CWE-862 · Missing Authorization (page 5)
Page 5 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-65489 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in LA-Studio Element Kit for Elementor <= 1.6.2 versions. |
CVE-2026-65487 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in Photography <= 7.7.6 versions. |
CVE-2026-65486 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in Event post <= 6.0.1 versions. |
CVE-2026-65485 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in Content Control <= 2.6.5 versions. |
CVE-2026-65484 | Medium | 6.3 | 2026-07-23 | Contributor Broken Access Control in Style Kits <= 2.6.5 versions. |
CVE-2026-65479 | Medium | 5.4 | 2026-07-23 | Subscriber Broken Access Control in Reviewer <= 3.14.2 versions. |
CVE-2026-65478 | Medium | 5.4 | 2026-07-23 | Subscriber Broken Access Control in ListingPro <= 2.9.10 versions. |
CVE-2026-65476 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in Civi <= 2.2.4 versions. |
CVE-2026-65472 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in Kit (formerly ConvertKit) <= 3.3.5 versions. |
CVE-2026-65469 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in AWP Classifieds <= 4.4.7 versions. |
CVE-2026-65468 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in JetBooking <= 4.1.2 versions. |
CVE-2026-65457 | Medium | 4.3 | 2026-07-23 | Subscriber Broken Access Control in ЮKassa для WooCommerce <= 2.16.1 versions. |
CVE-2026-65453 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions. |
CVE-2026-65452 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in Ebook Store <= 6.19 versions. |
CVE-2026-64814 | High | 8.6 | 2026-07-23 | In JetBrains IntelliJ IDEA before 2026.2 unauthorized file access was possible in a Remote Development session |
CVE-2026-61973 | Medium | 4.3 | 2026-07-23 | Subscriber Broken Access Control in ShopLentor Pro <= 2.8.5 versions. |
CVE-2026-61972 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in ShopLentor Pro <= 2.8.5 versions. |
CVE-2026-61954 | High | 7.5 | 2026-07-23 | Unauthenticated Broken Access Control in PayU India <= 3.8.9 versions. |
CVE-2026-61943 | High | 7.5 | 2026-07-23 | Unauthenticated Broken Access Control in WPDM – Premium Packages <= 6.2.0 versions. |
CVE-2026-59547 | High | 7.5 | 2026-07-23 | Unauthenticated Broken Access Control in Payment Gateway for PayPal on WooCommerce <= 9.1.4 versions. |
CVE-2026-59522 | Medium | 6.5 | 2026-07-23 | Subscriber Broken Access Control in WP ERP <= 1.17.5 versions. |
CVE-2026-57808 | Medium | 6.5 | 2026-07-23 | Subscriber Arbitrary Content Deletion in WP EasyPay <= 4.5.0 versions. |
CVE-2026-57717 | Medium | 6.5 | 2026-07-23 | Unauthenticated Broken Access Control in Knit Pay <= 9.6.0.0 versions. |
CVE-2026-57703 | Medium | 6.3 | 2026-07-23 | Subscriber Broken Access Control in Sunshine Photo Cart <= 3.6.10.1 versions. |
CVE-2026-57425 | Medium | 6.5 | 2026-07-23 | Unauthenticated Broken Access Control in Autopay dla WooCommerce <= 2.2.27 versions. |
CVE-2026-57367 | High | 7.1 | 2026-07-23 | Subscriber Broken Access Control in WP Booking System < 5.12.8.1 versions. |
CVE-2026-27423 | Medium | 4.3 | 2026-07-23 | Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions. |
CVE-2026-27422 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in YT Player <= 2.0.9 versions. |
CVE-2026-27418 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in WP Fast Total Search <= 1.81.282 versions. |
CVE-2026-27399 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in MarketKing <= 2.1.40 versions. |
CVE-2026-27392 | Medium | 4.3 | 2026-07-23 | Contributor Broken Access Control in uListing <= 2.2.0 versions. |
CVE-2026-27391 | Medium | 5.4 | 2026-07-23 | Subscriber Broken Access Control in uListing <= 2.2.0 versions. |
CVE-2026-27377 | Medium | 6.7 | 2026-07-23 | Booking Agent Broken Access Control in QuickCal - Appointment Booking Calendar for WordPress <= 1.0.16 versions. |
CVE-2026-27355 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in Ditty <= 3.1.66 versions. |
CVE-2026-25466 | Medium | 5.3 | 2026-07-23 | Unauthenticated Broken Access Control in WP Go Maps <= 10.1.04 versions. |
CVE-2026-25427 | Medium | 5.4 | 2026-07-23 | Subscriber Broken Access Control in eRoom <= 1.7.1 versions. |
CVE-2026-25424 | Medium | 4.3 | 2026-07-23 | Contributor Broken Access Control in Mediavine Control Panel <= 2.10.10 versions. |
CVE-2026-15827 | Medium | 5.3 | 2026-07-23 | The GutenKit Blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/gutenkit/v1/mailchimp/g… |
CVE-2026-15015 | Critical | 9.8 | 2026-07-23 | The MountDev AI MCP Connector for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.1. This is due… |
CVE-2026-59677 | | 2026-07-23 | A Missing Authorization vulnerability in selinux policycoreutils seunshares allows a user that is running in unconfined context to kill e.g. root-owned process… | |
CVE-2026-12082 | High | 7.5 | 2026-07-23 | The Praison AI SEO WordPress plugin before 5.0.7 does not perform authorization checks on several of its REST API routes, allowing unauthenticated users to mod… |
CVE-2026-13078 | High | 7.7 | 2026-07-22 | A vulnerability was discovered in MongoDB Server where the server-side MozJS scripting engine unconditionally registered a module loading hook that enables Jav… |
CVE-2026-7328 | | 2026-07-22 | Missing authorization in Caliptra Core Runtime Firmware (INVOKE_DPE_MLDSA87, CM_AES_GCM_DECRYPT_DMA, EXTERNAL_MAILBOX_CMD commands) in subsystem mode allows a… | |
CVE-2026-65011 | Medium | 4.3 | 2026-07-22 | Graylog2 Server before commit 46a2eeb contains a missing per-entity permission check in the POST /events/definitions/{definitionId}/duplicate endpoint that all… |
CVE-2026-16544 | Medium | 6.5 | 2026-07-22 | A flaw was found in AWX. The websocket event consumer performs RBAC authorization checks only for event groups that are mapped in the consumer_access() functio… |
CVE-2026-63262 | Medium | 4.3 | 2026-07-22 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized cross-space information disclosure via user-supplied input that circumvents space-level acce… |
CVE-2026-63143 | Medium | 4.3 | 2026-07-21 | Missing Authorization (CWE-862) in Kibana can lead to unauthorized information disclosure via Privilege Abuse (CAPEC-122). A user with limited feature privileg… |
CVE-2026-63141 | Medium | 6.3 | 2026-07-21 | Missing Authorization (CWE-862) in Kibana allows an authenticated user to access and modify Cloud Connect configuration and service settings without the requir… |
CVE-2026-61267 | High | 7.3 | 2026-07-21 | Vulnerability in the Oracle HCM Configuration Workbench product of Oracle E-Business Suite (component: Spreadsheet Loading). Supported versions that are affec… |
CVE-2026-60953 | High | 8.1 | 2026-07-21 | Vulnerability in the Oracle Telecommunications Billing Integrator product of Oracle E-Business Suite (component: Internal Operations). Supported versions that… |
CVE-2026-60712 | Medium | 6.5 | 2026-07-21 | Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager). Supported versions that are affected are 22… |
CVE-2026-65055 | Medium | 5.3 | 2026-07-21 | Taiga 6.10.1 contains a missing authorization vulnerability that allows unauthenticated attackers to disclose the full member roster and internal workflow conf… |
CVE-2026-63092 | Medium | 4.3 | 2026-07-21 | kirby-modules through 5.5.7, fixed in commit 315417e, contains an information disclosure vulnerability that allows any authenticated Kirby Panel user to retrie… |
CVE-2026-47688 | High | 8.2 | 2026-07-21 | FOG is a free open-source cloning/imaging/rescue suite/inventory management system. Prior to versions 1.5.10.1832 and 1.6.0-beta.2313, the `clearAES` and `clea… |
CVE-2026-47657 | | 2026-07-21 | HumHub is an Open Source Enterprise Social Network. In versions 1.13.0 through 1.18.2, a missing authorization check in the Space member management controller… | |
CVE-2026-47416 | Critical | 9.6 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 are vulnerable to vertical privilege escalation. T… |
CVE-2026-47413 | Critical | 9.6 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have aprivilege escalation / cross-tenant member i… |
CVE-2026-47412 | High | 8.1 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling destructive… |
CVE-2026-47411 | Medium | 6.5 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling workspace me… |
CVE-2026-47409 | High | 8.1 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have an authorization bypass enabling owner lockou… |
CVE-2026-47405 | High | 8.8 | 2026-07-21 | PraisonAI Platform is the platform layer for the PraisonAI multi-agent teams system. Versions prior to 0.1.4 have a broken workspace authorization check that a… |
CVE-2026-16454 | Medium | 4.3 | 2026-07-21 | In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI… |
CVE-2026-47394 | | 2026-07-21 | PraisonAI is a multi-agent teams system. Prior to version 4.6.40, the fix for GHSA-9mqq-jqxf-grvw / CVE-2026-44336 is incomplete. The original advisory descrip… | |
CVE-2026-28310 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a privilege escalation vulnerability that allows a domain administrator to escalate their user type to that of a system admini… |
CVE-2026-28309 | Critical | 9.1 | 2026-07-21 | SolarWinds Serv-U is affected by a broken access control vulnerability that allows a domain administrator to create system administrator accounts. The impact i… |
CVE-2026-65050 | Medium | 6.5 | 2026-07-21 | Ninja Forms WordPress plugin version 3.14.8 and prior contains a missing authorization vulnerability in the render callback of the `ninja-forms/submissions-tab… |
CVE-2026-11876 | Medium | 5.0 | 2026-07-21 | In zenml-io/zenml version 0.94.2, the `GET /api/v1/stack-deployment/stack` endpoint (`get_deployed_stack`) lacks proper RBAC authorization checks, allowing any… |
CVE-2026-6792 | Medium | 6.5 | 2026-07-21 | Missing Authorization vulnerability in Universal Software Inc. FlexCity allows Exploiting Incorrectly Configured Access Control Security Levels. This issue af… |
CVE-2026-65007 | Critical | 9.6 | 2026-07-21 | The Grav api plugin (grav-plugin-api) before 1.0.8 fails to properly authorize API key generation and revocation: the plugin intercepts the apiKeyGenerate/apiK… |
CVE-2026-1372 | Medium | 4.3 | 2026-07-21 | The Tutor LMS Elementor Addons plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.0.0 This is due to missing c… |
CVE-2026-8593 | | 2026-07-21 | Improper permission enforcement in Checkmk versions 2.5.0 before 2.5.0p9, 2.4.0 before 2.4.0p34, 2.3.0 before 2.3.0p49, and 2.2.0 (EOL) allows users without pe… | |
CVE-2026-14185 | Medium | 4.3 | 2026-07-21 | The WPBot WordPress plugin before 8.2.0 does not perform a capability or nonce check in one of its retrieval-augmented-generation settings handlers, allowing… |
CVE-2026-13694 | Medium | 6.5 | 2026-07-21 | The Bit Form WordPress plugin before 3.1.0 does not properly validate its workflow-trigger token once the associated transient has expired, allowing unauthent… |
CVE-2026-57494 | | 2026-07-20 | AgenticMail gives AI agents real email addresses and phone numbers. In @agenticmail/api prior to version 0.9.64, a low-privileged authenticated AgenticMail age… | |
CVE-2026-55550 | High | 7.1 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. The CRM product catalog is an organization-wide business object. Normal application ser… |
CVE-2026-55544 | High | 7.6 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. In version 0.12.1, the MCP campaign tools expose campaign read and write operations ove… |
CVE-2026-47129 | High | 8.1 | 2026-07-20 | NextCRM is open-source customer relationship management (CRM) software. Versions prior to 0.12.0 have a Broken Access Control (BAC) vulnerability in the `activ… |
CVE-2026-44585 | Medium | 5.4 | 2026-07-20 | Paymenter is a free and open-source webshop solution for management of hosting services. In versions prior to 1.5.0, the ticket creation endpoint accepts a use… |
CVE-2026-45295 | Medium | 6.5 | 2026-07-20 | FreeScout is a free help desk and shared inbox built with PHP's Laravel framework. Prior to version 1.8.219, the open tracking endpoint `GET /thread/read/{conv… |
CVE-2026-58482 | Medium | 5.9 | 2026-07-20 | Network-AI, a TypeScript/Node.js multi-agent orchestrator, has a shipped, exported, documented feature called `ApprovalInbox` (`lib/approval-inbox.ts`). It is… |
CVE-2026-64622 | High | 7.5 | 2026-07-20 | Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApprovalInbox GET read r… |
CVE-2026-63758 | Medium | 5.4 | 2026-07-20 | SurrealDB versions before 3.1.0 contain an authorization bypass vulnerability in the KILL statement that allows authenticated database users to terminate other… |
CVE-2026-63741 | Medium | 6.5 | 2026-07-20 | SurrealDB versions before 3.1.0 fail to validate DEFINE NAMESPACE or DEFINE DATABASE permissions when processing USE NS and USE DB statements. Unauthenticated… |
CVE-2026-13432 | Medium | 5.4 | 2026-07-20 | The ThumbPress WordPress plugin before 6.2.2 does not perform a capability check on one of its AJAX actions, allowing authenticated users with subscriber-leve… |
CVE-2026-12973 | Medium | 6.5 | 2026-07-20 | The PayPlus Payment Gateway WordPress plugin before 8.2.2 does not perform authorization or order-ownership validation in one of its AJAX actions available to… |
CVE-2026-12723 | Medium | 5.3 | 2026-07-20 | The Kirki WordPress plugin before 6.0.12 does not perform any authorisation check on one of its REST routes, allowing unauthenticated users to overwrite the c… |
CVE-2026-11868 | Medium | 5.3 | 2026-07-20 | The WP Travel WordPress plugin before 11.7.1 does not perform capability or ownership checks on its booking cancellation action, which is also exposed to unau… |
CVE-2026-16216 | Medium | 4.3 | 2026-07-19 | A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAuth Handler. Executing a manipulation ca… |
CVE-2026-16215 | Medium | 6.5 | 2026-07-19 | A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the component OAuth Credential Revoke Handler. Per… |
CVE-2026-16197 | Medium | 6.3 | 2026-07-18 | A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMessageReceive of the file pkg/channels/f… |
CVE-2026-16123 | Medium | 6.3 | 2026-07-18 | A weakness has been identified in nextlevelbuilder GoClaw up to 3.13.2. Affected by this issue is the function ToolsInvokeHandler.ServeHTTP of the file interna… |
CVE-2026-16081 | Medium | 4.3 | 2026-07-18 | A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.go. Executing a man… |
CVE-2026-55518 | Critical | 9.6 | 2026-07-17 | Avo is a framework to create admin panels for Ruby on Rails apps. Prior to 3.32.1 and 4.0.0.beta.51, Avo's association attach workflow checks attach_<associati… |
CVE-2026-45704 | | 2026-07-17 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.6, CustomReports uses inconsistent authorization between the r… | |
CVE-2026-45260 | High | 8.1 | 2026-07-17 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, Pimcore's WebDAV asset endpoint exposes a MOVE operation th… |
CVE-2026-45703 | Medium | 6.4 | 2026-07-17 | Pimcore is an Open Source Data & Experience Management Platform. Prior to 11.5.17 (LTS) and 12.3.7, the WordExport export flow in bundles/WordExportBundle/src/… |
CVE-2026-48014 | Medium | 6.5 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, the order state transition features /api/_action/order/{orderId}/state/{transition} and… |
CVE-2026-48008 | Medium | 6.5 | 2026-07-17 | Shopware is an open commerce platform. Prior to 6.6.10.18 and 6.7.10.1, a non-admin API user with integration:create ACL privilege can escalate to full adminis… |
CVE-2026-16106 | Medium | 4.9 | 2026-07-17 | A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to… |
CVE-2026-12694 | Critical | 9.1 | 2026-07-17 | Missing Authorization vulnerability in Vimesoft Inc. Enterprise Video Platform allows Accessing Functionality Not Properly Constrained by ACLs. This issue aff… |