CWE-862 · Missing Authorization (page 5)
Page 5 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-73807 | Critical | 9.8 | 2026-09-15 | The mySCADA myPRO Manager command API does not properly enforce authentication for privileged functions. An unauthenticated attacker with network access to the… |
CVE-2026-91739 | Medium | 4.2 | 2026-09-15 | Missing authorization in Transactions Platform in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to sp… |
CVE-2026-91732 | High | 8.1 | 2026-09-15 | Missing authorization in AppManifest in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process and leveraged s… |
CVE-2026-91717 | Medium | 5.1 | 2026-09-15 | Missing authorization in Android in Google Chrome on on Android prior to 153.0.8010.47 allowed a local attacker to obtain sensitive information via a co-instal… |
CVE-2026-91713 | Medium | 4.2 | 2026-09-15 | Missing authorization in Browser in Google Chrome prior to 153.0.8010.47 allowed a remote attacker who had compromised the renderer process to spoof UI element… |
CVE-2026-66887 | Critical | 9.6 | 2026-09-15 | The affected products are missing authorization on state-changing CGIs and session checks are not performed. |
CVE-2026-18426 | Medium | 6.5 | 2026-09-15 | Concrete CMS 9.0.0 through 9.5.2 did not enforce a block-level edit-permission check on the Express Form block's control-management actions, which relied solel… |
CVE-2026-18425 | Low | 2.7 | 2026-09-15 | Concrete CMS 9 before 9.5.3 authorized the dashboard sitemap reorder action (Concrete\Controller\Backend\Dashboard\SitemapUpdate) using only the global access_… |
CVE-2026-18422 | Medium | 6.5 | 2026-09-15 | Concrete CMS before 9.5.3 did not enforce a destination-side authorization check and did not validate a CSRF token in the multilingual page assignment backend… |
CVE-2026-81923 | Low | 2.7 | 2026-09-15 | In Concrete CMS before 9.5.3, the SEO Bulk Update Meta Tags editor did not check per-page edit permissions before saving. The saveRecord() action validated the… |
CVE-2026-81922 | Low | 2.7 | 2026-09-15 | Concrete CMS before 9.5.3 did not enforce a per-page authorization check when reordering pages from the sitemap. In the sitemap Explore dashboard controller, t… |
CVE-2026-81921 | Medium | 5.4 | 2026-09-15 | Concrete CMS 8.5.3 through 9.5.2 enabled the OAuth 2.0 refresh-token grant using the unmodified upstream League grant, which issued new access tokens from a va… |
CVE-2026-68533 | | 2026-09-15 | Concrete CMS below 9.5.3 conversation attachment uploaded endpoint imported files into the file manager before evaluating the "Add Message Attachments" permiss… | |
CVE-2026-68530 | | 2026-09-15 | Concrete CMS 9 through 9.5.2 did not perform an authorization check on several board-instance actions in the Boards area of the Dashboard. The instance details… | |
CVE-2026-68529 | | 2026-09-15 | Concrete CMS 9.0.0 through 9.5.2 was missing an authorization check on the Express entries advanced-search dashboard action. The advanced_search() method in Da… | |
CVE-2026-18421 | | 2026-09-15 | Concrete CMS 9 through 9.5.2 does not perform an authorization check in three actions of the Boards data source dashboard controller (update, update_data_sourc… | |
CVE-2026-0192 | Medium | 6.7 | 2026-09-15 | In Bootloader, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with System exec… |
CVE-2026-56830 | Medium | 6.5 | 2026-09-15 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, an earlier product sub-form hardening change left store() in packages/admin/src/Livewire/Componen… |
CVE-2026-56829 | High | 8.1 | 2026-09-15 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Products/VariantStock.php exposes stockAction() without ed… |
CVE-2026-56827 | High | 8.1 | 2026-09-15 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, groupedBulkActions in packages/admin/src/Livewire/Pages/Attribute/Browse.php, packages/admin/src/… |
CVE-2026-56825 | High | 8.1 | 2026-09-15 | Shopper is a Headless e-commerce Admin Panel. Prior to 2.9.2, packages/admin/src/Livewire/Components/Collection/CollectionProducts.php exposes Action::make('de… |
CVE-2026-18115 | | 2026-09-15 | Concrete CMS 9.2.0 to 9.5.2 did not enforce per-field edit_user_properties permissions on the REST API user write endpoints (PUT /ccm/api/1.0/users/{uID} and P… | |
CVE-2026-12742 | Medium | 5.4 | 2026-09-15 | IBM Business Automation Workflow containers and traditional could allow an authenticated attacker to trigger restricted import actions due to missing authoriza… |
CVE-2026-55863 | Medium | 5.3 | 2026-09-15 | motionEye (mEye) is an online interface for a piece of software called "motion," which is a video surveillance program with motion detection. Prior to 0.44.0… |
CVE-2026-18110 | High | 7.5 | 2026-09-15 | Concrete CMS 9 (9.0.0 through 9.5.2) does not perform an authorization check on the user selector autocomplete endpoint (/ccm/system/user/autocomplete), which… |
CVE-2026-91929 | High | 7.1 | 2026-09-15 | Flowise versions before 3.1.4 contain cross-tenant authorization gaps in Enterprise endpoints that fail to verify resource ownership before operations. Attacke… |
CVE-2026-88620 | Medium | 4.3 | 2026-09-15 | SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enf… |
CVE-2026-88619 | High | 8.1 | 2026-09-15 | 1024-lab SmartAdmin v3.30.0 contains a missing authorization vulnerability in the scheduled-job management module. The AdminSmartJobController exposes schedule… |
CVE-2026-87792 | | 2026-09-15 | The "Design Scuole Italia" WordPress theme is affected by multiple Authorization Bypass vulnerabilities in the dsi_pdf_generator and dsi_csv_generator function… | |
CVE-2026-54076 | High | 8.1 | 2026-09-15 | ArcadeDB is a Multi-Model DBMS. Prior to 26.6.1, the fix for CVE-2026-44221 added an UPDATE_SCHEMA authorization check only to LocalDocumentType.createProperty… |
CVE-2026-61549 | | 2026-09-15 | Woodpecker is a CI/CD engine. From 1.0.0 until 3.16.0, pipeline/backend/kubernetes/backend_options.go defines backend_options.kubernetes.serviceAccountName, an… | |
CVE-2026-55178 | High | 7.5 | 2026-09-15 | GeoLens is a self-hosted geospatial data catalog with semantic search, OGC and STAC APIs, and a map builder. Prior to 1.2.3, multiple read and link endpoints a… |
CVE-2026-54168 | Medium | 6.5 | 2026-09-15 | Pipelines-as-Code is a CI/CD system that lets users define Tekton pipelines in source code repositories. Prior to 0.37.8, 0.39.6, 0.42.1, and 0.48.0, a GitHub… |
CVE-2026-53966 | | 2026-09-15 | XWiki Platform is a generic wiki platform. From 13.4-rc-1 until 16.10.17, 17.4.10, 17.10.4, and 18.1.0-rc-1, the Live Data edit REST API allows a user who can… | |
CVE-2026-91994 | Medium | 6.5 | 2026-09-15 | Semaphore UI through 2.19.12 exempts GET and HEAD requests from project resource permission checks in GetMustCanMiddleware. Attackers with guest or task_runner… |
CVE-2026-91924 | High | 8.5 | 2026-09-15 | pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary d… |
CVE-2026-57139 | Critical | 9.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. From 1.5.0 until 1.7.2, MCPServer.startHttp() in src/praisonai-ts/src/mcp/server.ts binds without a host restriction a… |
CVE-2026-57137 | High | 8.8 | 2026-09-15 | PraisonAI is a multi-agent teams system. From 1.4.0 until 1.7.2, createAgentLoop() in src/praisonai-ts/src/ai/agent-loop.ts passes executable tools to generate… |
CVE-2026-57112 | High | 8.3 | 2026-09-15 | PraisonAI is a multi-agent teams system. From praisonaiagents 0.6.0 until 1.6.59 and PraisonAI 3.10.0 until 4.6.59, ToolsMCPServer.run_sse() in src/praisonai-a… |
CVE-2026-52828 | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.58.0, ExportController::createExportTemplate() and ExportController::editExportTemplate() inherit… | |
CVE-2026-52825 | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.58.0, POST /api/teams/{id}/members/{userId} and POST /api/teams/{id}/activities/{activityId} veri… | |
CVE-2026-52822 | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.58.0, PATCH /api/timesheets/{id}/restart, PATCH /api/timesheets/{id}/duplicate, and the web dupli… | |
CVE-2026-52821 | | 2026-09-15 | Kimai is an open-source time tracking application. Prior to 2.57.0, GET or POST requests to /en/admin/activity/create/{project} and /en/admin/project/create/{c… | |
CVE-2026-91846 | | 2026-09-15 | Affected versions of MISP allow a collection element to be created from a bare UUID without consistently checking whether the acting user is allowed to access… | |
CVE-2026-91825 | | 2026-09-15 | Affected versions of MISP fail to authorize a submitted sharing group in a specific event-edit path. The vulnerable logic checked whether the acting user cou… | |
CVE-2026-91774 | Medium | 4.3 | 2026-09-15 | Yao through v1.0.0-rc22 authenticates but fails to authorize the GET /user/teams/:id endpoint, allowing any logged-in user to read full team records. Attackers… |
CVE-2026-77191 | Low | 2.6 | 2026-09-14 | An authenticated supplicant on an adjacent network may bypass intended network authorization policy and send unrestricted traffic during a brief window (millis… |
CVE-2026-12758 | Medium | 5.4 | 2026-09-14 | IBM Cloud Pak for Business Automation could allow a remote attacker to bypass authorization and invoke restricted endpoints due to improper validation of HTTP… |
CVE-2026-90820 | Medium | 4.3 | 2026-09-14 | A security vulnerability has been detected in a2aproject a2a-java 1.2.0. The impacted element is the function AuthorizationRequestHandlerDecorator.onListTasks… |
CVE-2026-86897 | Medium | 5.5 | 2026-09-14 | This issue was addressed with additional entitlement checks. This issue is fixed in Safari 27, iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gat… |
CVE-2026-84629 | High | 7.5 | 2026-09-14 | This issue was addressed with additional entitlement checks. This issue is fixed in iOS 27 and iPadOS 27, tvOS 27, visionOS 27, watchOS 27. An app may be able… |
CVE-2026-84580 | High | 8.4 | 2026-09-14 | The issue was addressed with improved checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be able to break ou… |
CVE-2026-84569 | Medium | 5.5 | 2026-09-14 | An access issue was addressed with additional sandbox restrictions on the system pasteboards. This issue is fixed in macOS Golden Gate 27. An app may be able t… |
CVE-2026-84551 | Medium | 4.4 | 2026-09-14 | A logic issue was addressed with improved validation. This issue is fixed in iOS 27 and iPadOS 27, macOS Golden Gate 27, visionOS 27, watchOS 27. An app may be… |
CVE-2026-84514 | Medium | 5.5 | 2026-09-14 | This issue was addressed with additional entitlement checks. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be a… |
CVE-2026-81901 | High | 8.7 | 2026-09-14 | In Concrete CMS 9.2.0 through 9.5.2, the REST API page update endpoint (PUT /ccm/api/1.0/pages/{cID}) did not enforce page-property, page-template, or page-typ… |
CVE-2026-65381 | Critical | 10.0 | 2026-09-14 | A validation issue existed in the entitlement verification. This issue was addressed with improved validation of the process entitlement. This issue is fixed i… |
CVE-2026-65342 | High | 7.5 | 2026-09-14 | A permissions issue was addressed with improved validation. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app may be ab… |
CVE-2026-53718 | Medium | 6.4 | 2026-09-14 | Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, an HTTPRout… |
CVE-2026-43789 | High | 7.5 | 2026-09-14 | An access issue was addressed with additional sandbox restrictions. This issue is fixed in macOS Golden Gate 27, macOS Sequoia 15.8, macOS Tahoe 26.7. An app m… |
CVE-2026-43696 | Medium | 5.3 | 2026-09-14 | An authorization issue was addressed with improved entitlement checks. This issue is fixed in macOS Golden Gate 27. An app may be able to capture Touch Bar con… |
CVE-2026-43689 | High | 7.8 | 2026-09-14 | A permissions issue was addressed with additional restrictions. This issue is fixed in iOS 26.7 and iPadOS 26.7, iOS 27 and iPadOS 27, macOS Golden Gate 27, vi… |
CVE-2026-54629 | High | 7.5 | 2026-09-14 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes file-backed SQLite virtual table modules such as csv_reader and… |
CVE-2026-54628 | High | 8.6 | 2026-09-14 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server exposes URL-capable SQLite virtual table modules such as json_reader an… |
CVE-2026-50006 | Critical | 9.1 | 2026-09-14 | Anyquery is an SQL query engine built on top of SQLite. Prior to 0.4.5, anyquery server forwards unauthenticated SQL from its MySQL-compatible server port to S… |
CVE-2026-16190 | Low | 3.1 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 is affected by an authorization bypass vulnerability. |
CVE-2026-16187 | Medium | 6.5 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication and obtain sensitive information by sending a crafted unau… |
CVE-2026-16185 | Medium | 6.4 | 2026-09-14 | IBM WebSphere Application Server 9.0, and 8.5 could allow a remote attacker to bypass authentication on an admin console servlet. |
CVE-2026-89023 | High | 8.6 | 2026-09-14 | ThemeAtelier Domain For Sale plugin for WordPress before 3.5.2 contains a missing authorization vulnerability in its REST API endpoints that allows unauthentic… |
CVE-2026-82519 | Medium | 4.3 | 2026-09-14 | Really Simple Security plugin for WordPress before 9.8.2 contains a missing authorization check vulnerability that allows authenticated low-privileged attacker… |
CVE-2026-90806 | Medium | 6.3 | 2026-09-14 | A vulnerability has been found in DjangoCRM django-crm up to 1.2. This vulnerability affects the function BulkUpdateCasesView of the file backend/cases/bulk_vi… |
CVE-2026-57578 | | 2026-09-14 | DotVVM is an open source MVVM framework for web applications. Prior to 4.2.11, 4.3.15, and 5.0.0-preview09-final, AuthorizeActionFilter performs no authorizati… | |
CVE-2026-57570 | Medium | 6.5 | 2026-09-14 | backpack/crud provides Create, Read, Update & Delete (CRUD) functions for Backpack, a collection of Laravel packages that help users build custom administratio… |
CVE-2026-57579 | High | 7.5 | 2026-09-14 | Alchemy is an open source content management system engine written in Ruby on Rails. Prior to 7.4.15, 8.0.15, 8.1.14, and 8.2.6, the unauthenticated GET /api/p… |
CVE-2026-57131 | Critical | 9.8 | 2026-09-14 | PraisonAI is a multi-agent teams system. Prior to 4.6.58, praisonai.jobs.server.create_app mounts praisonai.jobs.router.create_router under /api/v1/runs withou… |
CVE-2026-82437 | Medium | 4.3 | 2026-09-14 | Description The Logviewer offers `logs.users` and `logs.groups` so operators can control who may read log content. For daemon logs those settings were not app… |
CVE-2026-82433 | Medium | 6.5 | 2026-09-14 | Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is con… |
CVE-2026-90941 | Medium | 4.3 | 2026-09-14 | novel-plus through 5.3.3 contains an authorization bypass vulnerability in the BookController download endpoint that allows authenticated backend accounts to e… |
CVE-2026-90939 | Medium | 6.5 | 2026-09-14 | novel-plus through 5.3.3 contains an information disclosure vulnerability in the /sys/user/list endpoint that lacks proper permission annotations. Authenticate… |
CVE-2026-90933 | High | 7.1 | 2026-09-14 | laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overw… |
CVE-2026-75030 | Critical | 9.8 | 2026-09-14 | Missing Authorization vulnerability in Apache Syncope. An administrator with task execution entitlements might be able to mass (de)provision group members… |
CVE-2026-8821 | High | 7.1 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to validate channel member-management permission during play… |
CVE-2026-14344 | Medium | 4.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce the board-creation permission which allows an una… |
CVE-2026-14259 | Medium | 4.3 | 2026-09-14 | Mattermost versions 11.9.x <= 11.9.0, 11.8.x <= 11.8.4, 11.7.x <= 11.7.7, 10.11.x <= 10.11.22 fail to enforce board creation permissions when importing archive… |
CVE-2026-90895 | | 2026-09-14 | Affected versions of MISP’s interactive CLI shell implement access control independently from the normal web application, causing several authorization inconsi… | |
CVE-2026-90599 | Medium | 4.3 | 2026-09-13 | A flaw has been found in Rizwan17 inventory-management-system up to 5e74a46b4b70623d0e4a0c9c4aee3bd1777185d2. This affects an unknown function of the file incl… |
CVE-2026-90595 | Medium | 6.3 | 2026-09-13 | A security flaw has been discovered in wxiaoqi Spring-Cloud-Platform 1.0/2.2/3.0. This issue affects the function OnlineController.getOnlineInfo of the file ac… |
CVE-2026-90594 | Medium | 6.3 | 2026-09-13 | A vulnerability was identified in wxiaoqi Spring-Cloud-Platform 3.0.1/3.1.0. This vulnerability affects the function PermissionService.checkUserPermission of t… |
CVE-2026-88802 | High | 7.5 | 2026-09-13 | The MDJM Event Management WordPress plugin before 1.7.8.5 and the Mobile Events Manager WordPress plugin through 1.4.8.3 do not check a capability, a nonce or… |
CVE-2026-81648 | Critical | 10.0 | 2026-09-13 | The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated use… |
CVE-2026-74933 | High | 8.8 | 2026-09-13 | The GenieWords WordPress plugin from 1.5.27 to 1.5.34 does not have authorisation checks on some of its REST API and AJAX actions, and decodes stored values be… |
CVE-2026-90768 | High | 8.1 | 2026-09-13 | CAPEv2 through commit 471ee4b fails to validate task ownership in REST API endpoints, allowing authenticated users to read and delete analyses submitted by oth… |
CVE-2026-90508 | Low | 3.4 | 2026-09-13 | A security flaw has been discovered in Chengdu Qilu Technology Ludashi 6.1026.4715.714. Affected by this vulnerability is the function MessageNotifyCallback in… |
CVE-2026-90551 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate playlist ownership in the video_from_program API endpoint, allowing unaut… |
CVE-2026-90547 | Medium | 5.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate user permissions in the Bookmark plugin getBookmarks.json.php endpoint, a… |
CVE-2026-90546 | Medium | 4.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the like.json.php endpoint, allowing logged-i… |
CVE-2026-90545 | Medium | 4.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the commentAddNew.json.php endpoint, allowing… |
CVE-2026-90544 | Medium | 4.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate video access permissions in the videoAddViewCount.json.php endpoint befor… |
CVE-2026-90540 | Medium | 4.3 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 fails to validate watch permissions in the playListAddVideo.json.php endpoint when adding v… |
CVE-2026-90537 | High | 8.2 | 2026-09-12 | WWBN AVideo through commit c3edcc274c389816d434acadac07ee78eaf330c1 contains a missing authorization vulnerability in plugin/Scheduler/sendEmail.json.php that… |