CWE-862 · Missing Authorization (page 3)
Page 3 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-47765 | | 2026-08-06 | Frappe is a full-stack web application framework. Prior to 15.110.0 and 16.20.0, the restore and bulk_restore endpoints do not apply the appropriate document p… | |
CVE-2026-45415 | Medium | 6.0 | 2026-08-06 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the /admin/csv_census/census_l… |
CVE-2026-13399 | High | 7.5 | 2026-08-06 | The Payment Plugins for PayPal WooCommerce WordPress plugin before 2.0.20 does not have proper authorization checks on a REST endpoint, allowing unauthenticate… |
CVE-2026-18277 | High | 7.1 | 2026-08-06 | Missing authorization in the OcrModelRight create and delete views in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to grant themselv… |
CVE-2026-18276 | Medium | 4.3 | 2026-08-06 | Missing authorization in the websocket consumer in Scripta eScriptorium through 26.04.1 allows a remote authenticated user to subscribe to any document's event… |
CVE-2026-66712 | High | 7.5 | 2026-08-06 | Unauthenticated Broken Access Control in Simple Membership <= 4.7.8 versions. |
CVE-2026-66708 | High | 8.2 | 2026-08-06 | Unauthenticated Broken Access Control in Total Upkeep <= 1.17.2 versions. |
CVE-2026-66701 | Medium | 5.3 | 2026-08-06 | Unauthenticated Broken Access Control in Profile Builder <= 3.16.5 versions. |
CVE-2026-66699 | Medium | 5.3 | 2026-08-06 | Custom role Broken Access Control in Dokan <= 5.0.10 versions. |
CVE-2026-66678 | Medium | 4.3 | 2026-08-06 | Contributor Broken Access Control in Advanced Custom Fields: Font Awesome Field <= 6.1.1 versions. |
CVE-2026-66470 | High | 7.1 | 2026-08-06 | Subscriber Broken Access Control in Frontend Admin by DynamiApps <= 3.29.10 versions. |
CVE-2026-66452 | Medium | 6.5 | 2026-08-06 | Unauthenticated Broken Access Control in Legal Text Connector of the IT-Recht Kanzlei <= 1.0.13 versions. |
CVE-2026-65554 | High | 7.1 | 2026-08-06 | Subscriber Broken Access Control in AnsPress – Question and answer 4.4.4 versions. |
CVE-2026-65541 | High | 7.3 | 2026-08-06 | Unauthenticated Broken Access Control in Staff Training <= 1.0.7 versions. |
CVE-2026-65504 | High | 7.5 | 2026-08-06 | Unauthenticated Broken Access Control in BOX NOW Delivery Croatia <= 3.3.0 versions. |
CVE-2026-32548 | Medium | 5.3 | 2026-08-06 | Unauthenticated Broken Access Control in SureCart <= 4.6.2 versions. |
CVE-2026-28140 | High | 7.5 | 2026-08-06 | Unauthenticated Broken Access Control in JetFormBuilder <= 3.6.4.1 versions. |
CVE-2026-28005 | Critical | 9.8 | 2026-08-06 | Unauthenticated Privilege Escalation in Kadence WooCommerce Email Designer <= 1.5.19 versions. |
CVE-2026-25403 | Medium | 6.5 | 2026-08-06 | Unauthenticated Broken Access Control in Ultimate Store Kit Elementor Addons <= 3.0.5 versions. |
CVE-2026-15246 | Medium | 4.3 | 2026-08-06 | The RealHomes Memberships WordPress plugin before 3.1.0 does not verify that a membership payment actually completed, nor check a nonce or the user's capabilit… |
CVE-2026-65551 | High | 7.5 | 2026-08-06 | Missing Authorization vulnerability in Soflyy Breakdance allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Breakdanc… |
CVE-2026-11983 | Medium | 5.3 | 2026-08-06 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a mis… |
CVE-2025-9266 | Medium | 4.3 | 2026-08-06 | The Accelerate theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the enqueue_scripts() function in al… |
CVE-2026-19010 | High | 7.3 | 2026-08-06 | A security vulnerability has been detected in TinyAGI 0.0.20. Impacted is the function processMessage of the file packages/main/src/index.ts of the component M… |
CVE-2026-16734 | High | 7.5 | 2026-08-06 | The Stripe Payment Forms by WP Full Pay WordPress plugin before 8.5.2 does not verify that the caller owns the Stripe payment intent referenced by two unauthe… |
CVE-2026-16290 | Medium | 5.3 | 2026-08-06 | The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks before returning a group's member list, and registers the handler for un… |
CVE-2026-15991 | High | 8.8 | 2026-08-06 | The File Manager plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the connector function in all versio… |
CVE-2026-71316 | High | 7.5 | 2026-08-05 | Nuxt is an open-source web development framework for Vue.js. From 4.4.0 until 4.5.1, runtime cache:nuxt:payload entries for /<page>/_payload.json can be return… |
CVE-2026-70618 | Medium | 4.3 | 2026-08-05 | Spacebar Server before commit 51da17c contains a missing authorization vulnerability that allows any authenticated user to enumerate complete guild membership… |
CVE-2026-70617 | High | 8.1 | 2026-08-05 | Spacebar Server before commit dcfd910 contains a missing authorization vulnerability that allows any authenticated attacker to add themselves to arbitrary grou… |
CVE-2026-48168 | Critical | 10.0 | 2026-08-05 | PraisonAI is a multi-agent teams system. In versions prior to 4.6.40, the bundled Claude GitHub Actions workflow is vulnerable to command injection because it… |
CVE-2026-70447 | Medium | 4.3 | 2026-08-05 | Missing permission checks in Jenkins AWS CodeBuild Plugin 0.59 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credent… |
CVE-2026-70446 | Medium | 4.3 | 2026-08-05 | Missing permission checks in Jenkins CodeSonar Plugin 3.6.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credential… |
CVE-2026-70445 | Medium | 4.3 | 2026-08-05 | Missing permission checks in Jenkins Sauce OnDemand Plugin 2.2.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of crede… |
CVE-2026-70439 | Medium | 6.5 | 2026-08-05 | Jenkins XML Job to Job DSL Plugin 0.1.13 and earlier does not perform permission checks, allowing attackers lacking appropriate permissions to invoke the conve… |
CVE-2026-70438 | Medium | 4.3 | 2026-08-05 | A missing permission check in Jenkins Parameterized Remote Trigger Plugin 3.2.2 and earlier allows attackers with Overall/Read permission to enumerate credenti… |
CVE-2026-70436 | Medium | 4.3 | 2026-08-05 | Jenkins External Workspace Manager Plugin 1.4.1 and earlier does not perform a permission check (1.4.0 and earlier) or performs an improper permission check (1… |
CVE-2026-70435 | Medium | 4.2 | 2026-08-05 | A missing permission check in Jenkins SCM-Manager Plugin 1.11.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified U… |
CVE-2026-70433 | Medium | 4.3 | 2026-08-05 | Missing permission checks in Jenkins HCL AppScan Plugin 1.8.3 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of credenti… |
CVE-2026-17613 | High | 7.5 | 2026-08-05 | Penpot’s ::import-binfile RPC command lacks authorization on the optional file-id parameter, allowing any authenticated user to overwrite any files on the targ… |
CVE-2026-7529 | High | 7.5 | 2026-08-05 | The wiseCampaign – WooCommerce Conversions Made Easy plugin for WordPress is vulnerable to unauthorized modification and disclosure of data due to every one of… |
CVE-2026-7456 | Medium | 6.5 | 2026-08-05 | The Udimi Tools plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `ajax_disconnect()` function i… |
CVE-2026-71264 | High | 8.2 | 2026-08-05 | WLED's GET /json/cfg endpoint (registered in wled00/wled_server.cpp) calls serveJson with no settings-PIN check, unlike the /edit endpoint which explicitly che… |
CVE-2026-71252 | High | 8.2 | 2026-08-05 | toner-management's admin state-changing handlers (add.php, edit.php, delete.php under admin/toners, admin/toner-brands, admin/printers, and related admin subdi… |
CVE-2026-7726 | Medium | 6.5 | 2026-08-05 | The Layouts for WPBakery plugin for WordPress is vulnerable to unauthorized actions due to a missing capability check on the `Layouts_WPB_Remote::template_sync… |
CVE-2026-7520 | High | 8.1 | 2026-08-05 | The MailChimp Forms by MailMunch plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `sign_in()` a… |
CVE-2026-7105 | Medium | 4.3 | 2026-08-05 | The Xpro Addons plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on the `get_menu_content_editor()` functi… |
CVE-2026-6639 | High | 7.5 | 2026-08-05 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.6… |
CVE-2026-6627 | High | 8.2 | 2026-08-05 | The WPFormify – Stripe Payments with Form and Checkout plugin for WordPress is vulnerable to unauthorized modification and deletion of Stripe payment credentia… |
CVE-2026-6079 | High | 7.3 | 2026-08-05 | The Material Dashboard plugin for WordPress is vulnerable to unauthorized access and modification of data due to missing capability checks on the amd_ajax_targ… |
CVE-2026-5581 | Critical | 9.1 | 2026-08-05 | The Multi Uploader for Gravity Forms plugin for WordPress is vulnerable to unauthorized arbitrary media deletion in all versions up to, and including, 1.1.8. T… |
CVE-2026-54418 | High | 8.1 | 2026-08-05 | Leantime through 3.6.2 exposes the JSON-RPC methods leantime.rpc.TwoFA.TwoFA.getSetupData, saveSecret, verifyAndEnable, and disable2FA, which act on a caller-s… |
CVE-2026-4431 | Critical | 9.1 | 2026-08-05 | The Easy Post Submission plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `create_post()` funct… |
CVE-2026-12000 | High | 7.5 | 2026-08-05 | The Page and Post Restriction plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to and including 1.4.0 via the WordPress core… |
CVE-2026-16605 | High | 7.2 | 2026-08-05 | The MultiVendorX WordPress plugin before 5.0.11 does not verify that the store targeted through its REST API belongs to the requesting vendor, allowing an aut… |
CVE-2026-16561 | High | 7.5 | 2026-08-05 | The Sunshine Photo Cart WordPress plugin before 3.6.12 does not perform access control checks in one of its AJAX actions, allowing unauthenticated users to re… |
CVE-2026-8761 | High | 8.8 | 2026-08-05 | The Dokan plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.1. This is due to a missing authorization check… |
CVE-2026-7753 | Medium | 6.5 | 2026-08-05 | The Cost Calculator Builder plugin for WordPress is vulnerable to unauthorized access of sensitive data due to a missing capability check on the `cost-calculat… |
CVE-2026-18819 | Medium | 4.3 | 2026-08-04 | A security vulnerability has been detected in RackTables up to 0.22.0/e5fff9f8aab339798ed47e8c6d7d977ed97a82bd. This vulnerability affects unknown code. The ma… |
CVE-2026-70619 | High | 8.8 | 2026-08-04 | Odysseus before commit bf325f6 contains a missing authorization vulnerability that allows authenticated non-admin users to manage server-wide embedding backend… |
CVE-2026-70494 | High | 8.1 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.0, the DELETE /api/v1/folders/{id} handler in back… |
CVE-2026-70487 | Medium | 5.3 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.8 until 0.11.0, inline direct model metadata accepted client-sup… |
CVE-2026-13227 | | 2026-08-04 | An Improper Authorization vulnerability exists in ERPNext version <v16.25.0 and <15.115.0 due to insufficient access control in the whitelisted API method erp… | |
CVE-2026-70484 | Medium | 4.3 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.7.0 until 0.11.0, the legacy chat-completions features block trust… |
CVE-2026-70483 | Low | 3.1 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.6 until 0.11.0, DELETE /api/v1/chats/{id} cancelled a chat's in-… |
CVE-2026-70481 | Medium | 5.4 | 2026-08-04 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.5.0 until 0.11.0, the standard channel message update and delete h… |
CVE-2026-70475 | | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the PUT /api/v1/executions/:id endpoint in packages/se… | |
CVE-2026-70473 | | 2026-08-04 | Flowise is a drag-and-drop user interface for building customized large language model (LLM) flows. Prior to 3.1.3, Flowise GET /api/v1/upsert-history returns… | |
CVE-2026-13229 | | 2026-08-04 | Zammad 7.1.0 contains an authenticated improper authorization vulnerability in the ticket article attachment cloning endpoint. | |
CVE-2026-69252 | | 2026-08-04 | Flowise is a drag & drop user interface to build a customized large language model flow. Prior to 3.1.3, the /api/v1/files route was protected only by the feat… | |
CVE-2026-18650 | High | 8.8 | 2026-08-04 | Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Privilege Escalation. This issue affects Liman MYS: from 2.2.3 before 2.3.1. |
CVE-2026-17070 | High | 8.8 | 2026-08-04 | Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Liman MYS… |
CVE-2026-63248 | Medium | 6.5 | 2026-08-04 | In Eclipse Milo versions 0.6.0 through 1.1.4, OPC UA server diagnostics nodes do not enforce access authorization. An anonymous client can enable diagnostics o… |
CVE-2026-58080 | High | 8.2 | 2026-08-04 | In Eclipse Milo versions 1.0.0 through 1.1.4, `OpcUaServerConfig.copy()` fails to preserve a configured `RoleMapper`. On servers that rely on role permissions… |
CVE-2026-16546 | Medium | 4.3 | 2026-08-04 | The Wired Impact Volunteer Management WordPress plugin before 2.8.2 does not have authorisation checks in one of its AJAX actions, and does not verify that the… |
CVE-2026-16056 | Medium | 4.3 | 2026-08-04 | The Contest Gallery WordPress plugin before 30.0.7 does not perform any capability or nonce check in one of its handlers, allowing any authenticated user down… |
CVE-2026-16035 | Medium | 4.3 | 2026-08-04 | The miniOrange 2FA WordPress plugin before 6.2.7 does not restrict who can trigger its second-factor configuration OTP send, nor bind the OTP recipient to the… |
CVE-2026-15958 | Critical | 9.3 | 2026-08-04 | The Easy Integration for Dropbox WordPress plugin before 2.2.0 does not perform authorization checks on several of its file-management AJAX actions that it al… |
CVE-2026-66326 | Medium | 6.5 | 2026-08-04 | Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network. |
CVE-2026-66311 | Medium | 6.2 | 2026-08-04 | Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering locally. |
CVE-2026-67616 | Medium | 4.3 | 2026-08-03 | Camaleon CMS through 2.9.2, fixed in commit 88ab703, contains a missing authorization vulnerability on the drafts endpoint that allows any authenticated low-pr… |
CVE-2026-68979 | Critical | 9.8 | 2026-08-03 | Apache NiFI 1.10.0 through 2.10.0 provide a Parameter Context update REST API method that does not enforce authorization checking on components referencing Par… |
CVE-2026-69090 | Medium | 4.9 | 2026-08-03 | Admidio before 5.0.11 fails to validate target organization membership in role handlers, allowing authenticated role administrators to delete, activate, deacti… |
CVE-2026-68587 | High | 8.6 | 2026-08-03 | SiYuan versions before v3.7.3 contain an information disclosure vulnerability in the getHeadingDeleteTransaction, getHeadingLevelTransaction, and getHeadingIns… |
CVE-2026-68586 | High | 8.6 | 2026-08-03 | SiYuan before v3.7.3 fails to apply publish-access filters to the getBacklinkDoc and getBackmentionDoc content endpoints (/api/ref/getBacklinkDoc and /api/ref/… |
CVE-2026-68585 | Medium | 5.8 | 2026-08-03 | SiYuan versions before v3.7.3 contain a metadata disclosure vulnerability in the /api/block/getBlockInfo endpoint that returns document root metadata including… |
CVE-2026-28147 | Medium | 5.4 | 2026-08-03 | Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Conf… |
CVE-2026-16300 | Critical | 9.8 | 2026-08-03 | The ChamaWP WordPress plugin before 1.0.13 does not properly validate a password reset request, allowing unauthenticated attackers to reset the password of ar… |
CVE-2026-16289 | Medium | 4.3 | 2026-08-03 | The ProfileGrid WordPress plugin before 6.0.0.0 does not perform authorization checks when listing a group's pending membership requests, allowing any authent… |
CVE-2026-16276 | Low | 2.7 | 2026-08-03 | The Classified Listing WordPress plugin before 5.4.4 does not perform a capability check on an AJAX action that returns aggregated store revenue totals, allow… |
CVE-2026-16274 | Low | 2.7 | 2026-08-03 | The Classified Listing WordPress plugin before 5.4.4 does not perform a capability or ownership check on an AJAX action that returns a post's content, allowin… |
CVE-2026-16057 | Medium | 6.5 | 2026-08-03 | The Contest Gallery WordPress plugin before 30.0.7 does not perform per-object capability or nonce checks in one of its post-deletion handlers, gating it only… |
CVE-2026-15930 | Critical | 9.4 | 2026-08-03 | The Simple Membership WordPress plugin before 4.7.8 does not verify whether user creation failed during registration before using the returned value as a user… |
CVE-2026-20495 | High | 7.8 | 2026-08-03 | In Bluetooth driver, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege with User execut… |
CVE-2026-20483 | High | 7.7 | 2026-08-03 | In Telephony, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additiona… |
CVE-2026-18573 | Medium | 6.5 | 2026-08-02 | A flaw was found in the keycloak-services component of Keycloak, which is used for managing authentication and authorization flows. The issue occurs when a rea… |
CVE-2026-18571 | Medium | 6.6 | 2026-08-02 | A flaw was found in the user creation component of Keycloak when Fine-Grained Admin Permissions V2 (FGAP V2) is enabled. This issue allows a sub-administrator… |
CVE-2026-18570 | Medium | 5.4 | 2026-08-02 | A flaw was found in the full-scope-disabled client-policy executor within the keycloak-services component. This component is responsible for enforcing security… |
CVE-2026-16285 | High | 7.5 | 2026-08-02 | The Product Attachment for WooCommerce WordPress plugin before 2.3.3 does not perform any authorization check before streaming media library files, allowing un… |
CVE-2026-16042 | Medium | 4.3 | 2026-08-02 | The LWS Optimize WordPress plugin before 3.4 does not perform a capability check on its cache-clearing actions, allowing any authenticated user, including Sub… |