CWE-862 · Missing Authorization (page 6)
Page 6 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-90535 | High | 7.5 | 2026-09-12 | Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplie… |
CVE-2026-90533 | Medium | 6.5 | 2026-09-12 | Flowise before 3.1.4 contains a broken access control vulnerability in GET /api/v1/organizationuser that allows any authenticated organization member to retrie… |
CVE-2026-11355 | Medium | 5.3 | 2026-09-12 | The DT LMS – elearning, WordPress LMS plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple AJA… |
CVE-2026-87919 | Medium | 4.9 | 2026-09-12 | The Product XML Feed Manager for WooCommerce WordPress plugin before 3.1.1 does not restrict which object method its product shortcode may call, nor check the… |
CVE-2026-87797 | Medium | 4.3 | 2026-09-12 | The Sprout Invoices WordPress plugin before 20.8.16 does not perform a capability or ownership check before allowing a private note to be overwritten through… |
CVE-2026-90454 | | 2026-09-11 | A deployment mode intended to expose only read access to a bundled packet-analysis component's interface denies a list of write-capable routes by pattern, but… | |
CVE-2026-90448 | | 2026-09-11 | A deployment mode intended to expose only read access to stored data proxies a set of application programming interface routes without restricting which reques… | |
CVE-2026-68535 | Medium | 4.3 | 2026-09-11 | Concrete CMS Area API's block-create endpoint in versions 9.2.0 to 9.5.2 did not invoke the block type controller's validate() method on submitted data, which… |
CVE-2026-50025 | | 2026-09-11 | Mousehole is a background service to update a seedbox IP for MAM and web app to manage it. Prior to version 0.4.05, Mousehole's HTTP/WebSocket management bound… | |
CVE-2026-49439 | Medium | 4.3 | 2026-09-11 | OpenRemote is an open-source internet-of-things platform. Prior to version 1.24.1, the predicted datapoint write endpoint allows users with only `read:assets`… |
CVE-2026-81916 | Medium | 4.3 | 2026-09-11 | Concrete CMS before 9.5.3 evaluated the authorization check for an Express entry submission against the entity of the posted form rather than the entity identi… |
CVE-2026-81915 | Medium | 5.3 | 2026-09-11 | Concrete CMS below 9.5.3 does not perform an object-level authorization check when a Page Type was updated. The Types::submit() dashboard controller loaded and… |
CVE-2026-62137 | Medium | 5.3 | 2026-09-11 | Unauthenticated Sensitive Data Exposure in bbPress <= 2.6.14 versions. |
CVE-2026-62136 | Medium | 5.3 | 2026-09-11 | Unauthenticated Broken Access Control in Flexible Quantity – Measurement Price Calculator for WooCommerce <= 2.3.21 versions. |
CVE-2026-62135 | Medium | 5.3 | 2026-09-11 | Unauthenticated Broken Access Control in Booktics <= 1.0.24 versions. |
CVE-2026-62132 | Medium | 5.3 | 2026-09-11 | Subscriber Broken Access Control in Masteriyo - LMS <= 3.4.0 versions. |
CVE-2026-62114 | Medium | 5.3 | 2026-09-11 | Unauthenticated Broken Access Control in Passster <= 4.3.13 versions. |
CVE-2026-62089 | High | 7.1 | 2026-09-11 | Missing Authorization vulnerability in Pixar Labs Master Addons for Elementor allows Privilege Abuse. This issue affects Master Addons for Elementor: from n/a… |
CVE-2026-27378 | Medium | 5.3 | 2026-09-11 | Unauthenticated Broken Access Control in Deposits and Partial Payments for WooCommerce <= 3.1.0 versions. |
CVE-2026-81909 | | 2026-09-11 | Concrete CMS 9 through 9.5.2 is vulnerable to Missing Authorization in the block alias route (Process::alias() in concrete/controllers/backend/block/process.ph… | |
CVE-2026-81908 | | 2026-09-11 | Concrete CMS 9.2.0 to 9.5.2 contain a missing authorization vulnerability in the REST API Groups list endpoint. The listGroups() method in concrete/src/Api/Con… | |
CVE-2026-18122 | | 2026-09-11 | Concrete CMS 9.2.0 to 9.5.2 Express REST API list endpoint exposes restricted Express entries via Missing Authorization; the Concrete CMS REST API's Express en… | |
CVE-2026-72709 | Critical | 9.8 | 2026-09-11 | SPIP before version 4.4.18 contains a missing authorization vulnerability in sensitive actions under ecrire/action/ that allows unauthenticated attackers to in… |
CVE-2026-8304 | Medium | 5.5 | 2026-09-11 | Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus About allows Exploiting Incorrectly Configured Access Con… |
CVE-2026-89265 | Medium | 4.3 | 2026-09-11 | MoguBlog through 6.2 contains an authorization bypass vulnerability in the POST /pictureSort/getPictureSortByUid endpoint, which omits the @AuthorityVerify ann… |
CVE-2026-38056 | High | 8.8 | 2026-09-11 | A local privilege escalation vulnerability exists in the iDirect iQ200 VSAT terminal running firmware 23.0.1.0. The iQ200 is a rackmount satellite modem deploy… |
CVE-2024-12145 | Medium | 4.3 | 2026-09-11 | The BuddyPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 14.3.3 via the bp_notifications_act… |
CVE-2026-86815 | Medium | 5.5 | 2026-09-11 | The BackWPup WordPress plugin before 5.7.5 does not properly restrict access to several of its REST API routes for job, backup-destination, and backup-executi… |
CVE-2026-86779 | Low | 2.7 | 2026-09-11 | The Visualizer WordPress plugin before 4.0.6 does not properly authorise chart-deletion requests, performing only a site-wide capability check with no per-obj… |
CVE-2026-11496 | Medium | 6.5 | 2026-09-11 | The Woo PDF Invoice Builder plugin (also distributed as "PDF Builder for WooCommerce") for WordPress is vulnerable to Insecure Direct Object Reference in all v… |
CVE-2026-11446 | Medium | 5.3 | 2026-09-11 | The Booktics – Booking Calendar for Appointments and Service Businesses plugin for WordPress is vulnerable to unauthorized modification of data in all versions… |
CVE-2026-18121 | | 2026-09-11 | Concrete CMS 9.5.2 and below is vulnerable to an authorization bypass (IDOR) because the frontend calendar lightbox endpoint (/ccm/calendar/view_event/{bID}/{o… | |
CVE-2026-81211 | High | 8.8 | 2026-09-10 | IBM Langflow OSS 1.0.0 through 1.11.5 could allow a remote authenticated attacker to execute arbitrary Python code due to improper authorization of custom comp… |
CVE-2026-89054 | High | 8.2 | 2026-09-10 | A missing authorization vulnerability in OpenNMS Horizon allows configuration changes without authentication. The Spring Security policy for the /api/v2 REST A… |
CVE-2026-88959 | High | 8.8 | 2026-09-10 | Anchor CMS through 0.12.7 fails to enforce role-based access control in admin user-management endpoints, allowing any authenticated low-privilege user to creat… |
CVE-2026-4129 | High | 8.1 | 2026-09-10 | There is an improper access control vulnerability in NI SystemLink that may allow an authenticated user with limited privileges to access host operating system… |
CVE-2026-88898 | Medium | 6.5 | 2026-09-10 | AppFlowy-Cloud versions 0.7.2 through 0.9.64 fail to authorize callers against the workspace in the bulk publish endpoint path, allowing authenticated users to… |
CVE-2026-84821 | High | 7.5 | 2026-09-10 | Unauthenticated Broken Access Control in WP Fast Total Search <= 1.82.284 versions. |
CVE-2026-81801 | High | 8.1 | 2026-09-10 | Subscriber Settings Change in WP-Stateless <= 4.4.1 versions. |
CVE-2026-81799 | High | 7.5 | 2026-09-10 | Unauthenticated Broken Access Control in Return Refund and Exchange For WooCommerce <= 4.6.4 versions. |
CVE-2026-81794 | High | 7.5 | 2026-09-10 | Unauthenticated Broken Access Control in Shirt Product Designer for WooCommerce 1.0.4 versions. |
CVE-2026-81793 | Medium | 6.5 | 2026-09-10 | Unauthenticated Broken Access Control in Salon booking system <= 10.31.5 versions. |
CVE-2026-81788 | Medium | 6.3 | 2026-09-10 | Subscriber Broken Access Control in IMPress for IDX Broker <= 3.3.0 versions. |
CVE-2026-81786 | High | 7.5 | 2026-09-10 | Unauthenticated Broken Access Control in Thank You Page Customizer for WooCommerce <= 1.2.2 versions. |
CVE-2026-81785 | Medium | 6.5 | 2026-09-10 | Unauthenticated Broken Access Control in BuddyForms <= 2.9.0 versions. |
CVE-2026-78536 | Medium | 6.5 | 2026-09-10 | Unauthenticated Broken Access Control in Robokassa payment gateway for Woocommerce <= 1.8.9 versions. |
CVE-2026-88915 | | 2026-09-10 | Affected versions of MISP do not consistently enforce the acting user's authorization when instantiating event templates. For templates using distribution =… | |
CVE-2026-88271 | High | 8.8 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows a Guest user to overwrite device configuration and replace the administrator password through SSVR. |
CVE-2026-88270 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows a Guest user to enter SSVR firmware-upgrade mode and disrupt live services before any firmware image is validated. |
CVE-2026-88269 | Medium | 6.5 | 2026-09-10 | GeoVision GV-LPC2211 V1.13 allows a Guest user to retrieve persistent device configuration containing plaintext administrative and user credentials through SSV… |
CVE-2026-78361 | Critical | 9.1 | 2026-09-10 | The zipMoney(Zip Co) Payments Plugin for WooCommerce WordPress plugin before 2.4.0 does not perform any authorisation checks on one of its front-end request ha… |
CVE-2026-77770 | Critical | 10.0 | 2026-09-10 | The miniOrange 2FA WordPress plugin before 6.3.1, miniOrange 2FA WordPress plugin before 19.3 does not require a validated transaction before deleting site o… |
CVE-2026-18594 | Medium | 4.3 | 2026-09-10 | The Advanced Contact form 7 DB plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.1.3. This is due to the plugi… |
CVE-2026-15823 | Medium | 4.3 | 2026-09-10 | The Builderall Cheetah For Wp plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the disable() functi… |
CVE-2026-14873 | High | 8.0 | 2026-09-10 | The Bulk Password Reset plugin for WordPress is vulnerable to privilege escalation via account takeover in all versions up to, and including, 1.3.3. This is du… |
CVE-2026-87997 | Medium | 4.3 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.10.0 until 0.11.1, POST /api/chat/completions and POST /api/v1/cha… |
CVE-2026-87994 | Medium | 4.3 | 2026-09-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.5 until 0.11.1, the channel branch of chat_completion in backend… |
CVE-2026-79324 | High | 7.5 | 2026-09-09 | Missing authorization in the Address Delete controller in Mageplaza GDPR for Magento 2 (mageplaza/module-gdpr) through 4.2.9 allows remote unauthenticated atta… |
CVE-2026-68484 | | 2026-09-09 | Cash Collect contains an improper authorization vulnerability in the Sage AR Automation API. Administrative functions do not properly verify user privileges, a… | |
CVE-2026-86765 | Medium | 6.5 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to enforce checkout authorization when assignment fields are submitted to the asset update endpoint. Authenticated users wi… |
CVE-2026-86764 | Medium | 6.5 | 2026-09-09 | Snipe-IT through 8.6.4 (fixed in 8.7.0) does not enforce the components.view permission on the authenticated endpoint GET /api/v1/hardware/<asset-id>/assigned/… |
CVE-2026-86762 | High | 8.1 | 2026-09-09 | Snipe-IT before 8.7.0 does not apply the CheckUserIsActivated middleware to the `api` middleware group in app/Http/Kernel.php, and deactivating a user does not… |
CVE-2026-86759 | High | 7.1 | 2026-09-09 | Snipe-IT versions before 8.7.0 fail to authorize the POST /hardware/history endpoint, allowing any authenticated user to reassign arbitrary assets and modify a… |
CVE-2026-86757 | Medium | 6.5 | 2026-09-09 | Snipe-IT before 8.7.0 fails to properly gate access to encrypted custom-field values in asset form templates for listbox, textarea, markdown-textarea, and date… |
CVE-2026-41871 | Critical | 9.8 | 2026-09-09 | Missing Authorization, Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Nutch Server (Nutch REST API… |
CVE-2026-41870 | High | 8.8 | 2026-09-09 | Missing Authorization, Improper Control of Generation of Code ('Code Injection'), Improper Control of Dynamically-Managed Code Resources, Use of Externally-Con… |
CVE-2026-41869 | Critical | 9.1 | 2026-09-09 | Missing Authorization, Improper Resource Shutdown and Job Interruption vulnerability in Apache Nutch Server (Nutch REST API). This issue affects Apache Nut… |
CVE-2026-86777 | Medium | 5.3 | 2026-09-09 | AlchemyCMS versions before 7.4.16 and 8.x before 8.3.6 fail to authorize access to the GET /api/nodes endpoint, allowing unauthenticated attackers to retrieve… |
CVE-2026-15398 | Medium | 4.3 | 2026-09-09 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up… |
CVE-2026-19802 | Medium | 4.3 | 2026-09-09 | The Checkout Custom Fields Builder for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.5. This… |
CVE-2026-8615 | Medium | 4.3 | 2026-09-09 | The Reviso Exporter for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce… |
CVE-2026-85133 | Medium | 5.4 | 2026-09-09 | The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on several of its settings AJAX actions, allowing any authen… |
CVE-2026-85132 | Medium | 4.3 | 2026-09-09 | The WPLP Cookie Consent WordPress plugin before 4.4.2 does not perform nonce or capability checks on one of its cookie scanner AJAX actions, allowing any auth… |
CVE-2026-84908 | Medium | 5.3 | 2026-09-09 | The WPFunnels plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.12.13. This is due to the plugin registering the… |
CVE-2026-82848 | Medium | 5.3 | 2026-09-09 | The Masteriyo LMS WordPress plugin before 3.4.0 does not perform any authorization check before returning a course enrolment record over its REST API, allowin… |
CVE-2026-82185 | Medium | 4.3 | 2026-09-09 | The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have capability or nonce checks on some of its A/B testing actions, allowing any authenticated… |
CVE-2026-82184 | Medium | 5.3 | 2026-09-09 | The WPLP Cookie Consent WordPress plugin before 4.4.2 does not have any authorisation or CSRF checks when storing visitor consent state, and the code that doe… |
CVE-2026-75905 | Medium | 4.3 | 2026-09-09 | The WP Recipe Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 10.8.0. This is due to the plugin not prop… |
CVE-2026-75861 | Medium | 6.5 | 2026-09-09 | The Ultimate Gift Cards for WooCommerce WordPress plugin before 3.2.10 does not verify that the user redeeming a gift card is its intended recipient, allowing… |
CVE-2026-19946 | Medium | 4.3 | 2026-09-09 | The Awesome Support plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 6.3.9. This is due to a missing capability ch… |
CVE-2026-18042 | Medium | 5.3 | 2026-09-09 | The WP Travel WordPress plugin before 12.0.2 does not verify that the requester is authorized to act on the booking targeted by one of its front-end payment-m… |
CVE-2026-11821 | Medium | 5.4 | 2026-09-09 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass in all versions up… |
CVE-2026-87073 | Medium | 6.5 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87072 | High | 7.1 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87048 | Medium | 5.4 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87037 | Medium | 5.4 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-87036 | High | 8.1 | 2026-09-09 | Tanium addressed an improper access controls vulnerability in Comply. |
CVE-2026-12956 | Medium | 5.3 | 2026-09-09 | The WP Event Solution (Eventin) plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 4.1.22 via the create_item() hand… |
CVE-2026-87631 | Medium | 6.5 | 2026-09-09 | Missing authorization in DOM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to potentially leak sensitive information via a crafted HTML pag… |
CVE-2026-87622 | Medium | 4.3 | 2026-09-09 | Missing authorization in FedCM in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromium… |
CVE-2026-87611 | Low | 3.1 | 2026-09-09 | Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to obtain cross-… |
CVE-2026-87606 | High | 8.1 | 2026-09-09 | Missing authorization in SiteIsolation in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass sit… |
CVE-2026-87605 | Medium | 5.3 | 2026-09-09 | Missing authorization in Contacts in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged soci… |
CVE-2026-87603 | Medium | 6.5 | 2026-09-09 | Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML p… |
CVE-2026-87569 | High | 8.8 | 2026-09-09 | Missing authorization in Views in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restrict… |
CVE-2026-87560 | Medium | 4.3 | 2026-09-09 | Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page… |
CVE-2026-87557 | Medium | 4.3 | 2026-09-09 | Missing authorization in LocalNetworkAccess in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypas… |
CVE-2026-87556 | Medium | 4.3 | 2026-09-09 | Missing authorization in Browser in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted HTML page… |
CVE-2026-87552 | Medium | 5.5 | 2026-09-09 | Missing authorization in TrustedWebActivities in Google Chrome on on Android prior to 153.0.8010.36 allowed a local attacker to obtain sensitive information vi… |
CVE-2026-87543 | Medium | 4.3 | 2026-09-09 | Missing authorization in Core in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass site isolati… |