CWE-862 · Missing Authorization (page 3)
Page 3 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-87981 | Medium | 4.7 | 2026-09-23 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not perform a capability check on several admin AJAX actions that manage its payment-gateway con… |
CVE-2026-87979 | Medium | 5.3 | 2026-09-23 | The Paymob for WooCommerce WordPress plugin before 4.1.14 does not verify the request signature on the card-token branch of its payment webhook, allowing unaut… |
CVE-2026-87074 | Low | 3.7 | 2026-09-23 | The Forminator Forms WordPress plugin before 1.57.2.1 does not bind its saved-draft notification to the visitor who created the draft, and takes both the reci… |
CVE-2026-87069 | Low | 3.1 | 2026-09-23 | The Forminator Forms WordPress plugin before 1.57.2.1 does not perform a nonce, capability or ownership check before running a one-time payment-field migratio… |
CVE-2026-86842 | Medium | 6.8 | 2026-09-23 | The Real3D Flipbook WordPress plugin before 5.4 does not perform capability checks on several of its authenticated flipbook management actions, allowing users… |
CVE-2026-86785 | Medium | 5.3 | 2026-09-23 | The Social Commerce for WooCommerce WordPress plugin through 2.5.4 does not have authorisation checks on some of its REST API endpoints, allowing unauthenticat… |
CVE-2026-84027 | Medium | 4.3 | 2026-09-23 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9.5 does not check user capabilities when creating orders t… |
CVE-2026-83555 | Medium | 5.3 | 2026-09-23 | The Email Subscribers & Newsletters WordPress plugin before 5.9.35 does not verify the per-subscriber management token before changing a subscriber's subscrip… |
CVE-2026-18364 | Medium | 4.3 | 2026-09-23 | The zportals WordPress plugin before 6.4.2 does not perform any capability or nonce check on several of its AJAX actions, allowing users with a subscriber-leve… |
CVE-2026-18156 | Medium | 6.5 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to bypass security controls by forging user identities… |
CVE-2026-18132 | Medium | 6.5 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote authenticated attacker to perform unauthorized payment mutation actions due t… |
CVE-2026-17618 | High | 7.3 | 2026-09-22 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift could allow a remote unauthenticated attacker to view and modify sensitive information and cause a… |
CVE-2026-77426 | | 2026-09-22 | Unleash is an open-source feature management platform. Prior to 8.0.3, the Unleash admin API contains five authorization vulnerabilities. POST /api/admin/segme… | |
CVE-2026-63104 | High | 8.1 | 2026-09-22 | Kaneo versions 2.3.12 before 2.12.2 contain a missing authorization vulnerability that allows authenticated workspace members with viewer or member roles to de… |
CVE-2026-94384 | High | 8.1 | 2026-09-22 | Missing authorization in Amazon amazon-connect-salesforce-lambda before 5.26 allows any IAM principal with lambda:InvokeFunction permission on the affected fun… |
CVE-2026-77244 | Critical | 10.0 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, the HTTP transport accepts requests witho… |
CVE-2026-77243 | High | 8.8 | 2026-09-22 | MCP Atlassian is a Model Context Protocol (MCP) server for Atlassian products (Confluence and Jira). Prior to 0.22.0, ENABLED_TOOLS and TOOLSETS are applied wh… |
CVE-2026-43643 | High | 7.5 | 2026-09-22 | Softaculous Virtualizor before 3.2.9 (Patch 9) and 3.0.0 contains an authorization bypass vulnerability in the billing module handler that allows unauthenticat… |
CVE-2026-86059 | Critical | 9.6 | 2026-09-22 | Dokploy is a free, self-hostable Platform as a Service (PaaS). Prior to 0.29.13, Dokploy organization members without Git provider access can retrieve plaintex… |
CVE-2026-77637 | Low | 3.8 | 2026-09-22 | Cloudreve is a self-hosted file management and sharing system. Prior to 4.18.0, tool.GET("wopi") and tool.POST("mail") in routers/router.go inherit ScopeAdminR… |
CVE-2026-75607 | High | 8.1 | 2026-09-22 | Frigate is an open source network video recorder. Prior to 0.17.2, the WebSocket handler in frigate/comms/ws.py forwards attacker-selected message topics to th… |
CVE-2026-95697 | | 2026-09-22 | MISP contains an authorization flaw in the Organisation model's captureOrg method. When the $force parameter is set to true, the method unconditionally overwri… | |
CVE-2026-95685 | | 2026-09-22 | MISP contains an access control flaw in the EventReports functionality. The replaceSuggestionInReport action, which allows modification of suggestion content w… | |
CVE-2026-95683 | | 2026-09-22 | In MISP, the Overmind event view enriches an event with its most recent attached report for preview purposes. The enrichment logic fetched the report using onl… | |
CVE-2026-93344 | Medium | 6.5 | 2026-09-22 | MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_get_page_content AJAX action that allows authent… |
CVE-2026-95671 | | 2026-09-22 | In MISP, the CollectionsController add() method enforced the sharing-group usability authorization check and element capture only when the HTTP request method… | |
CVE-2026-93343 | Medium | 6.5 | 2026-09-22 | MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_admin_vendors_ajax AJAX action that allows authe… |
CVE-2026-93342 | Medium | 5.4 | 2026-09-22 | MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_duplicate_product AJAX action that allows authen… |
CVE-2026-93341 | Medium | 4.3 | 2026-09-22 | MarketKing plugin for WordPress before 2.1.72 contains a missing authorization vulnerability in the marketking_send_refund AJAX action that allows authenticate… |
CVE-2026-91092 | Medium | 4.3 | 2026-09-22 | The wpForo Forum plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.1.5. This is due to the plugin not properly… |
CVE-2026-7622 | Medium | 4.3 | 2026-09-22 | The ThumbPress plugin for WordPress is vulnerable to unauthorized access in versions up to and including 6.2.1. This is due to missing capability checks and no… |
CVE-2026-4123 | Medium | 4.3 | 2026-09-22 | The RW Elephant Rental Inventory plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 2.3.13. This is due to a missi… |
CVE-2026-18345 | Medium | 4.3 | 2026-09-22 | The WP User Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Connect::complete() functi… |
CVE-2025-14487 | Medium | 5.3 | 2026-09-22 | The Handily plugin for WordPress is vulnerable to unauthorized payment settings modification due to missing authorization checks in all versions up to, and inc… |
CVE-2025-14486 | Medium | 5.3 | 2026-09-22 | The PixelPlay plugin for WordPress is vulnerable to unauthorized API key deletion due to missing authorization checks in all versions up to, and including, 1.0… |
CVE-2025-14484 | Medium | 5.3 | 2026-09-22 | The Image Buzz plugin for WordPress is vulnerable to unauthorized API key modification due to missing authorization checks in all versions up to, and including… |
CVE-2026-77525 | Medium | 4.2 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, management chat-record routes authorize the path application_id but load record… |
CVE-2026-77520 | Medium | 5.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal user in the same workspace can obtain another user's application_id fr… |
CVE-2026-77518 | Medium | 5.0 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. In 2.10.2-lts and earlier, a normal workspace user who knows another user's active MCP tool_id in the same… |
CVE-2026-77517 | Medium | 5.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.10.2-lts, document and paragraph operate routes authorize only knowledge_id i… |
CVE-2026-77516 | Medium | 5.4 | 2026-09-21 | MaxKB is an open-source AI assistant for enterprise. From version 2.0.0 through 2.9.2, a lowest-role workspace member denied access to a tool by WorkspaceUserR… |
CVE-2026-94501 | High | 8.8 | 2026-09-21 | jshERP through 3.6 contains an authorization bypass vulnerability in the userBusiness CRUD endpoints that allows authenticated users to create, modify, or dele… |
CVE-2026-94496 | High | 8.3 | 2026-09-21 | jshERP through 3.6 fails to validate caller permissions in role management endpoints, allowing authenticated users to modify any role's data scope or delete ro… |
CVE-2026-94495 | High | 7.1 | 2026-09-21 | jshERP through 3.6 fails to properly validate user privileges in SystemConfigService.updateSystemConfig, allowing authenticated users to modify tenant system c… |
CVE-2026-94414 | Medium | 5.4 | 2026-09-21 | jshERP through 3.6 is missing an authorization check on the POST /userBusiness/updateBtnStr endpoint that allows authenticated users to modify role button-perm… |
CVE-2026-94412 | High | 8.8 | 2026-09-21 | jshERP through 3.6 contains an authorization bypass vulnerability in the POST /user/resetPwd endpoint that allows authenticated users to reset any other user's… |
CVE-2026-94411 | High | 8.8 | 2026-09-21 | jshERP 3.6 contains a privilege escalation vulnerability in the updateOneValueByKeyIdAndType endpoint that allows authenticated users to grant themselves arbit… |
CVE-2026-91167 | | 2026-09-21 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.28.4, PUT /@warpgate/admin/api/users/:id/roles/:role_id reaches api_update_u… | |
CVE-2026-63330 | High | 7.7 | 2026-09-21 | Warpgate is an open source SSH, HTTPS and MySQL bastion host for Linux. Prior to 0.25.6, api_get_recording_stream in warpgate-admin/src/api/recordings_detail.r… |
CVE-2026-61748 | Medium | 4.3 | 2026-09-21 | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, ReportPrint at POST /api/report/print/ and LabelPrint at POST /api/report/label/print/… |
CVE-2026-61746 | Medium | 5.3 | 2026-09-21 | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, PluginSettingList, PluginAllSettingList, and PluginSettingDetail set GlobalSettingsPer… |
CVE-2026-69190 | Medium | 6.3 | 2026-09-21 | Graylog is a free and open log management platform. From 6.3.0 until 6.3.14, 7.0.9, and 7.1.4, the view update API for saved searches and dashboards permits a… |
CVE-2026-61745 | Medium | 4.3 | 2026-09-21 | InvenTree is an Open Source Inventory Management System. Prior to 1.4.0, the POST /api/machine/{pk}/restart/ endpoint in src/backend/InvenTree/machine/api.py u… |
CVE-2026-48974 | Medium | 5.4 | 2026-09-21 | HomeBox is a home inventory and organization system. Prior to 0.26.0, POST /v1/groups/members invokes HandleGroupMemberAdd and GroupService.AddMember using a c… |
CVE-2026-84990 | High | 8.8 | 2026-09-21 | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260718, scripts/lua/rest/v2/get/system/configurations/list_available_backups.lua and… |
CVE-2026-83621 | High | 8.1 | 2026-09-21 | ntopng is a web-based network traffic monitoring application. Prior to 6.7.260717, POST /lua/rest/v2/edit/system/edit_blacklist.lua in scripts/lua/rest/v2/edit… |
CVE-2026-79920 | Critical | 9.9 | 2026-09-21 | Ajenti is a Linux & BSD modular server admin panel. Prior to version 2.2.16, any authenticated user can call /api/core/tasks/start to enqueue InstallPlugin, Un… |
CVE-2026-63116 | High | 8.8 | 2026-09-21 | deepstream is a server that allows clients and backend services to sync data, send messages and make rpcs at scale. From 10.1.0 until 10.1.1, src/services/perm… |
CVE-2026-84298 | Low | 3.1 | 2026-09-21 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. Prior to 0.95.3, the V1 DurableTask stream handler stores… |
CVE-2026-94394 | | 2026-09-21 | When a regular user adds a reference between objects or attributes, MISP checks whether the user can access the overall event, but it does not always check whe… | |
CVE-2026-86802 | Low | 3.7 | 2026-09-21 | The To Do List Member WordPress plugin through 1.6 does not have authorisation or nonce checks in an import routine, and does not validate the location it fetc… |
CVE-2026-94218 | Low | 3.1 | 2026-09-21 | A flaw was found in the authentication session management of Keycloak, an identity and access management solution. The issue occurs when an administrator enfor… |
CVE-2026-94217 | Low | 3.5 | 2026-09-21 | A flaw was found in the User-Managed Access (UMA) implementation of Keycloak. The issue occurs in the authorization token endpoint when processing permission t… |
CVE-2026-94215 | Medium | 5.5 | 2026-09-21 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs because the API uses a per-request… |
CVE-2026-94213 | Medium | 4.9 | 2026-09-21 | A flaw was found in the Authorization Services component of Keycloak, an open-source identity and access management solution. The issue occurs in the policy ev… |
CVE-2026-94113 | Medium | 6.5 | 2026-09-20 | Frappe ERPNext versions before 15.121.0 and 16.x before 16.34.0 contain an information disclosure vulnerability in whitelisted timesheet endpoints that fail to… |
CVE-2026-92965 | Low | 3.7 | 2026-09-20 | The TikTok WordPress plugin before 1.4.2 does not check that a request is authorised before acting on a sign-in code supplied in the URL, so any visitor can ma… |
CVE-2026-94001 | Medium | 6.5 | 2026-09-19 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The endpoint used for deleting user credentials doe… |
CVE-2026-94000 | Medium | 6.6 | 2026-09-19 | A flaw was found in the Admin REST API of Keycloak, an open-source identity and access management solution. The issue occurs in the group-membership endpoints… |
CVE-2026-93999 | Medium | 4.2 | 2026-09-19 | A flaw was found in the OIDC protocol implementation of Keycloak, an open-source identity and access management solution. The issue occurs during the token ref… |
CVE-2026-9858 | Medium | 4.3 | 2026-09-19 | The Partial Shipment for Woocommerce plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.4 via the wxp_order_shipme… |
CVE-2026-9766 | Medium | 4.3 | 2026-09-19 | The Empik for Woocommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.1. This is due to the plugin not… |
CVE-2026-9613 | Medium | 4.3 | 2026-09-19 | The Datalogics Ecommerce Delivery – Datalogics plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.65. This is… |
CVE-2026-18346 | Medium | 5.3 | 2026-09-19 | The TikTok plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1. This is due to the plugin not properly verif… |
CVE-2026-9615 | Medium | 4.3 | 2026-09-19 | The Flex Import plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.0. This is due to the license_activate_flex… |
CVE-2026-9232 | Medium | 6.5 | 2026-09-19 | The Easy Appointments plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.12.27 via the handle_custome… |
CVE-2026-4792 | Medium | 5.3 | 2026-09-19 | The Bread plugin for WordPress is vulnerable to information exposure in versions up to and including 2.9.12. This is due to the lack of authentication and auth… |
CVE-2026-2278 | Medium | 4.3 | 2026-09-19 | The VW Writer Blog theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'vw_writer_blog_reset_all_se… |
CVE-2026-1984 | Medium | 5.3 | 2026-09-19 | The Ibtana – Ecommerce Product Addons plugin for WordPress is vulnerable to unauthorized post meta modification due to a missing capability check on the 'iepa_… |
CVE-2026-15947 | Medium | 4.3 | 2026-09-19 | The Metasync plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the save_instant_indexing_settings()… |
CVE-2026-15946 | Medium | 4.3 | 2026-09-19 | The Search Atlas SEO – Premier SEO Plugin for One-Click WP Publishing & Integrated AI Optimization plugin for WordPress is vulnerable to authorization bypass i… |
CVE-2026-11899 | Medium | 4.3 | 2026-09-19 | The PDF Builder for WooCommerce. Create invoices,packing slips and more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and i… |
CVE-2026-92435 | Medium | 5.3 | 2026-09-19 | The Mailchimp for WooCommerce WordPress plugin before 6.1.1 does not verify that the requesting user holds the required capability in the permission callback f… |
CVE-2026-92430 | Medium | 5.3 | 2026-09-19 | The Rede Itaú for WooCommerce — Payment PIX, Credit Card and Debit WordPress plugin before 5.4.7 does not verify the authenticity of its PIX payment webhook be… |
CVE-2026-86591 | Critical | 9.8 | 2026-09-19 | The Botiga Pro WordPress plugin before 1.6.5 does not perform any authorisation checks on one of its REST routes, allowing unauthenticated users to update arbi… |
CVE-2026-85574 | High | 8.0 | 2026-09-19 | The Unbounce Landing Pages WordPress plugin before 1.1.5 does not perform any authorisation check when updating the configuration its front-end proxy relies on… |
CVE-2026-89334 | Medium | 6.5 | 2026-09-19 | The Better Messages – Chat Rooms, Group Chat, Private Messages & AI Chat Bots plugin for WordPress is vulnerable to authorization bypass in all versions up to… |
CVE-2026-88944 | Medium | 4.3 | 2026-09-19 | The Tutor LMS – eLearning and online course solution plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.8. Th… |
CVE-2026-15760 | Medium | 6.5 | 2026-09-19 | The Divi Essential plugin for WordPress is vulnerable to sensitive information exposure in versions up to, and including, 5.8.1 via the dnxte_get_database_tabl… |
CVE-2026-15660 | Medium | 4.3 | 2026-09-19 | The SEO Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.4.7. This is due to a missing capability check… |
CVE-2026-93921 | Medium | 4.3 | 2026-09-19 | SiYuan versions through 3.8.4 fail to enforce publish access control in the getDynamicIcon endpoint, allowing read-only token holders to access document metada… |
CVE-2026-68928 | High | 8.6 | 2026-09-18 | Acode is a powerful text and code editor for Android. From 1.11.6 until 1.12.7, com.foxdebug.acode.rk.exec.terminal.TerminalService is declared as an exported… |
CVE-2026-82885 | High | 8.8 | 2026-09-18 | IBM Guardium Data Protection 12.2 could allow a remote authenticated attacker to gain elevated privileges due to missing authorization in the REST API. |
CVE-2026-76902 | Medium | 5.0 | 2026-09-18 | CordysCRM is an open source AI-powered customer relationship management system that supports private deployment. Prior to 1.7.4, ShiroFilter configures /attach… |
CVE-2026-61821 | High | 8.5 | 2026-09-18 | pg_partman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, drop_partition_id() and drop_partition_time() use part_conf… |
CVE-2026-11545 | Low | 3.7 | 2026-09-18 | IBM WebSphere Application Server 8.5 and 9.0 could allow a remote attacker to obtain sensitive information from the administrative console due to missing autho… |
CVE-2026-93852 | | 2026-09-18 | In OpenStack Blazar before 17.0.1, the V2 lease listing operation (GET /v2/leases) returns leases for every project without enforcing project scoping or an adm… | |
CVE-2026-85058 | High | 7.5 | 2026-09-18 | Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.publishWill publishes a client-controlled Last Will message through publish2Subscribers… |
CVE-2026-77385 | Medium | 4.3 | 2026-09-18 | Kyoo is a self-hosted media server focused on movies, series, and anime. Prior to 5.1.0, a registered user with the core.play permission could supply a base64-… |
CVE-2026-63199 | | 2026-09-18 | Perses is an open-source dashboard and visualization project for observability data. From 0.43.0 until 0.54.0-rc.0, the datasource creation and unsaved datasou… |