CWE-862 · Missing Authorization (page 4)
Page 4 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15248 | Medium | 5.5 | 2026-08-02 | The Meta Box WordPress plugin before 5.13.1 does not verify that a user is authorized to delete the supplied attachment before deleting it, allowing users with… |
CVE-2026-13389 | Medium | 6.5 | 2026-08-02 | The webtoffee-cookie-consent WordPress plugin before 3.5.3 does not perform authorization checks on several of its REST API routes, allowing unauthenticated at… |
CVE-2026-67344 | Medium | 4.3 | 2026-08-01 | ArcadeDB before 26.7.2 fails to enforce the UPDATE_SCHEMA database permission on the ALTER TYPE ... CUSTOM and ALTER TYPE ... BUCKETSELECTIONSTRATEGY SQL opera… |
CVE-2026-17580 | Medium | 6.5 | 2026-08-01 | The Advanced Views – Display Custom Fields (ACF, Pods, MetaBox), Posts, CPT and Woo Products anywhere in Gutenberg, Elementor, Divi, Beaver… plugin for WordPre… |
CVE-2026-11995 | Medium | 5.3 | 2026-08-01 | The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to authorization bypass i… |
CVE-2026-10782 | Medium | 4.3 | 2026-08-01 | The RealHomes Memberships plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.0.9. This is due to the plugin not… |
CVE-2026-3141 | Critical | 9.1 | 2026-08-01 | The FormGent plugin for WordPress is vulnerable to unauthorized arbitrary file deletion due to a missing capability check on the /wp-json/formgent/responses/at… |
CVE-2026-45330 | Medium | 4.9 | 2026-07-31 | Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the identity-document verifica… |
CVE-2026-45086 | Medium | 5.4 | 2026-07-31 | Decidim is a participatory democracy framework. From 0.31.1 before 0.31.5 and in 0.32.0.rc1 before 0.32.0.rc2, a participant can directly load /admin/demograph… |
CVE-2026-17350 | Medium | 5.4 | 2026-07-31 | The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce its permission check consistently. In… |
CVE-2026-15227 | | 2026-07-31 | Missing authorization in Checkmk <2.5.0p10, <2.4.0p35, <2.3.0p49, and 2.2.0 (EOL) allows an authenticated user lacking the "Edit foreign Reports" permission to… | |
CVE-2026-18437 | Medium | 5.3 | 2026-07-31 | The MailerPress – Newsletter, email marketing & AI automation plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on th… |
CVE-2026-18436 | Medium | 5.3 | 2026-07-31 | The MailPress plugin for WordPress is vulnerable to unauthorized access in versions up to, and including, 1.5.0 via the campaign revision-restore REST endpoint… |
CVE-2026-18218 | Medium | 4.2 | 2026-07-31 | A flaw was found in the TokenManager component of the Keycloak identity management service. When an administrator attempts to revoke tokens for a specific appl… |
CVE-2026-18214 | Medium | 6.8 | 2026-07-31 | Keycloak allows users to log in using Google accounts and can be configured to only allow users from specific Google Workspace domains. A flaw was found where… |
CVE-2026-18208 | Medium | 6.5 | 2026-07-31 | A flaw was found in the OIDC token introspection endpoint of the keycloak-services component. Keycloak is an open-source identity and access management solutio… |
CVE-2026-16105 | Medium | 4.9 | 2026-07-31 | A flaw was found in the RoleContainerResource component of Keycloak. The issue occurs because certain name-based endpoints in the admin REST API do not properl… |
CVE-2026-14930 | High | 7.5 | 2026-07-31 | The JS Help Desk WordPress plugin before 3.1.4 does not perform any authorization, nonce, or ownership check on a front-end request dispatcher, allowing unaut… |
CVE-2026-14862 | Low | 3.7 | 2026-07-31 | The Support Genix WordPress plugin before 1.4.48 does not properly authorize access to support-ticket attachment downloads, allowing unauthenticated users who… |
CVE-2026-14317 | Medium | 5.3 | 2026-07-31 | The GiveWP WordPress plugin before 4.16.3 does not restrict the set of available payment gateways to those enabled by the administrator, deriving it in part f… |
CVE-2026-67529 | Medium | 4.3 | 2026-07-30 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, GET /api/v3/time_entries and GET /api/v3/cost_entries rendered _links.workP… |
CVE-2026-67527 | High | 7.6 | 2026-07-30 | OpenProject is open-source, web-based project management software. Prior to 17.6.0, PATCH /api/v3/work_packages/{id} accepted _links.fileLinks and allowed auth… |
CVE-2026-15397 | High | 7.2 | 2026-07-30 | The Subscriptions for WooCommerce plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 2.0.0. This is due to the p… |
CVE-2026-15252 | Medium | 5.4 | 2026-07-30 | The Search Atlas SEO WordPress plugin before 2.6.12 does not perform a capability or nonce check in one of its AJAX handlers, allowing any authenticated user… |
CVE-2026-15054 | Low | 3.7 | 2026-07-30 | The Bit Form WordPress plugin before 3.1.2 does not enforce a form's active/published status on its public form-submission handlers, allowing unauthenticated… |
CVE-2026-12500 | High | 7.5 | 2026-07-30 | The WP Travel Engine WordPress plugin before 6.8.2 does not perform a capability check on an AJAX action that updates a WP Travel Engine WordPress plugin bef… |
CVE-2026-11867 | Medium | 6.5 | 2026-07-30 | The Frontend Admin by DynamiApps WordPress plugin before 3.29.7 does not perform capability checks on its taxonomy term creation, modification, and deletion op… |
CVE-2026-14356 | High | 8.8 | 2026-07-30 | The FleekDash V2 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2.2. This is due to the plugin not proper… |
CVE-2026-4672 | Medium | 4.3 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 18.4 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-14341 | Medium | 4.9 | 2026-07-29 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 12.8 before 19.0.5, 19.1 before 19.1.3, and 19.2 before 19.2.1 that under certain co… |
CVE-2026-16543 | | 2026-07-29 | Kong Operator's embedded Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingres… | |
CVE-2026-15228 | | 2026-07-29 | Kong Kubernetes Ingress Controller (KIC) allows a user with namespace-scoped Secret creation privileges to cause a cluster-wide ingress configuration denial of… | |
CVE-2026-66724 | | 2026-07-29 | MWDB Core versions >=2.0.0 and <2.19.0 contain a missing authorization vulnerability in the deprecated config and blob upload endpoints. These endpoints accept… | |
CVE-2026-66723 | | 2026-07-29 | MWDB Core versions >=2.2.0 and <2.19.0 contain a missing authorization vulnerability in the Remote Instances proxy API. The proxy API does not verify authentic… | |
CVE-2026-4604 | Medium | 5.3 | 2026-07-29 | The Klubraum Membership Request plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `kr_mr_store_s… |
CVE-2026-14488 | Critical | 9.1 | 2026-07-29 | The Meta Box AIO plugin for WordPress is vulnerable to Missing Authorization via the template_redirect dispatcher in the MB Frontend Submission extension in ve… |
CVE-2026-50622 | High | 8.8 | 2026-07-29 | Description: Missing Authorization in Apache Atlas. A missing authorization vulnerability in Apache Atlas's admin endpoints allows any authenticated user, rega… |
CVE-2026-18201 | Medium | 5.5 | 2026-07-29 | Keycloak provides a way to manage identity providers and organizations through its administrative API. A flaw was discovered where an administrator with permis… |
CVE-2026-13692 | Medium | 5.3 | 2026-07-29 | The PayU CommercePro Plugin WordPress plugin before 3.9.0 does not verify the payment-gateway signature before applying order modifications, allowing unauthent… |
CVE-2026-5626 | Medium | 4.3 | 2026-07-29 | The Survey Form Block plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_data() function in all… |
CVE-2026-17166 | Medium | 4.3 | 2026-07-29 | The Event Booking Manager for WooCommerce – Sell Tickets, Event Registration, RSVP & Event Calendar plugin for WordPress is vulnerable to authorization bypass… |
CVE-2026-54719 | High | 7.5 | 2026-07-28 | goshs is a feature-rich single-binary file server for red teamers and developers. Prior to 2.1.1, the httpserver/updown.go bulkDownload handler for ?bulk&file=… |
CVE-2026-16184 | High | 7.0 | 2026-07-28 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication by sending a crafted unauthenticated request. |
CVE-2026-49258 | High | 8.8 | 2026-07-28 | Nebula Mesh is a self-hosted control plane for the Slack Nebula mesh VPN. In versions 0.3.5 and below, the web UI (/ui/*) does not apply the per-operator CA sc… |
CVE-2026-66751 | Medium | 5.4 | 2026-07-28 | Let's Chat 0.3.0 through 0.4.8 contains an improper authorization vulnerability that allows any authenticated user to archive any room on the server by sending… |
CVE-2026-66750 | Medium | 4.3 | 2026-07-28 | Let's Chat 0.3.0 through 0.4.8 contains a broken access control vulnerability that allows authenticated attackers to download file attachments from private and… |
CVE-2026-16774 | Medium | 5.3 | 2026-07-28 | The Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.5.9 via the wpcs_send_email() AJAX handler. This is… |
CVE-2026-15411 | Medium | 5.3 | 2026-07-28 | The StoreGrowth: Smart Sales Booster for WooCommerce | BOGO, Upsells, Direct Checkout, Quick View, Side Cart plugin for WordPress is vulnerable to authorizatio… |
CVE-2026-15025 | High | 7.5 | 2026-07-28 | The Uncanny Automator – Easy Automation, Integration, Webhooks & Workflow Builder plugin for WordPress is vulnerable to Missing Authorization in versions up to… |
CVE-2026-13110 | Medium | 5.3 | 2026-07-28 | The Storegrowth Sales Booster plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 2.1.0. This is due to a missing capab… |
CVE-2026-14168 | High | 8.8 | 2026-07-28 | A low privileged remote attacker can gain administrator privileges due to missing authorization at the insert path of the configuration table resulting in gain… |
CVE-2026-16587 | Medium | 4.3 | 2026-07-28 | The Advanced Form Integration — Connect Forms to 200+ Apps plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6… |
CVE-2026-14924 | High | 7.5 | 2026-07-28 | The Tablesome Table WordPress plugin before 1.1.31 does not perform any authentication, capability, or nonce checks in one of its AJAX actions, allowing unaut… |
CVE-2026-14821 | Low | 2.7 | 2026-07-28 | The Quiz and Survey Master (QSM) WordPress plugin before 11.1.5 does not perform a capability check before deleting output templates, allowing users with cont… |
CVE-2026-12124 | Medium | 5.3 | 2026-07-28 | The PDFDraft – Drag & Drop PDF Builder, PDF Viewer, Embed & Download PDF, Certificate & Invoice Designer plugin for WordPress is vulnerable to unauthorized acc… |
CVE-2026-66473 | High | 7.5 | 2026-07-27 | Unauthenticated Broken Access Control in Xendit Payment <= 7.1.0 versions. |
CVE-2026-65445 | Medium | 6.5 | 2026-07-27 | Unauthenticated Broken Access Control in Ad Invalid Click Protector (AICP) <= 1.3.0 versions. |
CVE-2026-64746 | Critical | 9.8 | 2026-07-27 | An authorization issue was addressed with improved validation. This issue is fixed in iOS 26.6 and iPadOS 26.6, macOS Tahoe 26.6, visionOS 26.6, watchOS 26.6… |
CVE-2026-43665 | Medium | 5.5 | 2026-07-27 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8. A local attacker may be able to… |
CVE-2026-65922 | High | 7.1 | 2026-07-27 | An authorization weakness in JFrog Artifactory internal metadata handling could allow a user with limited repository access to write to restricted internal met… |
CVE-2026-66477 | Medium | 5.3 | 2026-07-27 | Unauthenticated Broken Access Control in Gillion <= 4.13 versions. |
CVE-2026-66442 | Medium | 5.4 | 2026-07-27 | Subscriber Broken Access Control in YayPricing <= 3.5.6 versions. |
CVE-2026-65568 | Medium | 5.0 | 2026-07-27 | Contributor Broken Access Control in Visual Composer Website Builder <= 45.15.0 versions. |
CVE-2026-65567 | Medium | 5.3 | 2026-07-27 | Unauthenticated Broken Access Control in Event Tickets <= 5.29.0.1 versions. |
CVE-2026-65435 | Medium | 6.5 | 2026-07-27 | Unauthenticated Broken Access Control in Thrive Leads Version <= 10.9.2 versions. |
CVE-2026-65433 | Medium | 6.5 | 2026-07-27 | Subscriber Broken Access Control in RT Mega Menu – Mega Menu Builder for Elementor & Gutenberg <= 1.5.1 versions. |
CVE-2026-59560 | Medium | 6.5 | 2026-07-27 | Subscriber Broken Access Control in FundEngine <= 1.7.8 versions. |
CVE-2026-59557 | Medium | 6.5 | 2026-07-27 | Unauthenticated Broken Access Control in Events Made Easy <= 3.1.3 versions. |
CVE-2026-59536 | High | 7.5 | 2026-07-27 | Unauthenticated Broken Access Control in CoCart – Headless ecommerce <= 4.8.4 versions. |
CVE-2026-59535 | High | 7.3 | 2026-07-27 | Unauthenticated Broken Access Control in Thrive Product Manager <= 10.9.2 versions. |
CVE-2026-59534 | High | 7.5 | 2026-07-27 | Unauthenticated Broken Access Control in Post My CF7 Form <= 6.2.0 versions. |
CVE-2026-59530 | High | 7.5 | 2026-07-27 | Unauthenticated Broken Access Control in Stripe For WooCommerce <= 4.0.7 versions. |
CVE-2026-59529 | High | 7.5 | 2026-07-27 | Unauthenticated Sensitive Data Exposure in Ebook Store <= 6.19 versions. |
CVE-2026-59690 | High | 8.0 | 2026-07-27 | A Missing Authorization vulnerability in Progress Software LoadMaster, ECS Connection Manager, Object Scale Connection Manager, MOVEit WAF, and Multi Tenant al… |
CVE-2026-13390 | Medium | 5.3 | 2026-07-27 | The Events Calendar WordPress plugin before 6.16.5.1 does not perform an authorization check on one of its Event Aggregator import REST API routes and skips an… |
CVE-2026-66012 | Critical | 10.0 | 2026-07-25 | SiYuan before v3.7.2 contains a missing authorization vulnerability in the POST /mcp kernel endpoint, which is gated only by a general auth check (model.CheckA… |
CVE-2026-66027 | High | 8.3 | 2026-07-24 | Suna before 0.9.102 contains a broken access control vulnerability in the message queue API that allows authenticated attackers to access and manipulate queue… |
CVE-2026-49326 | Medium | 6.5 | 2026-07-24 | Missing Authorization vulnerability in Apache HBase thrift and rest delegation service. A scan operation in thrift/rest service has 3 steps, open, fetch(possi… |
CVE-2026-16799 | Medium | 5.0 | 2026-07-24 | Improper access control in the automation tests and workflows features in Devolutions PowerShell Universal 2026.2.2 and earlier allows an authenticated user wi… |
CVE-2026-10033 | High | 7.3 | 2026-07-24 | The EventON Action User plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.5.14. This is due to the plugin not… |
CVE-2026-12654 | Medium | 5.3 | 2026-07-24 | The Payment Plugins for Stripe WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.0.7. This is due… |
CVE-2026-12690 | Low | 3.8 | 2026-07-24 | The ProfileGrid WordPress plugin before 5.9.9.7 does not perform a capability check on its license management actions, relying only on a nonce that is exposed… |
CVE-2026-12689 | Medium | 5.4 | 2026-07-24 | The ProfileGrid WordPress plugin before 5.9.9.7 does not perform any authorization or ownership check on some of its private-message thread actions, allowing… |
CVE-2026-11354 | Medium | 5.3 | 2026-07-24 | The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' param… |
CVE-2026-58275 | Critical | 10.0 | 2026-07-24 | Missing authorization in Azure DNS allows an unauthorized attacker to elevate privileges over a network. |
CVE-2026-47724 | Critical | 9.9 | 2026-07-23 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh virtual private network. Prior to version 0.3.4, the `/api/v1/*` route surface trusts the bear… |
CVE-2026-47755 | Medium | 6.5 | 2026-07-23 | ITFlow provides an IT documentation, ticketing and accounting system for small managed service providers. Prior to version 26.05, low-privileged authenticated… |
CVE-2026-65916 | High | 8.1 | 2026-07-23 | CyberPanel through 1.9.1, fixed in commit b198460, contains a missing authorization vulnerability in the cancelBackupCreation handler that allows authenticated… |
CVE-2026-65895 | High | 8.5 | 2026-07-23 | Grav API Plugin versions before 1.0.10 fail to restrict write access to security-critical plugin configuration scopes, allowing authenticated users with api.co… |
CVE-2026-65537 | Medium | 4.3 | 2026-07-23 | Subscriber Broken Access Control in Cyr to Lat reloaded – transliteration of links and file names <= 1.3.3 versions. |
CVE-2026-65531 | Medium | 4.8 | 2026-07-23 | Unauthenticated Broken Access Control in Qubely <= 1.8.14 versions. |
CVE-2026-65530 | Medium | 4.3 | 2026-07-23 | Subscriber Broken Access Control in TemplateSpare <= 4.2.2 versions. |
CVE-2026-65529 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in Graphina <= 3.1.12 versions. |
CVE-2026-65525 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in Civi Framework <= 2.2.0 versions. |
CVE-2026-65524 | Medium | 4.3 | 2026-07-23 | Contributor Broken Access Control in Avada Custom Branding <= 1.2 versions. |
CVE-2026-65506 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in MP3 Audio Player for Music, Radio & Podcast by Sonaar <= 5.12 versions. |
CVE-2026-65500 | High | 7.5 | 2026-07-23 | Unauthenticated Broken Access Control in Manual - Documentation, Knowledge Base & Education WordPress Theme <= 7.5.4 versions. |
CVE-2026-65499 | Medium | 6.5 | 2026-07-23 | Unauthenticated Broken Access Control in PeproDev Ultimate Invoice <= 2.2.6 versions. |
CVE-2026-65495 | High | 7.5 | 2026-07-23 | Unauthenticated Broken Access Control in Dokan Pro <= 5.0.3 versions. |
CVE-2026-65491 | Medium | 4.3 | 2026-07-23 | Subscriber Broken Access Control in Query Wrangler <= 1.5.57 versions. |