CWE-862 · Missing Authorization (page 30)
Page 30 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-33501 | Medium | 5.3 | 2026-03-23 | WWBN AVideo is an open source video platform. In versions up to and including 26.0, the endpoint `plugin/Permissions/View/Users_groups_permissions/list.json.ph… |
CVE-2026-4590 | Low | 3.1 | 2026-03-23 | A security flaw has been discovered in kalcaddle kodbox 1.64. The impacted element is an unknown function of the file /workspace/source-code/plugins/oauth/cont… |
CVE-2026-4261 | High | 8.8 | 2026-03-21 | The Expire Users plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.2.2. This is due to the plugin allowing a u… |
CVE-2026-4127 | Medium | 4.3 | 2026-03-21 | The Speedup Optimization plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 1.5.9. The `speedup01_ajax_enabled()`… |
CVE-2026-3651 | Medium | 5.3 | 2026-03-21 | The Build App Online plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.23. This is due to the plugin register… |
CVE-2026-3645 | Medium | 5.3 | 2026-03-21 | The Punnel – Landing Page Builder plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.3.1. The save_config() fu… |
CVE-2026-3570 | Medium | 5.3 | 2026-03-21 | The Smarter Analytics plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0. This is due to missing authenticatio… |
CVE-2026-3506 | Medium | 5.3 | 2026-03-21 | The WP-Chatbot for Messenger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.9. This is due to the plugin no… |
CVE-2026-3335 | Medium | 5.3 | 2026-03-21 | The Canto plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 3.1.1 via the `/wp-content/plugins/canto/includes/l… |
CVE-2026-2941 | High | 8.8 | 2026-03-21 | The Linksy Search and Replace plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'linksy_search_a… |
CVE-2026-2720 | Medium | 6.5 | 2026-03-21 | The Hr Press Lite plugin for WordPress is vulnerable to unauthorized access of sensitive employee data due to a missing capability check on the `hrp-fetch-empl… |
CVE-2026-1935 | Medium | 4.3 | 2026-03-21 | The Company Posts for LinkedIn plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.0. This is due to a missin… |
CVE-2026-1253 | Medium | 4.3 | 2026-03-21 | The Group Chat & Video Chat by AtomChat plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'atomc… |
CVE-2026-3567 | Medium | 5.3 | 2026-03-21 | The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1132. The plugin… |
CVE-2026-33427 | High | 7.5 | 2026-03-21 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, an unauthenticated attacker can cause a legitimat… |
CVE-2026-33426 | Low | 3.5 | 2026-03-21 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, users with tag-editing permissions could edit and… |
CVE-2026-33425 | Medium | 5.3 | 2026-03-21 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, unauthenticated users can determine whether a spe… |
CVE-2026-33423 | Medium | 4.3 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, staff can modify any user's group notification le… |
CVE-2026-33177 | Medium | 4.3 | 2026-03-20 | Statamic is a Laravel and Git powered content management system (CMS). Prior to versions 5.73.14 and 6.7.0, low-privileged Control Panel users could create tax… |
CVE-2026-22172 | Critical | 9.9 | 2026-03-20 | OpenClaw versions prior to 2026.3.12 contain an authorization bypass vulnerability in the WebSocket connect path that allows shared-token or password-authentic… |
CVE-2026-3550 | Medium | 5.3 | 2026-03-20 | The RockPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.17. This is due to missing capability check… |
CVE-2026-4038 | Critical | 9.8 | 2026-03-20 | The Aimogen Pro plugin for WordPress is vulnerable to Arbitrary Function Call that can lead to privilege escalation due to a missing capability check on the 'a… |
CVE-2026-30889 | Medium | 4.9 | 2026-03-20 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a moderator could exploit insufficient authorizat… |
CVE-2026-32817 | Critical | 9.1 | 2026-03-20 | Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the documents and files module does not verify whether the current user ha… |
CVE-2026-33408 | Low | 2.2 | 2026-03-19 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, moderators were able to see the first 40 characte… |
CVE-2026-32818 | Medium | 6.5 | 2026-03-19 | Admidio is an open-source user management solution. In versions 5.0.0 through 5.0.6, the forum module in Admidio does not verify whether the current user has p… |
CVE-2026-29072 | High | 7.5 | 2026-03-19 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, users who do not belong to the allowed policy cre… |
CVE-2026-33305 | Medium | 5.4 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization bypass in the optio… |
CVE-2026-33304 | Medium | 6.5 | 2026-03-19 | OpenEMR is a free and open source electronic health records and medical practice management application. Prior to 8.0.0.2, an authorization bypass in the dated… |
CVE-2026-32622 | High | 8.8 | 2026-03-19 | SQLBot is an intelligent data query system based on a large language model and RAG. Versions 1.5.0 and below contain a Stored Prompt Injection vulnerability th… |
CVE-2026-27491 | Medium | 4.3 | 2026-03-19 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, a type coercion issue in a post actions API endpo… |
CVE-2026-27454 | Medium | 5.3 | 2026-03-19 | Discourse is an open-source discussion platform. Prior to versions 2026.3.0-latest.1, 2026.2.1, and 2026.1.2, requesting /posts/:id.json?version=X bypassed aut… |
CVE-2026-26939 | Medium | 6.5 | 2026-03-19 | Missing Authorization (CWE-862) in Kibana’s server-side Detection Rule Management can lead to Unauthorized Endpoint Response Action Configuration (host isolati… |
CVE-2026-25443 | High | 7.5 | 2026-03-19 | Missing Authorization vulnerability in Dotstore Fraud Prevention For Woocommerce woo-blocker-lite-prevent-fake-orders-and-blacklist-fraud-customers allows Expl… |
CVE-2026-3475 | Medium | 5.3 | 2026-03-19 | The Instant Popup Builder plugin for WordPress is vulnerable to Unauthenticated Arbitrary Shortcode Execution in all versions up to and including 1.1.7. This i… |
CVE-2026-25312 | High | 7.5 | 2026-03-19 | Missing Authorization vulnerability in Metagauss EventPrime eventprime-event-calendar-management allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-27091 | Medium | 6.3 | 2026-03-19 | Missing Authorization vulnerability in UiPress UiPress lite uipress-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-28070 | Medium | 5.3 | 2026-03-19 | Missing Authorization vulnerability in Tips and Tricks HQ WP eMember allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-32736 | Medium | 4.3 | 2026-03-18 | The Hytale Modding Wiki is a free service for Hytale mods to host their documentation & wikis. An Insecure Direct Object Reference (IDOR) vulnerability in vers… |
CVE-2026-2992 | High | 8.2 | 2026-03-18 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to Privilege Escalation due to missing authorization on the `/wp-jso… |
CVE-2026-2559 | Medium | 5.3 | 2026-03-18 | The Post SMTP plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `handle_office365_oauth_redirect… |
CVE-2026-32565 | Medium | 5.3 | 2026-03-18 | Missing Authorization vulnerability in Ajay Contextual Related Posts contextual-related-posts allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2026-1217 | Medium | 5.4 | 2026-03-18 | The Yoast Duplicate Post plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the clone_bulk_action_han… |
CVE-2026-32268 | | 2026-03-18 | The Azure Blob Storage for Craft CMS plugin provides an Azure Blob Storage integration for Craft CMS. In versions on the 2.x branch prior to 2.1.1, unauthentic… | |
CVE-2026-1926 | Medium | 5.3 | 2026-03-18 | The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `wps_sfw_adm… |
CVE-2026-4064 | High | 8.3 | 2026-03-17 | Missing authorization checks on multiple gRPC service endpoints in PowerShell Universal before 2026.1.4 allows an authenticated user with any valid token to by… |
CVE-2026-30911 | High | 8.1 | 2026-03-17 | Apache Airflow versions 3.1.0 through 3.1.7 missing authorization vulnerability in the Execution API's Human-in-the-Loop (HITL) endpoints that allows any authe… |
CVE-2026-4202 | Medium | 4.3 | 2026-03-17 | The extension fails to verify, if an authenticated user has permissions to access to redirects resulting in exposure of redirect records when editing a page. |
CVE-2026-32586 | Medium | 5.3 | 2026-03-17 | Missing Authorization vulnerability in Pluggabl Booster for WooCommerce woocommerce-jetpack allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-2373 | Medium | 5.3 | 2026-03-17 | The Royal Addons for Elementor – Addons and Templates Kit for Elementor plugin for WordPress is vulnerable to Information Exposure in all versions up to, and i… |
CVE-2026-32587 | Medium | 5.4 | 2026-03-16 | Missing Authorization vulnerability in Saad Iqbal WP EasyPay wp-easy-pay allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-32583 | Medium | 5.3 | 2026-03-16 | Missing Authorization vulnerability in Webnus Inc. Modern Events Calendar allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2026-2463 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to filter invite IDs based on user permissions, which allows regular users to… |
CVE-2026-2458 | Medium | 4.3 | 2026-03-16 | Mattermost versions 11.3.x <= 11.3.0, 11.2.x <= 11.2.2, 10.11.x <= 10.11.10 fail to properly validate team membership when searching channels which allows a re… |
CVE-2026-2233 | Medium | 5.3 | 2026-03-16 | The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to unauthorized modi… |
CVE-2026-25083 | High | 8.3 | 2026-03-16 | GROWI OpenAI thread/message API endpoints do not perform authorization. Affected are v7.4.5 and earlier versions. A logged-in user who knows a shared AI assist… |
CVE-2026-1948 | Medium | 4.3 | 2026-03-16 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check o… |
CVE-2026-1870 | Medium | 5.3 | 2026-03-16 | The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing val… |
CVE-2026-4063 | Medium | 4.3 | 2026-03-13 | The Social Icons Widget & Block by WPZOOM plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check in the add_men… |
CVE-2026-3045 | High | 7.5 | 2026-03-13 | The Appointment Booking Calendar — Simply Schedule Appointments plugin for WordPress is vulnerable to unauthorized access of sensitive data in all versions up… |
CVE-2026-32543 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in CyberChimps Responsive Blocks responsive-block-editor-addons allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2026-32487 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in raratheme Lawyer Landing Page lawyer-landing-page allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2026-32486 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in wptravelengine Travel Booking travel-booking allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-32461 | Medium | 4.3 | 2026-03-13 | Missing Authorization vulnerability in Really Simple Plugins Really Simple SSL really-simple-ssl allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2026-32457 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in Wombat Plugins Advanced Product Fields (Product Addons) for WooCommerce advanced-product-fields-for-woocommerce allows E… |
CVE-2026-32453 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in ThemeFusion Avada Core fusion-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2026-32452 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-32451 | Medium | 6.5 | 2026-03-13 | Missing Authorization vulnerability in ThemeFusion Fusion Builder fusion-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-32447 | Medium | 4.3 | 2026-03-13 | Missing Authorization vulnerability in Vito Peleg Atarim atarim-visual-collaboration allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-32446 | Medium | 4.3 | 2026-03-13 | Missing Authorization vulnerability in Syed Balkhi Contact Form by WPForms wpforms-lite allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-32445 | Low | 2.7 | 2026-03-13 | Missing Authorization vulnerability in Elementor Elementor Website Builder elementor allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-32442 | Medium | 5.0 | 2026-03-13 | Missing Authorization vulnerability in E2Pdf e2pdf e2pdf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects e2pdf: from… |
CVE-2026-32440 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in Ex-Themes WP Food wp-food allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP… |
CVE-2026-32439 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in WebGeniusLab BigHearts bighearts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2026-32438 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in vowelweb VW School Education vw-school-education allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-32437 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in vowelweb VW Portfolio vw-portfolio allows Exploiting Incorrectly Configured Access Control Security Levels.This issue af… |
CVE-2026-32436 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in vowelweb VW Photography vw-photography allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-32435 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in vowelweb VW Pet Shop vw-pet-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2026-32434 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in vowelweb VW Fitness vw-fitness allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2026-32432 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in codepeople WP Time Slots Booking Form wp-time-slots-booking-form allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-32428 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in Ays Pro Popup Like box ays-facebook-popup-likebox allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2026-32427 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in vowelweb VW Education Lite vw-education-lite allows Exploiting Incorrectly Configured Access Control Security Levels.Thi… |
CVE-2026-32425 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in linknacional Payment Gateway Pix For GiveWP payment-gateway-pix-for-givewp allows Exploiting Incorrectly Configured Acce… |
CVE-2026-32423 | Medium | 5.4 | 2026-03-13 | Missing Authorization vulnerability in Bowo Admin and Site Enhancements (ASE) admin-site-enhancements allows Exploiting Incorrectly Configured Access Control S… |
CVE-2026-32421 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in Agile Logix Post Timeline post-timeline allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-32417 | Medium | 5.4 | 2026-03-13 | Missing Authorization vulnerability in wppochipp Pochipp pochipp allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Poc… |
CVE-2026-32416 | Medium | 5.4 | 2026-03-13 | Missing Authorization vulnerability in bPlugins PDF Poster pdf-poster allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2026-32413 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in Maciej Bis Permalink Manager Lite permalink-manager allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2026-32410 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in WBW Plugins WBW Currency Switcher for WooCommerce woo-currency allows Exploiting Incorrectly Configured Access Control S… |
CVE-2026-32409 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform Forminator forminator allows Exploiting Incorrectly Configured Access Cont… |
CVE-2026-32408 | Medium | 4.3 | 2026-03-13 | Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Briz… |
CVE-2026-32407 | Medium | 4.3 | 2026-03-13 | Missing Authorization vulnerability in WPClever WPC Smart Wishlist for WooCommerce woo-smart-wishlist allows Exploiting Incorrectly Configured Access Control S… |
CVE-2026-32406 | Medium | 4.3 | 2026-03-13 | Missing Authorization vulnerability in WPClever WPC Product Bundles for WooCommerce woo-product-bundle allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-32404 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in Studio99 Studio99 WP Monitor studio99-wp-monitor allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2026-32402 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in Ays Pro Image Slider by Ays ays-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-32397 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in YMC Filter & Grids ymc-smart-filter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-32396 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in RadiusTheme Team tlp-team allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tea… |
CVE-2026-32395 | Medium | 5.3 | 2026-03-13 | Missing Authorization vulnerability in Xpro Xpro Addons For Beaver Builder – Lite xpro-addons-beaver-builder-elementor allows Exploiting Incorrectly Configured… |
CVE-2026-32394 | Medium | 4.3 | 2026-03-13 | Missing Authorization vulnerability in PublishPress PublishPress Capabilities capability-manager-enhanced allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-32391 | Medium | 5.4 | 2026-03-13 | Missing Authorization vulnerability in linethemes SmartFix smartfix allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |