CWE-862 · Missing Authorization (page 26)
Page 26 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-6667 | Medium | 4.3 | 2026-05-09 | PgBouncer before 1.25.2 did not perform an appropriate authorization check for the KILL_CLIENT admin command. All users with access to the administration conso… |
CVE-2026-44125 | | 2026-05-08 | SEPPmail Secure Email Gateway before version 15.0.4 fails to enforce authorization checks for multiple endpoints in the new GINA UI, allowing unauthenticated r… | |
CVE-2026-39816 | High | 8.8 | 2026-05-08 | The optional extension component TinkerpopClientService is missing the Restricted annotation with the Execute Code Required Permission in Apache NiFi 2.0.0-M1… |
CVE-2026-8077 | | 2026-05-08 | Lack of proper authorization implementation in the CashDro 3 web administration panel, version 24.01.00.26. The backend lacks authorization controls, leaving s… | |
CVE-2026-41498 | Low | 3.3 | 2026-05-08 | Kimai is an open-source time tracking application. Prior to version 2.54.0, the Team API endpoints use #[IsGranted('edit_team')] instead of #[IsGranted('edit'… |
CVE-2026-27416 | Medium | 5.3 | 2026-05-07 | Missing Authorization vulnerability in bPlugins PDF Poster allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects PDF Pos… |
CVE-2026-25436 | Medium | 5.3 | 2026-05-07 | Missing Authorization vulnerability in WProyal Royal Elementor Addons allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affe… |
CVE-2025-66105 | Medium | 5.3 | 2026-05-07 | Missing Authorization vulnerability in Magepeople inc. Bus Ticket Booking with Seat Reservation allows Exploiting Incorrectly Configured Access Control Securit… |
CVE-2026-6214 | Medium | 6.5 | 2026-05-07 | The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.53.0. This is due to the listen_for_saving_e… |
CVE-2026-41658 | Medium | 6.5 | 2026-05-07 | Admidio is an open-source user management solution. Prior to version 5.0.9, the Admidio inventory module enforces authorization for destructive operations (del… |
CVE-2026-4807 | Medium | 6.5 | 2026-05-07 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.6.10.6. This is due to a flawed… |
CVE-2026-6222 | Medium | 5.3 | 2026-05-07 | The Forminator Forms plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.51.1. This is due to the `processRequest()`… |
CVE-2026-43583 | Medium | 5.3 | 2026-05-06 | OpenClaw versions 2026.4.10 before 2026.4.14 fail to persist session context during delivery queue recovery for media replay. Attackers can exploit recovered q… |
CVE-2026-43580 | High | 7.7 | 2026-05-06 | OpenClaw before 2026.4.10 contains an incomplete navigation guard vulnerability that allows attackers to trigger navigation without complete SSRF policy enforc… |
CVE-2026-43579 | Medium | 6.5 | 2026-05-06 | OpenClaw before 2026.4.10 contains an insufficient access control vulnerability in Nostr plugin HTTP profile routes that allows operators with write permission… |
CVE-2026-43577 | Medium | 6.5 | 2026-05-06 | OpenClaw before 2026.4.9 contains a file read vulnerability allowing attackers to bypass navigation guards through browser act/evaluate interactions. Attackers… |
CVE-2026-43575 | Critical | 9.8 | 2026-05-06 | OpenClaw versions 2026.2.21 before 2026.4.10 contain an authentication bypass vulnerability in the sandbox noVNC helper route that exposes interactive browser… |
CVE-2026-20193 | Medium | 4.3 | 2026-05-06 | A vulnerability in the RADIUS Policy API endpoints of Cisco ISE could allow an authenticated, remote attacker with read-only Administrator privileges to g… |
CVE-2026-20189 | Medium | 4.3 | 2026-05-06 | A vulnerability in the log file download functionality of Cisco Prime Infrastructure could allow an authenticated, remote attacker to download arbitrary l… |
CVE-2026-2306 | Medium | 4.3 | 2026-05-06 | The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to unauthorized database table creation due to missing authorization checks on th… |
CVE-2026-5753 | Medium | 6.5 | 2026-05-06 | The All-in-One WP Migration Unlimited Extension plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.83. This is due… |
CVE-2026-3208 | Medium | 5.3 | 2026-05-06 | The Mercado Pago payments for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'mp_pix_im… |
CVE-2026-33420 | Medium | 5.3 | 2026-05-05 | Vaultwarden is a Bitwarden-compatible server written in Rust. In version 1.35.4 and earlier, the get_org_collections_details endpoint (GET /api/organizations/{… |
CVE-2026-43573 | High | 7.7 | 2026-05-05 | OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in existing-session browser interaction routes. Attackers can bypa… |
CVE-2026-43572 | Medium | 5.3 | 2026-05-05 | OpenClaw versions 2026.4.10 before 2026.4.14 contain a missing authorization vulnerability in the Microsoft Teams SSO invoke handler that fails to apply sender… |
CVE-2026-43568 | Medium | 6.5 | 2026-05-05 | OpenClaw versions 2026.4.5 before 2026.4.10 contain a privilege escalation vulnerability allowing write-scoped operators to modify persistent memory dreaming s… |
CVE-2026-43567 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains a path traversal vulnerability in the screen_record tool's outPath parameter that bypasses workspace-only filesystem guards… |
CVE-2026-42439 | High | 8.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains a server-side request forgery policy bypass vulnerability in the browser tabs action select and close routes. Attackers can… |
CVE-2026-42436 | High | 7.7 | 2026-05-05 | OpenClaw before 2026.4.14 contains an improper access control vulnerability in browser snapshot, screenshot, and tab routes that fail to consistently validate… |
CVE-2026-42433 | Medium | 6.5 | 2026-05-05 | OpenClaw before 2026.4.10 contains an authorization bypass vulnerability allowing operator.write message-tool paths to access Matrix profile persistence requir… |
CVE-2026-3601 | Medium | 4.3 | 2026-05-05 | The User Registration & Membership plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `embed_form… |
CVE-2026-4362 | Medium | 6.5 | 2026-05-05 | The ElementsKit Elementor Addons plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `Live_Action… |
CVE-2026-5294 | Critical | 9.8 | 2026-05-05 | The Geeky Bot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 1.2.2. This is due to a nopriv AJAX route allowing… |
CVE-2026-42228 | Medium | 6.5 | 2026-05-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.32, 2.17.4, and 2.18.1, the /chat WebSocket endpoint used by the Chat Trigger node'… |
CVE-2026-42226 | High | 7.5 | 2026-05-04 | n8n is an open source workflow automation platform. Prior to versions 1.123.33 and 2.17.5, the dynamic-node-parameters endpoints did not verify whether the aut… |
CVE-2026-42809 | Critical | 9.9 | 2026-05-04 | Apache Polaris can issue broad temporary ("vended") storage credentials during staged table creation before the effective table location has been validated or … |
CVE-2026-4100 | High | 7.1 | 2026-05-02 | The Paid Memberships Pro plugin for WordPress is vulnerable to unauthorized modification and disruption of Stripe webhook configuration in all versions up to… |
CVE-2026-4024 | Medium | 5.3 | 2026-05-02 | The Royal Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `wpr_update_for… |
CVE-2026-4650 | Medium | 5.3 | 2026-05-02 | The FundPress – WordPress Donation Plugin for WordPress is vulnerable to authorization bypass in versions up to and including 2.0.8. This is due to missing aut… |
CVE-2026-6963 | High | 8.8 | 2026-05-02 | The WP Mail Gateway plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the wmg_save_provider_config AJAX action in… |
CVE-2026-3143 | Medium | 5.3 | 2026-05-01 | The Total Upkeep – WordPress Backup Plugin plus Restore & Migrate by BoldGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a… |
CVE-2026-40601 | High | 7.5 | 2026-04-30 | Chartbrew is an open-source web application that can connect directly to databases and APIs and use the data to create charts. In version 4.9.0, Chartbrew expo… |
CVE-2026-42522 | Medium | 4.3 | 2026-04-29 | A missing permission check in Jenkins GitHub Branch Source Plugin 1967.vdea_d580c1a_b_a_ and earlier allows attackers with Overall/Read permission to connect t… |
CVE-2026-42519 | Medium | 4.3 | 2026-04-29 | A missing permission check in Jenkins Script Security Plugin 1399.ve6a_66547f6e1 and earlier allows attackers with Overall/Read permission to enumerate pending… |
CVE-2026-42648 | Medium | 4.3 | 2026-04-29 | Missing Authorization vulnerability in Brainstorm Force Spectra ultimate-addons-for-gutenberg allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-42642 | Medium | 5.3 | 2026-04-29 | Missing Authorization vulnerability in StellarWP GiveWP give allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects GiveWP… |
CVE-2026-4019 | Medium | 5.3 | 2026-04-29 | The Complianz – GDPR/CCPA Cookie Consent plugin for WordPress is vulnerable to unauthorized data access in all versions up to, and including, 7.4.5 This is due… |
CVE-2026-42412 | Medium | 6.5 | 2026-04-29 | Missing Authorization vulnerability in weDevs WP User Frontend allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WP… |
CVE-2026-42377 | High | 7.3 | 2026-04-29 | Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affe… |
CVE-2026-41394 | High | 8.2 | 2026-04-28 | OpenClaw before 2026.3.31 contains an authentication bypass vulnerability where unauthenticated plugin-auth HTTP routes receive operator runtime write scopes… |
CVE-2026-41382 | Medium | 5.4 | 2026-04-28 | OpenClaw before 2026.3.31 contains an authorization bypass vulnerability in Discord voice ingress that allows attackers to bypass channel and member allowlist… |
CVE-2026-41378 | High | 8.8 | 2026-04-28 | OpenClaw before 2026.3.31 contains a privilege escalation vulnerability allowing paired nodes with role=node to dispatch node.event agent requests with unrestr… |
CVE-2026-6706 | Medium | 6.5 | 2026-04-28 | Improper access control in the vault documentation feature in Devolutions Server allows an authenticated attacker to read documentation content from unautho… |
CVE-2026-5944 | High | 8.2 | 2026-04-28 | An improper access control vulnerability exists in the Cisco Intersight Device Connector for Nutanix Prism Central. The service exposes an API passthrough endp… |
CVE-2026-40976 | Critical | 9.1 | 2026-04-28 | In certain circumstances, Spring Boot's default web security is ineffective allowing unauthorized access to all endpoints. For an application to be vulnerable… |
CVE-2026-41464 | Medium | 6.5 | 2026-04-27 | ProjeQtor versions 7.0 through 12.4.3 contain a missing authorization vulnerability in the objectDetail.php endpoint that allows authenticated users with guest… |
CVE-2026-7108 | Medium | 4.3 | 2026-04-27 | A security vulnerability has been detected in code-projects Invoice System in Laravel 1.0. This affects an unknown function. Such manipulation leads to cross-s… |
CVE-2026-41477 | High | 7.8 | 2026-04-24 | Deskflow is a keyboard and mouse sharing app. In 1.20.0, 1.26.0.134, and earlier, Deskflow daemon runs as SYSTEM and exposes an IPC named pipe with WorldAcces… |
CVE-2026-3569 | Medium | 5.3 | 2026-04-24 | The Liaison Site Prober plugin for WordPress is vulnerable to Information Exposure in all versions up to and including 1.2.1 via the /wp-json/site-prober/v1/lo… |
CVE-2025-11762 | Medium | 4.3 | 2026-04-24 | The HubSpot All-In-One Marketing - Forms, Popups, Live Chat plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and inc… |
CVE-2026-5347 | Medium | 5.3 | 2026-04-24 | The HM Books Gallery plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.8.0. This is due to the absence of capabilit… |
CVE-2026-6393 | Medium | 4.3 | 2026-04-24 | The BetterDocs plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 4.3.11. This is due to a missing capability check in… |
CVE-2026-5488 | Medium | 5.3 | 2026-04-24 | The ExactMetrics – Google Analytics Dashboard for WordPress plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 9.1.2… |
CVE-2026-33318 | High | 8.8 | 2026-04-24 | Actual is a local-first personal finance tool. Prior to version 26.4.0, any authenticated user (including `BASIC` role) can escalate to `ADMIN` on servers migr… |
CVE-2026-40623 | High | 8.1 | 2026-04-24 | A vulnerability in SenseLive X3050's web management interface allows critical system and network configuration parameters to be modified without sufficient val… |
CVE-2026-41352 | High | 8.8 | 2026-04-23 | OpenClaw before 2026.3.31 contains a remote code execution vulnerability where a device-paired node can bypass the node scope gate authentication mechanism. At… |
CVE-2026-41349 | High | 8.8 | 2026-04-23 | OpenClaw before 2026.3.28 contains an agentic consent bypass vulnerability allowing LLM agents to silently disable execution approval via config.patch paramete… |
CVE-2026-41266 | High | 7.5 | 2026-04-23 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.0, /api/v1/public-chatbotConfig/:id ep exposes sensitive… |
CVE-2025-62104 | Medium | 4.3 | 2026-04-23 | Missing Authorization vulnerability in Navneil Naicker ACF Galerie 4 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-5464 | High | 7.2 | 2026-04-23 | The ExactMetrics – Google Analytics Dashboard for WordPress (Website Stats Plugin) plugin for WordPress is vulnerable to unauthorized arbitrary plugin installa… |
CVE-2026-41679 | Critical | 10.0 | 2026-04-23 | Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker ca… |
CVE-2026-41454 | High | 8.3 | 2026-04-22 | WeKan before 8.35 contains a missing authorization vulnerability in the Integration REST API endpoints that allows authenticated board members to perform admin… |
CVE-2026-40937 | High | 8.3 | 2026-04-22 | RustFS is a distributed object storage system built in Rust. Prior to 1.0.0-alpha.94, all four notification target admin API endpoints in `rustfs/src/admin/han… |
CVE-2026-1930 | Medium | 4.3 | 2026-04-22 | The Emailchef plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the page_options_ajax_disconnect() f… |
CVE-2026-6235 | Critical | 9.8 | 2026-04-22 | The Sendmachine for WordPress plugin for WordPress is vulnerable to authorization bypass via the 'manage_admin_requests' function in all versions up to, and in… |
CVE-2026-4128 | Medium | 4.3 | 2026-04-22 | The TP Restore Categories And Taxonomies plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.1. The delete_te… |
CVE-2026-4119 | Critical | 9.1 | 2026-04-22 | The Create DB Tables plugin for WordPress is vulnerable to authorization bypass in all versions up to and including 1.2.1. The plugin registers admin_post acti… |
CVE-2026-4117 | Medium | 5.3 | 2026-04-22 | The CalJ plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5. This is due to a missing capability check in th… |
CVE-2026-6834 | Medium | 6.5 | 2026-04-22 | The a+HRD developed by aEnrich has a Missing Authorization vulnerability, allowing authenticated remote attackers to arbitrarily read database contents through… |
CVE-2026-41128 | | 2026-04-22 | Craft CMS is a content management system (CMS). In versions 5.6.0 through 5.9.14, the `actionSavePermissions()` endpoint allows a user with only `viewUsers` pe… | |
CVE-2026-40870 | High | 7.5 | 2026-04-21 | Decidim is a participatory democracy framework. Starting in version 0.0.1 and prior to versions 0.30.5 and 0.31.1, the root level `commentable` field in the AP… |
CVE-2026-41192 | High | 7.1 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.215, the reply and draft flows trust client-supplied encrypted attachment ID… |
CVE-2026-40592 | Medium | 5.9 | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.214, the undo-send route `GET /conversation/undo-reply/{thread_id}` checks o… |
CVE-2026-40570 | | 2026-04-21 | FreeScout is a free self-hosted help desk and shared mailbox. Prior to version 1.8.213, the `load_customer_info` action in `POST /conversation/ajax` returns co… | |
CVE-2026-6703 | Medium | 4.3 | 2026-04-21 | The Responsive Blocks – Page Builder for Blocks & Patterns plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.2… |
CVE-2026-39386 | High | 8.8 | 2026-04-21 | Neko is a a self-hosted virtual browser that runs in Docker and uses WebRTC In versions 3.0.0 through 3.0.10 and 3.1.0 through 3.1.1, any authenticated user ca… |
CVE-2026-41298 | Medium | 5.4 | 2026-04-21 | OpenClaw before 2026.4.2 fails to enforce write scopes on the POST /sessions/:sessionKey/kill endpoint in identity-bearing HTTP modes. Read-scoped callers can… |
CVE-2026-40098 | Medium | 5.4 | 2026-04-20 | Magento Long Term Support (LTS) is an unofficial, community-driven project provides an alternative to the Magento Community Edition e-commerce platform with a… |
CVE-2026-25058 | High | 7.5 | 2026-04-20 | Vexa is an open-source, self-hostable meeting bot API and meeting transcription API. Prior to 0.10.0-260419-1910, the Vexa transcription-collector service expo… |
CVE-2026-6589 | Medium | 4.3 | 2026-04-20 | A security vulnerability has been detected in ComfyUI up to 0.13.0. This affects the function create_origin_only_middleware of the file server.py. The manipula… |
CVE-2026-40581 | High | 8.1 | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the family record deletion endpoint (SelectDelete.php) performs permanent, ir… |
CVE-2026-40480 | | 2026-04-18 | ChurchCRM is an open-source church management system. In versions prior to 7.2.0, the GET /api/person/{personId} endpoint loads and returns person records with… | |
CVE-2026-40349 | High | 8.8 | 2026-04-18 | Movary is a self hosted web app to track and rate a user's watched movies. Prior to version 0.71.1, an ordinary authenticated user can escalate their own accou… |
CVE-2026-40474 | High | 7.6 | 2026-04-17 | wger is a free, open-source workout and fitness manager. In versions 2.5 and below, the GymConfigUpdateView declares permission_required = 'config.change_gymco… |
CVE-2026-35061 | Medium | 5.3 | 2026-04-17 | Anviz CX7 Firmware is vulnerable to the most recently captured test photo that can be retrieved without authentication, revealing sensitive operational image… |
CVE-2026-33093 | Medium | 5.3 | 2026-04-17 | Anviz CX7 Firmware is vulnerable to an unauthenticated POST to the device that captures a photo with the front facing camera, exposing visual information abou… |
CVE-2026-32648 | Medium | 5.3 | 2026-04-17 | Anviz CX2 Lite and CX7 are vulnerable to unauthenticated access that discloses debug configuration details (e.g., SSH/RTTY status), assisting attackers in re… |
CVE-2026-6441 | Medium | 4.3 | 2026-04-17 | The Canto plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 3.1.1. This is due to the absence of any capability check… |
CVE-2026-5502 | Medium | 5.3 | 2026-04-17 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to unauthorized course content manipulation in versions up to and inclu… |
CVE-2026-5427 | Medium | 5.3 | 2026-04-17 | The Kubio plugin for WordPress is vulnerable to Arbitrary File Upload in versions up to and including 2.7.2. This is due to insufficient capability checks in t… |