoom plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.6.7. This is due to the plu… |
CVE-2026-49775 | Medium | 6.5 | 2026-06-15 | Unauthenticated Broken Access Control in Welcart e-Commerce <= 2.11.28 versions. |
CVE-2026-49070 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Knit Pay <= 9.4.0.0 versions. |
CVE-2026-49065 | High | 8.2 | 2026-06-15 | Unauthenticated Broken Access Control in Hippoo Mobile App for WooCommerce <= 1.9.5 versions. |
CVE-2026-48887 | Medium | 6.5 | 2026-06-15 | Unauthenticated Broken Access Control in JS Help Desk <= 3.0.9 versions. |
CVE-2026-48883 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in WPC Product Bundles for WooCommerce <= 8.5.3 versions. |
CVE-2026-48881 | Critical | 9.1 | 2026-06-15 | Unauthenticated Broken Access Control in TrueBooker <= 1.1.9 versions. |
CVE-2026-48873 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Montonio for WooCommerce <= 10.1.2 versions. |
CVE-2026-48835 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Contact Form by WPForms <= 1.10.0.4 versions. |
CVE-2026-48709 | Low | 3.7 | 2026-06-15 | OliveTin gives access to predefined shell commands from a web interface. In versions 3000.0.0 and prior, The ValidateArgumentType RPC endpoint in service/inter… |
CVE-2026-42666 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Salon booking system <= 10.30.25 versions. |
CVE-2026-42664 | High | 8.2 | 2026-06-15 | Unauthenticated Broken Access Control in AI Product Search for WooCommerce – Motive Commerce Search <= 1.38.2 versions. |
CVE-2026-42659 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Access Control in Advanced Form Integration <= 1.126.12 versions. |
CVE-2026-42651 | Medium | 6.3 | 2026-06-15 | Subscriber Broken Access Control in Classified Listing <= 5.3.9 versions. |
CVE-2026-42640 | Medium | 6.5 | 2026-06-15 | Unauthenticated Broken Access Control in Classified Listing <= 5.3.8 versions. |
CVE-2026-40795 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Access Control in Amelia <= 2.2 versions. |
CVE-2026-40794 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Access Control in myCred <= 3.0.3 versions. |
CVE-2026-40793 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Access Control in Groundhogg < 4.4.1 versions. |
CVE-2026-40788 | High | 7.1 | 2026-06-15 | Subscriber Broken Access Control in ChatBot <= 7.9.7 versions. |
CVE-2026-40782 | Medium | 6.5 | 2026-06-15 | Unauthenticated Broken Access Control in WPAdverts <= 2.3.0 versions. |
CVE-2026-40776 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.8 versions. |
CVE-2026-40775 | High | 7.3 | 2026-06-15 | Unauthenticated Broken Access Control in Royal MCP <= 1.4.2 versions. |
CVE-2026-40774 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Booking Package <= 1.7.06 versions. |
CVE-2026-40773 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Access Control in rtMedia for WordPress, BuddyPress and bbPress <= 4.7.9 versions. |
CVE-2026-40743 | Medium | 6.5 | 2026-06-15 | Unauthenticated Broken Access Control in Tutor LMS <= 3.9.7 versions. |
CVE-2026-40741 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Redsys for WooCommerce Light <= 7.0.0 versions. |
CVE-2026-39594 | Medium | 6.4 | 2026-06-15 | Subscriber Broken Access Control in Ultra Addons for WPForms <= 1.0.11 versions. |
CVE-2026-39584 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Access Control in RepairBuddy <= 4.1132 versions. |
CVE-2026-39534 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in WP Directory Kit <= 1.5.0 versions. |
CVE-2026-39533 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.4 versions. |
CVE-2026-39525 | Medium | 6.5 | 2026-06-15 | Unauthenticated Broken Access Control in Booking Activities <= 1.16.48.1 versions. |
CVE-2026-39524 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Masteriyo - LMS <= 2.1.5 versions. |
CVE-2026-39515 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Access Control in Motors < 1.4.107 versions. |
CVE-2026-39513 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Easy Appointments <= 3.12.21 versions. |
CVE-2026-39503 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Easy Digital Downloads <= 3.6.5 versions. |
CVE-2026-34898 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Event Tickets Manager for WooCommerce <= 1.5.3 versions. |
CVE-2026-34892 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Access Control in Rank Math SEO <= 1.0.271 versions. |
CVE-2026-34886 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in Simple Membership <= 4.7.1 versions. |
CVE-2026-25440 | Medium | 5.3 | 2026-06-15 | Unauthenticated Broken Access Control in Essential Addons for Elementor < 6.6.0 versions. |
CVE-2026-25425 | High | 7.5 | 2026-06-15 | Unauthenticated Broken Access Control in User Registration <= 5.1.2 versions. |
CVE-2025-69332 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Access Control in Bookify <= 1.1.1 versions. |
CVE-2025-68049 | Medium | 6.3 | 2026-06-15 | Subscriber Broken Access Control in bunny.net <= 2.3.6 versions. |
CVE-2026-38329 | Critical | 9.8 | 2026-06-15 | Bludit CMS before version 3.18.4 allows Remote Code Execution (RCE) via the API Plugin. The POST /api/files/{key} endpoint in bl-plugins/api/plugin.php fails t… |
CVE-2026-5230 | High | 7.1 | 2026-06-15 | Improper Access Control, Missing Authorization vulnerability in MIA Technology Inc. Pizzy Library allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2026-48969 | Medium | 6.5 | 2026-06-15 | Subscriber Broken Access Control in Really Simple SSL <= 9.5.9 versions. |
CVE-2025-64215 | Medium | 6.5 | 2026-06-15 | Missing Authorization vulnerability in StylemixThemes MasterStudy LMS Pro allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects… |
CVE-2026-34024 | | 2026-06-15 | The Wertheim SafeController Software, AssemblyVersion 6.15.8328.28014, contains missing authorization checks on multiple web application endpoints. An authenti… | |
CVE-2026-53821 | High | 8.8 | 2026-06-12 | OpenClaw before 2026.5.18 accepts WebSocket client-declared operator scopes before binding to server-approved pairing or trusted-proxy authorization baseline… |
CVE-2026-53820 | Medium | 6.6 | 2026-06-12 | OpenClaw before 2026.5.12 contains an exec denylist bypass vulnerability in the bundle MCP loopback session-spawn path that allows authenticated callers to byp… |
CVE-2026-48119 | High | 7.1 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 0.20.0 to before version 2.0.12, authenticated age… |
CVE-2026-47120 | High | 7.1 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember can fi… |
CVE-2026-46716 | Critical | 9.9 | 2026-06-12 | Nezha Monitoring is a self-hostable, lightweight, servers and websites monitoring and O&M tool. From version 1.4.0 to before version 2.0.8, a RoleMember user c… |
CVE-2026-45085 | Medium | 5.3 | 2026-06-12 | Discourse is an open-source discussion platform. From versions 2026.1.0-latest to before 2026.1.4, 2026.3.0-latest to before 2026.3.1, and 2026.4.0-latest to b… |
CVE-2026-42851 | High | 7.8 | 2026-06-12 | Kitty is a cross-platform GPU based terminal. In versions prior to 0.47.0, a program able to write bytes to a kitty terminal — a remote SSH peer, a downloaded… |
CVE-2026-50244 | Medium | 5.3 | 2026-06-12 | The Naxclow platform exposes a registration endpoint that accepts signed requests containing a batch prefix and an arbitrary caller-supplied account identifier… |
CVE-2026-50108 | High | 7.5 | 2026-06-12 | The Naxclow platform API that returns device relay registration details exposes a persistent credential without verifying that the requester is the legitimate… |
CVE-2026-10715 | | 2026-06-12 | Camaleon CMS 2.9.2 contains an improper authorization vulnerability in the administrator draft autosave endpoint. A low-privileged authenticated user can send… | |
CVE-2026-6689 | Medium | 4.3 | 2026-06-12 | Mattermost versions 11.6.x <= 11.6.1, 11.5.x <= 11.5.4, 10.11.x <= 10.11.15, 10.11.x <= 10.11.16 Fail to enforce PermissionInviteUser when setting AllowOpenInv… |
CVE-2026-50084 | Critical | 9.6 | 2026-06-12 | The Aqara Cloud Production API (open-cn.aqara.com/v3.0/open/api) would authorize any valid developer token for access to any account. This is an instance of "C… |
CVE-2026-50026 | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.107.0 and 16.17.0, a lack of permission checks in these endpoints allowed unauthorized a… | |
CVE-2026-44975 | | 2026-06-12 | Frappe is a full-stack web application framework. Prior to versions 15.107.2 and 16.17.4, any authenticated user can reset onboarding for all users in the syst… | |
CVE-2026-7368 | High | 8.1 | 2026-06-12 | The Yarbo cloud does not enforce per-device or per-user authorization. Any client possessing valid credentials, whether the shared hard-coded credentials or le… |
CVE-2026-47197 | | 2026-06-12 | Quest Bot is an opensource Discord Bot. Prior to version 1.1.6, a moderator with the relevant Discord permission bit can use the bot to moderate users above th… | |
CVE-2026-53818 | Medium | 6.6 | 2026-06-11 | OpenClaw before 2026.4.24 contains an authorization bypass vulnerability in the MCP loopback feature that allows non-owner callers to skip owner-only tool poli… |
CVE-2026-53816 | High | 7.2 | 2026-06-11 | OpenClaw before 2026.5.18 contains an insufficient provenance validation vulnerability in node event handling that allows paired nodes to forge exec lifecycle… |
CVE-2026-53815 | Medium | 6.5 | 2026-06-11 | OpenClaw before 2026.5.19 contains an authorization bypass vulnerability in message read actions that skips channel allowlist checks. Lower-trust callers can r… |
CVE-2026-47163 | | 2026-06-11 | Quest Bot is an opensource modern Discord Bot built for moderation, utilities and support. Prior to version 1.0.1, any guild member who can invoke slash comman… | |
CVE-2026-4764 | | 2026-06-11 | A Missing Authorization vulnerability in the playbook import functionality in Dialogflow CX on Google Cloud Platform allows an authenticated user with specific… | |
CVE-2023-32959 | Medium | 4.3 | 2026-06-11 | Missing Authorization vulnerability in Sparkle WP MetroStore metrostore allows Exploiting Incorrectly Configured Access Control Security Levels. This issue af… |
CVE-2023-25969 | Medium | 5.4 | 2026-06-11 | Missing Authorization vulnerability in ThemeHunk Contact Form & Lead Form Elementor Builder allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2022-45813 | Medium | 5.4 | 2026-06-11 | Missing Authorization vulnerability in BeRocket Advanced AJAX Product Filters allows Exploiting Incorrectly Configured Access Control Security Levels. This is… |
CVE-2022-42479 | Medium | 5.4 | 2026-06-11 | Missing Authorization vulnerability in TemplateHouse Soledad allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Soledad: from… |
CVE-2026-46645 | Medium | 4.3 | 2026-06-10 | SQLAdmin is a flexible Admin interface for SQLAlchemy models. Prior to version 0.25.1, the ajax_lookup endpoint in application.py bypasses the is_accessible()… |
CVE-2026-53634 | Medium | 4.3 | 2026-06-10 | Sharp is a content management framework built for Laravel as a package. From version 9.0.0 to before version 9.22.3, the create and store endpoints of the Quic… |
CVE-2026-0272 | High | 7.2 | 2026-06-10 | A privilege escalation vulnerability in Palo Alto Networks PAN-OS® software allows an authenticated administrator with access to the Command Line Interface (CL… |
CVE-2026-49822 | High | 7.7 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-49821 | High | 7.7 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-46614 | Critical | 9.8 | 2026-06-10 | Fission is an open-source, Kubernetes-native serverless framework that simplifies the deployment of functions and applications on Kubernetes. Prior to version… |
CVE-2026-46558 | High | 8.3 | 2026-06-10 | Plane is an open-source project management tool. Prior to version 1.3.1, there is a cross-workspace asset authorization bypass lets any authenticated user read… |
CVE-2026-45552 | Critical | 9.9 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, the install blueprint declares only bp.be… |
CVE-2026-45550 | Critical | 9.1 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, PUT /smon/check (app/routes/smon/routes.p… |
CVE-2026-45549 | High | 8.5 | 2026-06-10 | Roxy-WI is a web interface for managing Haproxy, Nginx, Apache and Keepalived servers. In versions 8.2.6.4 and prior, agent_action (app/routes/smon/agent_route… |
CVE-2026-53439 | Medium | 4.3 | 2026-06-10 | Missing permission checks in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allow attackers with Overall/Read permission to determine other users' configur… |
CVE-2026-53438 | Medium | 4.3 | 2026-06-10 | A missing permission check in Jenkins 2.567 and earlier, LTS 2.555.2 and earlier allows attackers with Item/Cancel permission, but lacking Item/Read permission… |
CVE-2026-11852 | Medium | 6.5 | 2026-06-10 | Debusine is an integrated solution to build, distribute and maintain a Debian-based distribution. Files managed by debusine are organized into artifacts. The e… |
CVE-2026-26237 | High | 7.5 | 2026-06-10 | A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data… |
CVE-2026-46518 | High | 7.7 | 2026-06-10 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to version 8.0.0.1, a stored cross-site scriptin… |
CVE-2026-49956 | Medium | 6.5 | 2026-06-09 | Hermes WebUI before version 0.51.269 contains a profile isolation bypass vulnerability that allows authenticated users to access data belonging to other profil… |
CVE-2026-47281 | Critical | 9.6 | 2026-06-09 | Missing authorization in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-49948 | High | 8.1 | 2026-06-09 | Mem0 versions through 0.2.8, fixed in commit ae7f406, contain a missing authorization vulnerability in the self-hosted server component where the POST /configu… |
CVE-2026-49741 | | 2026-06-09 | Backend users with write access to the form_definition database table were able to directly create, update, or delete form definition records via DataHandler… | |
CVE-2026-47352 | | 2026-06-09 | Authenticated backend users were able to retrieve file metadata via several Backend API routes without proper permission checks, allowing access to files outsi… | |
CVE-2026-47351 | | 2026-06-09 | Backend users were able to insert arbitrary records and files into the TYPO3 clipboard without proper read permission checks, which allowed users to gather inf… | |
CVE-2026-47350 | | 2026-06-09 | Backend users were able to move records to a different page without having edit permissions on the source page. This issue affects TYPO3 CMS versions 13.0.0-13… | |
CVE-2026-47349 | | 2026-06-09 | Backend users with access to the Recycler module were able to restore soft-deleted records on pages or for tables they were not authorized to modify. This issu… | |
CVE-2026-47346 | | 2026-06-09 | Backend users with file write permissions were able to upload form definition files with mixed-case extensions (e.g., .FORM.YAML) to bypass the Form Framework'… | |
CVE-2026-47343 | | 2026-06-09 | Non-privileged backend users with file mount access were able to perform write operations (move, delete, rename) on folders representing the root of an active… | |
CVE-2026-11607 | | 2026-06-09 | Backend users with access to the Form Framework were able to use files not ending in .form.yaml as form definitions, which were processed without denying the i… | |
CVE-2026-4058 | Medium | 4.3 | 2026-06-09 | The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modi… |
CVE-2026-4986 | Medium | 5.3 | 2026-06-09 | The WPForms WordPress plugin before 1.10.0.5 does not verify the authenticity of incoming PayPal webhook events before processing them, allowing unauthenticat… |