CWE-862 · Missing Authorization (page 4)
Page 4 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-61550 | Critical | 9.8 | 2026-09-18 | Icinga 2 is an open source monitoring system. From 2.8 until 2.14.9, 2.15.4, and 2.16.2, certificate update JSON-RPC message handling does not validate that th… |
CVE-2026-93737 | Medium | 6.5 | 2026-09-18 | Azkaban through 4.0.0 omits project permission checks in the ScheduleServlet fetchSchedule action, allowing authenticated users to read any project's schedule… |
CVE-2026-93531 | Medium | 4.3 | 2026-09-18 | A weakness has been identified in gedelumbung HospitalManagement up to c2d45543789a3887067d3915f69d44cfc2cf76a8. This vulnerability affects unknown code. This… |
CVE-2026-93596 | Medium | 4.3 | 2026-09-18 | ArcadeDB before 26.9.1 (com.arcadedb:arcadedb-engine <= 26.8.1) fails to bind the authenticated principal onto the DatabaseAsyncTransaction async worker thread… |
CVE-2026-93595 | Medium | 6.5 | 2026-09-18 | ArcadeDB before 26.9.1 contains an access control bypass vulnerability in the query_database tool exposed through the AI chat endpoints. The tool executes quer… |
CVE-2026-85410 | High | 8.1 | 2026-09-18 | The Master Addons for Elementor – Elementor Addons, Widgets, Mega Menu Builder, Popup Builder, Widget Builder & Template Kits plugin for WordPress is vulnerabl… |
CVE-2026-12739 | Medium | 4.3 | 2026-09-18 | The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-91707 | Medium | 5.3 | 2026-09-18 | The The Divi theme for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.11.1. This is due to the software allow… |
CVE-2026-89413 | High | 8.1 | 2026-09-18 | The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not proper… |
CVE-2026-89138 | Medium | 4.3 | 2026-09-18 | The Filter Gallery plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.4. This is due to the plugin not proper… |
CVE-2026-75017 | Medium | 4.3 | 2026-09-18 | The Magazine Blocks – Blog Designer, Magazine & Newspaper Website Builder, Page Builder with Posts Blocks, Post Grid plugin for WordPress is vulnerable to auth… |
CVE-2026-18317 | Medium | 4.3 | 2026-09-18 | The Foxtool All-in-One: Contact chat button, Custom login, Media optimize images plugin for WordPress is vulnerable to authorization bypass in all versions up… |
CVE-2026-89007 | Low | 2.7 | 2026-09-18 | The Bookit — Booking & Appointment Calendar WordPress plugin before 2.6.0.5 does not perform a capability check in one of its appointment-deletion functions, a… |
CVE-2026-84904 | Low | 3.8 | 2026-09-18 | The King Addons for Elementor WordPress plugin before 51.1.81 does not perform per-object authorization checks on a group of image-optimization actions, gatin… |
CVE-2026-93455 | Medium | 6.5 | 2026-09-18 | django-page-cms through 2.0.13 fails to properly validate page permissions in admin helper views, allowing any staff account to read arbitrary page content and… |
CVE-2026-54671 | High | 8.8 | 2026-09-17 | WeGIA is a web manager for charitable institutions. Prior to 3.8.5, WeGIA maps InternoControle to an empty resource array in web/controle/control.php, and veri… |
CVE-2026-54648 | Medium | 6.5 | 2026-09-17 | CubeCart is an ecommerce software solution. Prior to 6.7.5, the GDPR tools in admin/sources/customers.gdpr.inc.php rely on page-level CC_PERM_READ access and d… |
CVE-2026-54643 | Medium | 5.4 | 2026-09-17 | CubeCart is an ecommerce software solution. Prior to 6.7.5, the delete-note handler in admin/sources/orders.index.inc.php verifies only the presence of order_i… |
CVE-2026-54608 | | 2026-09-17 | MythicalDash is a Pterodactyl client area. In 3.5.4-aurora and earlier, GET /api/stripe/process in backend/app/Api/System/Gateways/Stripe.php creates a pending… | |
CVE-2026-54519 | High | 8.8 | 2026-09-17 | AI Agent Automation is a modular AI agent workflow automation platform with schedulers, tools, and observability. Prior to 0.9.1, backend/src/controllers/memor… |
CVE-2026-16750 | Medium | 5.3 | 2026-09-17 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to unauthorized access of data due to missing authorization checks… |
CVE-2026-16582 | Medium | 5.3 | 2026-09-17 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized modification of data in all versions up to, and in… |
CVE-2026-14311 | Medium | 5.4 | 2026-09-17 | The Booking for Appointments and Events Calendar – Amelia plugin for WordPress is vulnerable to unauthorized access and modification of data due to a missing o… |
CVE-2026-93378 | Low | 3.1 | 2026-09-17 | Missing authorization in Storage in Google Chrome prior to 153.0.8010.52 allowed a remote attacker who had compromised the renderer process to bypass site isol… |
CVE-2026-54237 | | 2026-09-17 | Wavelog is web-based amateur radio logging software. From 1.8 until 2.4.2, Wavelog exposes /install/ajax.php and /install/includes/interface_assets/triggers.ph… | |
CVE-2026-92992 | Medium | 6.3 | 2026-09-17 | A security vulnerability has been detected in Dromara mayfly-go up to 1.11.5. The affected element is an unknown function of the file server/internal/ai/api/ai… |
CVE-2026-49292 | Unrated | | 2026-09-17 | Kiwi TCMS is an open source test management system. Prior to 16.0, the unauthenticated /init-db/ page handled by InitDBView in tcms/core/views.py remains reach… |
CVE-2026-54677 | Medium | 6.5 | 2026-09-17 | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, authenticated users who are not members of a private space can create content in q… |
CVE-2026-54676 | Medium | 6.5 | 2026-09-17 | Scoold is a Q&A and a knowledge sharing platform for teams. Prior to 1.69.0, users with personal API tokens can retrieve replies from questions in private spac… |
CVE-2026-69197 | | 2026-09-17 | Umbraco is an ASP.NET CMS. Prior to 13.15.1, 17.5.3, and 18.0.2, the Content Delivery API applies member and Public Access checks to the directly requested nod… | |
CVE-2026-78528 | Medium | 5.3 | 2026-09-17 | Unauthenticated Broken Access Control in BerqWP <= 4.1.15 versions. |
CVE-2026-74017 | Medium | 5.3 | 2026-09-17 | Unauthenticated Broken Access Control in User Registration <= 5.2.7 versions. |
CVE-2026-74002 | Medium | 5.3 | 2026-09-17 | Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions. |
CVE-2026-74000 | Medium | 5.3 | 2026-09-17 | Contributor Broken Access Control in Simple Membership <= 4.8.2 versions. |
CVE-2026-66676 | Medium | 5.3 | 2026-09-17 | Unauthenticated Broken Access Control in Easy Invoice <= 2.3.8 versions. |
CVE-2026-87831 | Medium | 4.3 | 2026-09-17 | The Checkout Field Manager (Checkout Manager) for WooCommerce WordPress plugin before 7.9.7 does not properly validate the ownership of an attachment before de… |
CVE-2026-91015 | Medium | 5.3 | 2026-09-17 | The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder po… |
CVE-2026-91010 | Medium | 4.3 | 2026-09-17 | The Invisible Anti-Spam & CAPTCHA — reCAPTCHA Alternative for All Forms WordPress plugin before 5.1.1 does not check the user's capabilities in its message del… |
CVE-2026-91009 | Medium | 4.3 | 2026-09-17 | The Active Woot Products Tables for WooCommerce. 100% FREE WordPress plugin before 2.1.3 does not have authorisation and CSRF checks in some of its AJAX actio… |
CVE-2026-61596 | High | 7.1 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, djust's per-object autho… |
CVE-2026-92589 | Medium | 4.3 | 2026-09-16 | Craft CMS 5.0.0 through 5.10.12 (fixed in 5.10.13) contains a broken access control flaw in the nested-elements reorder endpoint. When an authenticated control… |
CVE-2026-92586 | Medium | 4.3 | 2026-09-16 | AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to verify video access permissions in the set_api_comment function, allowing authen… |
CVE-2026-92585 | Medium | 4.3 | 2026-09-16 | AVideo through 29.0 (commit c3edcc274c389816d434acadac07ee78eaf330c1) fails to validate video access permissions in the API like endpoint, allowing logged-in u… |
CVE-2026-61594 | Critical | 9.1 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, the live (WebSocket) tra… |
CVE-2026-61592 | High | 7.4 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, SSE sessions were keyed… |
CVE-2026-92803 | Medium | 5.3 | 2026-09-16 | LibreTranslate through 1.9.6 omits the access_check decorator from the download_file route, allowing unauthenticated access to translated files. Attackers can… |
CVE-2026-92802 | Medium | 4.3 | 2026-09-16 | kan through 0.6.0 fails to properly validate board creation permissions in the GitHub project import endpoint, allowing guests to create boards despite lacking… |
CVE-2026-92794 | High | 7.5 | 2026-09-16 | OpenSign through 2.41.3 fails to validate caller identity in the getDocument cloud function when one-time-password verification is disabled. Attackers can supp… |
CVE-2026-92783 | High | 8.1 | 2026-09-16 | Yeti through 2.11.0 fails to validate caller permissions in the DELETE /api/v2/rbac/{id} endpoint, allowing users with read access to delete access control rel… |
CVE-2026-92780 | High | 8.8 | 2026-09-16 | KnowStreaming through 3.4.1 fails to enforce role-based access control on REST API endpoints, allowing any authenticated user to access protected functionality… |
CVE-2026-92772 | High | 7.1 | 2026-09-16 | Leantime before 3.9.6 contains an authorization bypass vulnerability in the HTMX plugin install endpoint that lacks permission validation. Authenticated users… |
CVE-2026-92763 | High | 8.1 | 2026-09-16 | Rundeck through 6.2.1 fails to properly authorize the importConfig and importNodesSources parameters in the project archive import endpoint. Attackers with onl… |
CVE-2026-92762 | High | 8.8 | 2026-09-16 | Pelican Panel versions before 1.0.0-beta35 enforce startup write permissions only through disabled form controls rather than server-side authorization checks… |
CVE-2026-92761 | High | 8.8 | 2026-09-16 | WebVirtCloud fails to properly validate permission flags in UserInstance grants, allowing view-only users to perform privileged actions. Attackers with read-on… |
CVE-2026-92754 | Medium | 4.3 | 2026-09-16 | PatrowlManager through 1.8.4 contains an improper access control vulnerability in the user listing API endpoint where the authorization decorator is commented… |
CVE-2026-92753 | High | 7.1 | 2026-09-16 | PatrowlManager through 1.8.4 contains an authorization bypass vulnerability in the events and alerts API endpoints that lack ownership filtering. Authenticated… |
CVE-2026-92750 | Medium | 6.5 | 2026-09-16 | Harness through 3.3.0 omits access control validation in the infrastructure provider read endpoint, allowing authenticated users to retrieve provider configura… |
CVE-2026-87026 | Low | 3.8 | 2026-09-16 | Tanium addressed an improper access controls vulnerability in Threat Response. |
CVE-2026-86089 | High | 7.1 | 2026-09-16 | Apache NiFi 2.11.0 supports migrating the contents of a version-controlled Process Group into a Connector using REST API methods that list eligible migration s… |
CVE-2026-82561 | Medium | 6.5 | 2026-09-16 | Apache NiFi 1.5.0 through 2.11.0 provide REST API methods that replace the entire contents of a Process Group using a client-supplied flow definition, covering… |
CVE-2026-81866 | Medium | 4.3 | 2026-09-16 | Apache NiFi 2.9.0 through 2.11.0 provide Connector configuration update and verification REST API methods that do not enforce authorization checking on Assets… |
CVE-2026-20324 | Critical | 9.9 | 2026-09-16 | A vulnerability in the sftunnel inter-device communication protocol of Cisco Secure Firewall Management Center (FMC) Software could allow an authenticated, rem… |
CVE-2026-92729 | High | 8.2 | 2026-09-16 | SigNoz versions 0.88.0 through 0.141.0 fail to apply authorization wrappers to trace-funnel analytics endpoints in the HTTP handler. Unauthenticated attackers… |
CVE-2026-18120 | Medium | 5.9 | 2026-09-16 | Concrete CMS before 9.5.3 exposed a legacy Express entry search endpoint that returned entry result JSON without invoking the canViewExpressEntries() permissio… |
CVE-2026-92601 | Medium | 6.5 | 2026-09-16 | Guns through 8.3.5 contains an improper access control vulnerability in SysNoticeController where requiredPermission defaults to false and is not overridden by… |
CVE-2026-92600 | Medium | 6.5 | 2026-09-16 | Guns through 8.3.5 contains an information disclosure vulnerability in SysUserController where /sysUser/detail and /sysUser/page endpoints omit requiredPermiss… |
CVE-2026-92402 | Medium | 6.3 | 2026-09-16 | A security flaw has been discovered in ChangeWeDer crm up to c07bd4c97141521af6475034bc58523beed51bbd. This issue affects the function index of the file UserCo… |
CVE-2026-87031 | Low | 2.7 | 2026-09-16 | n Concrete CMS 9.2.0 through 9.5.3, the REST API user creation endpoint (POST /ccm/api/1.0/users, the add() method of concrete/src/Api/Controller/Users.php) di… |
CVE-2026-87028 | Medium | 6.5 | 2026-09-16 | Concrete CMS 9 through 9.5.3 did not confirm that a board InstanceItem submitted to the custom-slot preview endpoint belonged to the board instance the request… |
CVE-2026-61595 | High | 7.7 | 2026-09-16 | djust provides Phoenix LiveView-style reactive server-side rendering for Django with Rust-powered performance. Prior to version 1.0.7, `djust.tenants` isolatio… |
CVE-2026-17526 | High | 7.2 | 2026-09-16 | Keycloak is an open-source identity and access management solution. A vulnerability was discovered where a user with the impersonation role can impersonate a r… |
CVE-2026-92570 | Medium | 6.5 | 2026-09-16 | reNgine through 2.2.0 contains an authorization bypass vulnerability in the GetFileContents API endpoint that allows any authenticated user to read bundled rec… |
CVE-2026-92383 | Medium | 4.3 | 2026-09-16 | A security vulnerability has been detected in PbootCMS up to 3.2.24. This vulnerability affects the function UserController::del/UserController::mod of the fil… |
CVE-2026-82964 | High | 8.8 | 2026-09-16 | Improper preservation of permissions in the Avast sandbox minifilter driver (aswSnx.sys) on Windows allows a local, low-privileged attacker executing inside th… |
CVE-2026-74909 | High | 8.1 | 2026-09-16 | Keycloak provides a policy enforcer to protect applications by matching incoming web requests against defined security policies. A flaw was found where the enf… |
CVE-2026-92466 | High | 8.8 | 2026-09-16 | zlt2000 microservices-platform through 6.0.0 contains a missing authorization vulnerability where the zlt.security.auth.urlPermission.enable flag defaults to f… |
CVE-2026-89030 | Medium | 4.3 | 2026-09-16 | Adenion Blog2Social plugin for WordPress before 9.1.0 exposes the email addresses of all registered WordPress users to low-privileged accounts. The b2s_search_… |
CVE-2026-92463 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 contains an authorization failure in the GET /admin-api/system/user/page endpoint where the @PreAuthorize annotation is commented out… |
CVE-2026-92462 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 fails to enforce authorization checks on the CrmFlowController deleteFlowStep endpoint, allowing any authenticated back-office user to… |
CVE-2026-92461 | Medium | 4.3 | 2026-09-16 | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the GET /admin-api/crm/flow/flow-users endpoint that allows any logged-in back-office… |
CVE-2026-92460 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 fails to enforce authorization on the GET /admin-api/crm/operatelog/page endpoint, allowing any authenticated back-office user to acces… |
CVE-2026-92459 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmCluesController receiveCustomer endpoint that allows authenticated back-office… |
CVE-2026-92458 | Medium | 4.3 | 2026-09-16 | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the StoreProductController onSale handler that allows authenticated back-office users… |
CVE-2026-92457 | Medium | 6.5 | 2026-09-16 | yshop-crm through 2.1.3 contains a missing authorization vulnerability in the CrmInvoiceController issueInvoice endpoint that allows authenticated back-office… |
CVE-2026-92456 | High | 7.1 | 2026-09-16 | yshop-crm through 2.1.3 fails to enforce authorization on the saveRedisSet and getRedisSet endpoints in CrmCustomerController, allowing any authenticated back-… |
CVE-2026-92455 | Medium | 4.3 | 2026-09-16 | yshop-crm through 2.1.3 fails to enforce authorization on the sendSms and sendMail endpoints in CrmCustomerController, allowing any authenticated back-office u… |
CVE-2026-79993 | High | 7.5 | 2026-09-16 | The `deleteContainer` opcode (0x14/20) is processed without verifying the caller's ACL permissions, allowing any authenticated client to delete specific znodes… |
CVE-2026-59739 | High | 7.5 | 2026-09-16 | Information disclosure via SetWatches reconnect replay in Apache ZooKeeper due to missing ACL check. An attacker can discover ACL-restricted paths by registeri… |
CVE-2026-8030 | Medium | 4.3 | 2026-09-16 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.0 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain co… |
CVE-2026-7514 | Medium | 4.3 | 2026-09-16 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 13.9 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that an authenticated… |
CVE-2026-16794 | Medium | 4.3 | 2026-09-16 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.11 before 19.1.8, 19.2 before 19.2.6, and 19.3 before 19.3.2 that under certain cond… |
CVE-2026-87860 | Medium | 4.3 | 2026-09-16 | The Subscriptions for WooCommerce WordPress plugin before 2.0.3 does not verify the security token on the request that cancels a subscription, allowing attacke… |
CVE-2026-84907 | Low | 3.7 | 2026-09-16 | The Eventin WordPress plugin before 4.1.24 does not properly authorise order finalisation when its offline (local) payment method is enabled, relying on a non… |
CVE-2026-84905 | Low | 2.7 | 2026-09-16 | The Eventin WordPress plugin before 4.1.24 does not verify a user's capability to create accounts when adding a speaker, allowing users with contributor-level… |
CVE-2026-77702 | Medium | 5.3 | 2026-09-16 | The Eventin WordPress plugin before 4.1.24 does not prevent the token issued to a guest at checkout from being used to change that order's tickets afterwards… |
CVE-2026-74926 | High | 7.1 | 2026-09-16 | The MultiVendorX WordPress plugin before 5.0.16 does not verify that a user owns the store they are acting on in one of its REST API routes, allowing any auth… |
CVE-2026-14349 | Critical | 9.8 | 2026-09-16 | The TrueBooker – Appointment Booking and Scheduler System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2… |
CVE-2026-11984 | Medium | 5.3 | 2026-09-16 | The Ad Inserter – Ad Manager & AdSense Ads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.8.16 due to a mis… |
CVE-2026-92299 | High | 7.4 | 2026-09-16 | @jitsi/electron-sdk before 10.0.5 exposes getDesktopSources() via contextBridge without requiring an active getDisplayMedia() picker, allowing any script in th… |
CVE-2026-82567 | Medium | 6.3 | 2026-09-15 | The myPRO Manager notification gateway exposes an unauthenticated HTTP endpoint used to send SMS messages through a connected GSM modem. The endpoint is access… |