CWE-862 · Missing Authorization (page 23)
Page 23 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-26236 | High | 7.5 | 2026-06-09 | A missing authorization vulnerability has been reported to affect QuMagie. The remote attackers can then exploit the vulnerability to access unauthorized data… |
CVE-2026-44754 | Medium | 6.6 | 2026-06-09 | The Remote Function Call (RFC) modules of the Operational Data Provisioning Data Replication API (ODP-RFC) are missing caller identification of permitted SAP-i… |
CVE-2026-44751 | High | 7.1 | 2026-06-09 | Application server ABAP does not perform necessary authorization checks for an authenticated user allowing an attacker to execute a report generation command w… |
CVE-2026-44750 | Medium | 4.3 | 2026-06-09 | SAP MDG (Review Match Groups Application) does not perform the necessary authorization checks for authenticated users. This could allow a low-privileged user t… |
CVE-2026-10787 | Medium | 4.3 | 2026-06-08 | Missing authorization in the deleted user groups API in Devolutions Server allows an authenticated low-privileged user to enumerate metadata of deleted user gr… |
CVE-2026-39910 | High | 8.8 | 2026-06-08 | STACKIT IaaS API contains a missing authorization check vulnerability that allows authenticated, low-privileged attackers to escalate privileges to full organi… |
CVE-2026-46444 | High | 8.8 | 2026-06-08 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to version 3.1.2, all CRUD endpoints for OpenAI Assistants Vecto… |
CVE-2026-7624 | Medium | 4.3 | 2026-06-06 | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 12.4.16. This is due to the plu… |
CVE-2026-8502 | Medium | 5.3 | 2026-06-06 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u… |
CVE-2026-9008 | Medium | 4.3 | 2026-06-06 | The Page-list plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 6.2. This is due to the pagelist_unqprfx_ext_sh… |
CVE-2026-8976 | Medium | 4.3 | 2026-06-06 | The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to authorization bypass in… |
CVE-2026-7523 | Medium | 4.3 | 2026-06-05 | The Alba Board plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugin not properly v… |
CVE-2026-5228 | High | 8.8 | 2026-06-04 | Improper Access Control, Missing Authorization vulnerability in Kurt Software Studio WriteUp Mobile App allows Accessing Functionality Not Properly Constrained… |
CVE-2026-10815 | Medium | 6.3 | 2026-06-04 | A vulnerability was found in LakshayD02 Hostel-Management-System-PHP up to f87e67c283bab6f718faf2fec6ae39a13bd7036b. This issue affects some unknown processing… |
CVE-2026-10855 | Medium | 4.3 | 2026-06-04 | An authorization flaw existed in the MISP Event Template Importer overwrite workflow. When importing an event template in overwrite mode, the application check… |
CVE-2026-4881 | Medium | 6.5 | 2026-06-04 | In affected versions of Octopus Server, permissions were not checked correctly resulting in any authenticated user being able to make server level changes usin… |
CVE-2026-10737 | High | 7.5 | 2026-06-04 | The SP Project & Document Manager plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the view_file function in all… |
CVE-2026-44281 | | 2026-06-03 | GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, an authenticated user with config R… | |
CVE-2026-42320 | | 2026-06-03 | GLPI is a free asset and IT management software package. Starting in version 0.50 and prior to versions 10.0.25 and 11.0.7, a technician can read arbitrary fil… | |
CVE-2026-42318 | | 2026-06-03 | GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to versions 10.0.25 and 11.0.7, low privilege users with access to… | |
CVE-2026-42317 | | 2026-06-03 | GLPI is a free asset and IT management software package. Starting in version 0.78 and prior to versions 10.0.25 and 11.0.7, a technician can delete arbitrary f… | |
CVE-2026-31942 | High | 7.1 | 2026-06-02 | LibreChat is an enhanced ChatGPT clone that supports multiple AI providers. In versions up to and including 0.7.6, an Insecure Direct Object Reference (IDOR) v… |
CVE-2026-10616 | Medium | 4.3 | 2026-06-02 | A weakness has been identified in nextlevelbuilder GoClaw up to 3.11.3. The impacted element is the function TeamTasksTool.executeComplete of the file internal… |
CVE-2026-40571 | | 2026-06-02 | NamelessMC is website software for Minecraft servers. In version 2.2.4, `core/classes/Misc/ProfilePostReactionContext.php` only verifies that the wall post exi… | |
CVE-2026-40314 | | 2026-06-02 | NamelessMC is website software for Minecraft servers. In version 2.2.4,`core/classes/Misc/ProfilePostReactionContext.php` only verifies that the wall post exis… | |
CVE-2026-35443 | | 2026-06-02 | NamelessMC is website software for Minecraft servers. In version 2.2.4, `modules/Forum/classes/ForumPostReactionContext.php` only verifies that the caller can… | |
CVE-2026-49782 | Medium | 5.4 | 2026-06-02 | Missing Authorization vulnerability in Elementor Elementor Website Builder allows Exploiting Incorrectly Configured Access Control Security Levels. This issue… |
CVE-2026-27351 | Medium | 5.4 | 2026-06-02 | Missing Authorization vulnerability in Sekander Badsha Crew HRM allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Cr… |
CVE-2026-42670 | High | 7.5 | 2026-06-02 | Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-42669 | High | 7.5 | 2026-06-02 | Missing Authorization vulnerability in EventPrime allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects EventPrime: from… |
CVE-2025-53346 | Medium | 4.3 | 2026-06-02 | Missing Authorization vulnerability in ThimPress Thim Core allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Thim Co… |
CVE-2025-53345 | High | 8.8 | 2026-06-02 | Missing Authorization vulnerability leading to code execution after installing malicious vulnerable plugin in ThimPress Thim Core. This issue affects Thim Cor… |
CVE-2025-53302 | Medium | 5.3 | 2026-06-02 | Missing Authorization vulnerability in Anton Shevchuk Constructor allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Construc… |
CVE-2025-52766 | Medium | 6.5 | 2026-06-02 | Missing Authorization vulnerability in Printeers Printeers Print & Ship allows Exploiting Incorrectly Configured Access Control Security Levels. This issue af… |
CVE-2026-9234 | Medium | 4.3 | 2026-06-02 | The JTL-Connector for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.4.1. This is due to missing c… |
CVE-2026-9050 | Medium | 4.3 | 2026-06-02 | The Slider Revolution plugin for WordPress in versions 6.0.0-6.7.55 and 7.0.0-7.0.14 is vulnerable to unauthorized modification of data. This is due to the plu… |
CVE-2025-26418 | High | 7.8 | 2026-06-01 | In setUserDisclaimerAcknowledged of CarDevicePolicyService.java, there is a possible way to bypass the user dialog when adding an account to a managed device d… |
CVE-2026-45285 | Medium | 6.4 | 2026-06-01 | Nextcloud is an open source content collaboration platform. From versions 32.0.0 to before 32.0.9, and 33.0.0 to before 33.0.3, when a user shares a folder or… |
CVE-2026-45267 | Medium | 6.5 | 2026-06-01 | Nextcloud is an open source content collaboration platform. Prior to version 5.2.6, a missing permissions check allowed users to request reading form submissio… |
CVE-2026-42677 | High | 7.5 | 2026-06-01 | Missing Authorization vulnerability in Ben Balter WP Document Revisions allows Exploiting Incorrectly Configured Access Control Security Levels. This issue af… |
CVE-2026-42675 | High | 7.3 | 2026-06-01 | Missing Authorization vulnerability in Themefic Hydra Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Hydr… |
CVE-2026-42671 | Medium | 6.5 | 2026-06-01 | Missing Authorization vulnerability in Paolo GeoDirectory allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects GeoDirec… |
CVE-2026-42682 | Critical | 9.1 | 2026-06-01 | Missing Authorization vulnerability in Tomdever wpForo Forum allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects wpFor… |
CVE-2026-41014 | Medium | 4.3 | 2026-06-01 | The partitioned_dag_runs endpoints in the Airflow UI enforced only asset-level access control, not per-Dag authorization. An authenticated UI/API user with glo… |
CVE-2026-40543 | | 2026-06-01 | SOPlanning does not enforce authorization for backup functionalities. An unauthenticated attacker can directly query backup-related endpoints and retrieve back… | |
CVE-2026-8382 | Medium | 5.3 | 2026-05-31 | The Advanced Custom Fields (ACF®) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.8.1. This is due to the pl… |
CVE-2026-48811 | Medium | 4.3 | 2026-05-29 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to 1.8.221, FreeScout allows a non-admin user to permanently delete an… |
CVE-2026-49385 | Medium | 6.5 | 2026-05-29 | In JetBrains YouTrack before 2026.1.13570 improper access control allowed low-privileged users to modify service accounts |
CVE-2026-49378 | Medium | 4.3 | 2026-05-29 | In JetBrains TeamCity before 2026.1 credentials parameters were exposed via parameter autocompletion |
CVE-2026-49374 | High | 7.6 | 2026-05-29 | In JetBrains TeamCity before 2026.1 improper permission checks exposed build configuration parameters |
CVE-2026-49367 | High | 8.0 | 2026-05-29 | In JetBrains IntelliJ IDEA before 2026.1.1 command execution was possible via the guest user account |
CVE-2026-47745 | Medium | 6.5 | 2026-05-29 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, the admin tables for PaymentMethods, Currencies and Carriers exposed inline toggles and per-recor… |
CVE-2026-47742 | Medium | 6.5 | 2026-05-29 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Sub-form Livewire components used in the product editor (Edit, Inventory, Seo, Shipping, Files) h… |
CVE-2026-47740 | High | 8.1 | 2026-05-29 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, Multiple Filament actions on the admin Order detail and Order shipments table were callable by an… |
CVE-2026-47125 | High | 8.8 | 2026-05-29 | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.2, the PUT /api/environments/{id}/templates/variables endpo… |
CVE-2026-45632 | Critical | 9.9 | 2026-05-29 | Dokploy is a free, self-hostable Platform as a Service (PaaS). In 0.26.7 and earlier, the schedule router does not enforce organization/role checks. As a resul… |
CVE-2026-45625 | Critical | 9.9 | 2026-05-29 | Arcane is an interface for managing Docker containers, images, networks, and volumes. Prior to 1.19.0, Arcane's huma-based REST API exposes nine endpoints unde… |
CVE-2026-35630 | High | 8.0 | 2026-05-29 | OpenClaw before 2026.5.18 contains an authorization bypass vulnerability in QQBot native approval buttons that fails to enforce configured approver identity. N… |
CVE-2026-32905 | High | 8.3 | 2026-05-29 | OpenClaw before 2026.5.4 contains an authorization bypass vulnerability in the bundled device-pair plugin that allows non-owner authorized chat senders to issu… |
CVE-2018-25391 | High | 7.5 | 2026-05-29 | HaPe PKH 1.1 fails to enforce authorization on its record deletion endpoints, allowing unauthenticated attackers to delete arbitrary records by sending a craft… |
CVE-2026-4290 | Critical | 9.1 | 2026-05-29 | The WP Travel Pro plugin for WordPress is vulnerable to arbitrary user deletion via the /wp-json/wp-travel/v1/travel-guide/{user_id} REST API endpoint in all v… |
CVE-2025-12714 | Medium | 5.3 | 2026-05-29 | The Rank Math SEO – AI SEO Tools to Dominate SEO Rankings plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the up… |
CVE-2026-44884 | Medium | 6.5 | 2026-05-28 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and… |
CVE-2026-44849 | High | 8.8 | 2026-05-28 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and… |
CVE-2026-44848 | High | 8.8 | 2026-05-28 | Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and… |
CVE-2026-42071 | | 2026-05-28 | Mantis Bug Tracker (MantisBT) is an open source issue tracker. From 2.23.0 to 2.28.1, a missing authorization check in MantisBT's file visibility function allo… | |
CVE-2026-44794 | Medium | 5.4 | 2026-05-28 | Nautobot is a Network Source of Truth and Network Automation Platform. Prior to 2.4.33 and 3.1.2, in the case of inter-object references via GenericForeignKey… |
CVE-2026-41160 | Medium | 4.3 | 2026-05-28 | EspoCRM is an open source customer relationship management application. Prior to 9.3.5, a business logic flaw (Broken Access Control) in EspoCRM 9.3.3 allows l… |
CVE-2026-9015 | Medium | 4.3 | 2026-05-28 | The Equalize Digital Accessibility Checker – WCAG, ADA, EAA and Section 508 compliance plugin for WordPress is vulnerable to authorization bypass in all versio… |
CVE-2026-8689 | Medium | 4.3 | 2026-05-28 | The Visualizer: Tables and Charts Manager for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.11… |
CVE-2026-6937 | Medium | 5.3 | 2026-05-28 | The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin plugin for WordPress is vulnerable to Missing Authorization in all versions up t… |
CVE-2026-8682 | Medium | 4.3 | 2026-05-28 | The 3D Viewer – 3D Model Viewer – Augmented Reality – Virtual Try On plugin for WordPress is vulnerable to authorization bypass in all versions up to, and incl… |
CVE-2026-7621 | Medium | 4.3 | 2026-05-28 | The SMTP2GO for WordPress – Email Made Easy plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.16.0. This is due… |
CVE-2026-7552 | Medium | 5.3 | 2026-05-28 | The Geo Mashup plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.13.19. This is due to the plugin not properly… |
CVE-2026-7802 | High | 8.8 | 2026-05-28 | The Frontend Admin by DynamiApps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.29.2. This is due to the pl… |
CVE-2026-4888 | Medium | 4.3 | 2026-05-28 | The Everest Forms – Contact Form, Payment Form, Quiz, Survey & Custom Form Builder plugin for WordPress is vulnerable to unauthorized email sending due to a mi… |
CVE-2026-46414 | High | 8.8 | 2026-05-27 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's WebSocket control plane trus… |
CVE-2026-5296 | Medium | 4.3 | 2026-05-27 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.7 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that when foundationa… |
CVE-2026-2601 | Medium | 4.3 | 2026-05-27 | GitLab has remediated an issue in GitLab EE affecting all versions from 11.5 before 18.10.7, 18.11 before 18.11.4, and 19.0 before 19.0.1 that under certain co… |
CVE-2026-48151 | High | 7.5 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.39.0, the webhook schema-building endpoint is registered under builderRoutes, but the generic authoriz… |
CVE-2026-46425 | Critical | 9.9 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.2, packages/worker/src/api/routes/global/scim.ts attaches only two middlewares to the SCIM router… |
CVE-2026-45717 | High | 8.8 | 2026-05-27 | Budibase is an open-source low-code platform. Prior to 3.38.1, Budibase exposes a REST API for datasource management. The route PUT /api/datasources/:datasourc… |
CVE-2026-49054 | Medium | 4.3 | 2026-05-27 | Missing Authorization vulnerability in Mamunur Rashid The Post Grid allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affect… |
CVE-2026-44329 | Critical | 10.0 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without OAuth2/bearer-toke… |
CVE-2026-44328 | High | 8.2 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 mid… |
CVE-2026-44327 | Critical | 10.0 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-oam route group without inbound OAuth2/bearer-to… |
CVE-2026-44326 | Critical | 9.4 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-traffic-influence API without inbound OAuth2/bea… |
CVE-2026-44321 | High | 7.5 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's SMF mounts the UPI management route group without inbound OAuth2 mid… |
CVE-2026-44320 | High | 7.3 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the nnef-callback route group without inbound OAuth2/bear… |
CVE-2026-44315 | Critical | 9.4 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, free5GC's NEF mounts the 3gpp-pfd-management API without inbound OAuth2/bearer… |
CVE-2026-42083 | High | 8.2 | 2026-05-27 | free5GC is an open-source implementation of the 5G core network. Prior to 4.2.2, PCF Npcf_SMPolicyControl missing authentication middleware allows unauthentica… |
CVE-2022-41656 | Medium | 4.3 | 2026-05-27 | Missing Authorization vulnerability in Bizswoop Account Manager for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels. This… |
CVE-2026-49053 | Medium | 5.3 | 2026-05-27 | Missing Authorization vulnerability in Wpmet ElementsKit Elementor addons Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This i… |
CVE-2026-49052 | Medium | 4.3 | 2026-05-27 | Missing Authorization vulnerability in Wpmet ElementsKit Elementor addons Lite allows Exploiting Incorrectly Configured Access Control Security Levels. This i… |
CVE-2026-49051 | Medium | 4.3 | 2026-05-27 | Missing Authorization vulnerability in Prasad Kirpekar WP Meta and Date Remover allows Exploiting Incorrectly Configured Access Control Security Levels. This… |
CVE-2026-49047 | Medium | 4.3 | 2026-05-27 | Missing Authorization vulnerability in DearHive DearFlip allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects DearFlip… |
CVE-2026-49045 | Medium | 4.3 | 2026-05-27 | Missing Authorization vulnerability in WP Media Adminimize allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Adminim… |
CVE-2026-48973 | Medium | 4.3 | 2026-05-27 | Missing Authorization vulnerability in Benbodhi SVG Support allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects SVG Su… |
CVE-2026-31266 | High | 7.3 | 2026-05-27 | Craft CMS 5.9.5 and earlier contains a Missing Authorization vulnerability in the migrate endpoint (/actions/app/migrate). |
CVE-2026-48971 | Medium | 4.3 | 2026-05-27 | Missing Authorization vulnerability in WebToffee Product Import Export for WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels… |