CWE-862 · Missing Authorization (page 48)
Page 48 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-39541 | Medium | 6.5 | 2025-09-09 | Missing Authorization vulnerability in Roland Murg WP Simple Booking Calendar wp-simple-booking-calendar.This issue affects WP Simple Booking Calendar: from n/… |
CVE-2025-32688 | Medium | 5.4 | 2025-09-09 | Missing Authorization vulnerability in Nebojsa Target Video Easy Publish brid-video-easy-publish.This issue affects Target Video Easy Publish: from n/a through… |
CVE-2025-8712 | Medium | 5.4 | 2025-09-09 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 22.8R2.3-723 and Ivan… |
CVE-2025-55148 | High | 7.6 | 2025-09-09 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivant… |
CVE-2025-55145 | High | 8.9 | 2025-09-09 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivan… |
CVE-2025-55144 | Medium | 5.4 | 2025-09-09 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivant… |
CVE-2025-55142 | High | 8.8 | 2025-09-09 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivant… |
CVE-2025-55141 | High | 8.8 | 2025-09-09 | Missing authorization in Ivanti Connect Secure before 22.7R2.9 or 22.8R2, Ivanti Policy Secure before 22.7R1.6, Ivanti ZTA Gateway before 2.8R2.3-723 and Ivant… |
CVE-2025-59017 | High | 8.8 | 2025-09-09 | Missing authorization checks in the Backend Routing of TYPO3 CMS versions 9.0.0‑9.5.54, 10.0.0‑10.4.53, 11.0.0‑11.5.47, 12.0.0‑12.4.36, and 13.0.0‑13.4.17 allo… |
CVE-2025-9542 | Medium | 5.4 | 2025-09-09 | The AutomatorWP – Automator plugin for no-code automations, webhooks & custom integrations in WordPress plugin for WordPress is vulnerable to unauthorized acce… |
CVE-2025-42918 | Medium | 4.3 | 2025-09-09 | SAP NetWeaver Application Server for ABAP allows authenticated users with access to background processing to gain unauthorized read access to profile parameter… |
CVE-2025-42917 | Medium | 6.5 | 2025-09-09 | SAP HCM Approve Timesheets Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileg… |
CVE-2025-42915 | Medium | 5.4 | 2025-09-09 | Fiori app Manage Payment Blocks does not perform the necessary authorization checks, allowing an attacker with basic user privileges to abuse functionalities t… |
CVE-2025-42914 | Low | 3.1 | 2025-09-09 | Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate pri… |
CVE-2025-42913 | Low | 3.1 | 2025-09-09 | Due to missing authorization checks, SAP HCM My Timesheet Fiori 2.0 application allows an authenticated attacker with in-depth system knowledge to escalate pri… |
CVE-2025-42912 | Medium | 6.5 | 2025-09-09 | SAP HCM My Timesheet Fiori 2.0 application does not perform necessary authorization checks for an authenticated user, resulting in escalation of privileges. Th… |
CVE-2025-42911 | Medium | 5.0 | 2025-09-09 | SAP NetWeaver (Service Data Download) allows an authenticated user to call a remote-enabled function module, which could grant access to information about the… |
CVE-2025-57817 | High | 7.2 | 2025-09-08 | Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the OAuth client creation and update endpoints of the Fides Webserver API do not… |
CVE-2024-36326 | High | 8.4 | 2025-09-06 | Missing authorization in AMD RomArmor could allow an attacker to bypass ROMArmor protections during system resume from a standby state, potentially resulting i… |
CVE-2025-7040 | High | 8.2 | 2025-09-06 | The Cloud SAML SSO plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'set_organization_settings'… |
CVE-2025-54744 | Medium | 6.5 | 2025-09-05 | Missing Authorization vulnerability in Stylemix MasterStudy LMS masterstudy-lms-learning-management-system allows Exploiting Incorrectly Configured Access Cont… |
CVE-2025-53571 | Medium | 6.5 | 2025-09-05 | Missing Authorization vulnerability in VillaTheme HAPPY happy-helpdesk-support-ticket-system allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2024-0028 | Medium | 5.5 | 2025-09-05 | In Audio Service, there is a possible way to obtain MAC addresses of nearby Bluetooth devices due to a missing permission check. This could lead to local escal… |
CVE-2025-58824 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in priyanshumittal Shk Corporate shk-corporate allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-58817 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in desertthemes SoftMe softme allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects So… |
CVE-2025-58816 | Low | 3.5 | 2025-09-05 | Missing Authorization vulnerability in Plugin Devs Product Carousel Slider for Elementor ecommerce-product-carousel-slider-for-elementor allows Exploiting Inco… |
CVE-2025-58813 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in themearile Consultstreet consultstreet allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2025-58795 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in Payoneer Checkout Payoneer Checkout payoneer-checkout allows Content Spoofing.This issue affects Payoneer Checkout: from… |
CVE-2025-58785 | Medium | 5.4 | 2025-09-05 | Missing Authorization vulnerability in Jiro Sasamoto Ray Enterprise Translation lingotek-translation allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-58783 | Medium | 4.3 | 2025-09-05 | Missing Authorization vulnerability in gutentor Gutentor gutentor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Gu… |
CVE-2025-8944 | Medium | 4.3 | 2025-09-05 | The OceanWP WordPress theme before 4.1.2 is vulnerable to an option update due to a missing capability check on one of its AJAX request handler, allowing any a… |
CVE-2025-22414 | High | 7.8 | 2025-09-04 | In FrpBypassAlertActivity of FrpBypassAlertActivity.java, there is a possible way to bypass FRP due to a missing permission check. This could lead to local esc… |
CVE-2025-48549 | High | 7.8 | 2025-09-04 | In multiple locations, there is a possible way to record audio via a background app due to a missing permission check. This could lead to local escalation of p… |
CVE-2025-48547 | High | 7.3 | 2025-09-04 | In multiple locations, there is a possible one-time permission bypass due to a logic error in the code. This could lead to local escalation of privilege with n… |
CVE-2025-48524 | Medium | 5.5 | 2025-09-04 | In isSystem of WifiPermissionsUtil.java, there is a possible permission bypass due to a missing permission check. This could lead to local denial of service wi… |
CVE-2025-0076 | Low | 3.3 | 2025-09-04 | In multiple locations, there is a possible way to view icons belonging to another user due to a missing permission check. This could lead to local information… |
CVE-2025-26450 | High | 7.8 | 2025-09-04 | In onInputEvent of IInputMethodSessionWrapper.java, there is a possible way for an untrusted app to inject key and motion events to the default IME due to a mi… |
CVE-2025-26445 | Medium | 5.5 | 2025-09-04 | In offerNetwork of ConnectivityService.java, there is a possible leak of sensitive data due to a missing permission check. This could lead to local information… |
CVE-2025-26440 | High | 7.8 | 2025-09-04 | In multiple functions of CameraService.cpp, there is a possible way to use the camera from the background due to a permissions bypass. This could lead to local… |
CVE-2025-26437 | Medium | 5.5 | 2025-09-04 | In CredentialManagerServiceStub of CredentialManagerService.java, there is a possible way to retrieve candidate credentials due to a missing permission check… |
CVE-2025-8268 | Medium | 6.5 | 2025-09-03 | The AI Engine plugin for WordPress is vulnerable to unauthorized access and loss of data due to a missing capability check on the rest_list and delete_files fu… |
CVE-2025-58639 | Medium | 5.4 | 2025-09-03 | Missing Authorization vulnerability in Ali Khallad Contact Form By Mega Forms mega-forms allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-58635 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in DevItems Support Genix support-genix-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-58634 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in peachpay PeachPay Payments peachpay-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-58622 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in yydevelopment Mobile Contact Line mobile-contact-line allows Exploiting Incorrectly Configured Access Control Security L… |
CVE-2025-58617 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in FAKTOR VIER F4 Media Taxonomies f4-media-taxonomies allows Exploiting Incorrectly Configured Access Control Security Lev… |
CVE-2025-58616 | Medium | 6.5 | 2025-09-03 | Missing Authorization vulnerability in Frisbii Frisbii Pay reepay-checkout-gateway allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-58613 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in Barn2 Plugins Posts Table with Search & Sort posts-data-table allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2025-58606 | Medium | 5.0 | 2025-09-03 | Missing Authorization vulnerability in cozythemes SaasLauncher saaslauncher allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-58603 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in Surfer Surfer surferseo allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Surfe… |
CVE-2025-58601 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in RadiusTheme Classified Listing classified-listing allows Exploiting Incorrectly Configured Access Control Security Level… |
CVE-2025-58600 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in Cozmoslabs Paid Member Subscriptions paid-member-subscriptions allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-58599 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in tychesoftwares Order Delivery Date for WooCommerce order-delivery-date-for-woocommerce allows Exploiting Incorrectly Con… |
CVE-2025-58594 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in themefusecom Brizy brizy allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Briz… |
CVE-2025-58460 | Medium | 4.2 | 2025-09-03 | A missing permission check in Jenkins OpenTelemetry Plugin 3.1543.v8446b_92b_cd64 and earlier allows attackers with Overall/Read permission to connect to an at… |
CVE-2025-3701 | Medium | 4.3 | 2025-09-03 | Missing Authorization vulnerability in Malcure Web Security Malcure Malware Scanner wp-malware-removal allows Exploiting Incorrectly Configured Access Control… |
CVE-2025-9219 | Medium | 4.3 | 2025-09-03 | The Post SMTP – WP SMTP Plugin with Email Logs and Mobile App for Failure Notifications – Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES and more plugin fo… |
CVE-2025-58210 | Medium | 5.3 | 2025-09-03 | Missing Authorization vulnerability in ThemeMove Makeaholic makeaholic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affec… |
CVE-2025-22439 | High | 7.3 | 2025-09-02 | In onLastAccessedStackLoaded of ActionHandler.java , there is a possible way to bypass storage restrictions across apps due to a missing permission check. This… |
CVE-2025-6685 | High | 8.8 | 2025-09-02 | ATEN eco DC Missing Authorization Privilege Escalation Vulnerability. This vulnerability allows remote attackers to escalate privileges on affected installatio… |
CVE-2025-9747 | Medium | 4.3 | 2025-08-31 | A vulnerability has been found in Koillection up to 1.6.18. Affected is an unknown function of the file assets/controllers/csrf_protection_controller.js. Such… |
CVE-2024-32832 | Critical | 9.8 | 2025-08-31 | Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a throug… |
CVE-2024-32589 | High | 7.1 | 2025-08-31 | Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-prod… |
CVE-2025-54943 | Critical | 9.8 | 2025-08-30 | A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application d… |
CVE-2025-43773 | Critical | 9.1 | 2025-08-29 | Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 20… |
CVE-2025-58334 | High | 8.1 | 2025-08-28 | In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves |
CVE-2025-54734 | Medium | 5.8 | 2025-08-28 | Missing Authorization vulnerability in bPlugins B Slider b-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B… |
CVE-2025-54733 | Medium | 6.5 | 2025-08-28 | Missing Authorization vulnerability in all_bootstrap_blocks All Bootstrap Blocks all-bootstrap-blocks allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-54714 | High | 7.1 | 2025-08-28 | Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Securi… |
CVE-2025-54710 | High | 7.1 | 2025-08-28 | Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Ti… |
CVE-2025-53337 | Medium | 5.4 | 2025-08-28 | Missing Authorization vulnerability in Ashan Perera LifePress lifepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affe… |
CVE-2025-53230 | High | 7.6 | 2025-08-28 | Missing Authorization vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2025-48350 | Medium | 4.3 | 2025-08-28 | Missing Authorization vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Exploiting Incorrectly Configured Access Control Security… |
CVE-2025-48327 | Medium | 5.3 | 2025-08-28 | Missing Authorization vulnerability in inkthemes WP Mailgun SMTP wp-mailgun-smtp allows Accessing Functionality Not Properly Constrained by ACLs.This issue aff… |
CVE-2025-7956 | Medium | 5.3 | 2025-08-28 | The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions u… |
CVE-2025-0951 | Medium | 4.3 | 2025-08-28 | Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpr… |
CVE-2025-2246 | Medium | 5.8 | 2025-08-27 | An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have allowed unauthent… |
CVE-2025-58201 | Medium | 5.3 | 2025-08-27 | Missing Authorization vulnerability in AfterShip & Automizely AfterShip Tracking aftership-woocommerce-tracking allows Accessing Functionality Not Properly Con… |
CVE-2025-58198 | Medium | 6.5 | 2025-08-27 | Missing Authorization vulnerability in Xpro Xpro Theme Builder xpro-theme-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-58193 | Medium | 4.3 | 2025-08-27 | Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-58192 | Medium | 4.3 | 2025-08-27 | Missing Authorization vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Exploiting Incorrectly Configured Access Control Security Levels.This… |
CVE-2025-0086 | Medium | 6.2 | 2025-08-26 | In onResult of AccountManagerService.java, there is a possible way to overwrite auth token due to a missing permission check. This could lead to local informat… |
CVE-2025-48108 | Medium | 6.5 | 2025-08-26 | Missing Authorization vulnerability in Mojoomla School Management allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sc… |
CVE-2024-8860 | Medium | 4.3 | 2025-08-26 | The Tourfic plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tf_order_status_email_resend_funct… |
CVE-2025-7828 | Medium | 4.3 | 2025-08-23 | The WP Filter & Combine RSS Feeds plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the post_listing… |
CVE-2025-7827 | Medium | 4.3 | 2025-08-23 | The Ni WooCommerce Customer Product Report plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ni_… |
CVE-2025-7821 | Medium | 5.3 | 2025-08-23 | The WC Plus plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'pluswc_logo_favicon_logo_base' AJ… |
CVE-2025-55741 | High | 8.1 | 2025-08-22 | UnoPim is an open-source Product Information Management (PIM) system built on the Laravel framework. In versions 0.3.0 and earlier, users without the Delete pr… |
CVE-2025-9331 | Medium | 4.3 | 2025-08-22 | The Spacious theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'welcome_notice_import_handler' fu… |
CVE-2025-57896 | Medium | 5.3 | 2025-08-22 | Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2025-57894 | Medium | 4.3 | 2025-08-22 | Missing Authorization vulnerability in ollybach WPPizza wppizza allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPPi… |
CVE-2025-57884 | Medium | 4.3 | 2025-08-22 | Missing Authorization vulnerability in wpsoul Greenshift greenshift-animation-and-page-builder-blocks allows Exploiting Incorrectly Configured Access Control S… |
CVE-2025-52352 | Critical | 9.8 | 2025-08-21 | Aikaan IoT management platform v3.25.0325-5-g2e9c59796 provides a configuration to disable user sign-up in distributed deployments by hiding the sign-up option… |
CVE-2025-54040 | Medium | 6.5 | 2025-08-20 | Missing Authorization vulnerability in Webba Appointment Booking Webba Booking webba-booking-lite allows Exploiting Incorrectly Configured Access Control Secur… |
CVE-2025-54025 | Medium | 6.5 | 2025-08-20 | Missing Authorization vulnerability in Elliot Sowersby / RelyWP Coupon Affiliates woo-coupon-usage allows Exploiting Incorrectly Configured Access Control Secu… |
CVE-2025-49406 | High | 8.5 | 2025-08-20 | Missing Authorization vulnerability in favethemes Houzez allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Houzez: from n/a t… |
CVE-2025-49396 | Medium | 4.3 | 2025-08-20 | Missing Authorization vulnerability in themifyme Themify Builder themify-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2025-9202 | Medium | 4.3 | 2025-08-20 | The ColorMag theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the welcome_notice_import_handler() fu… |
CVE-2025-55734 | Medium | 6.5 | 2025-08-19 | flaskBlog is a blog app built with Flask. In 2.8.0 and earlier, the code checks if the userRole is "admin" only when visiting the /admin page, but not when vis… |
CVE-2025-4046 | High | 8.5 | 2025-08-19 | A missing authorization vulnerability in Lexmark Cloud Services badge management allows attacker to reassign badges within their organization |