CWE-862 · Missing Authorization (page 6)
Page 6 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-63100 | Medium | 6.5 | 2026-07-17 | Maybe through 0.6.0 contains a missing authorization vulnerability that allows authenticated low-privilege member-role users to access and modify global hostin… |
CVE-2026-15783 | | 2026-07-17 | A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user with write access to any repository to read… | |
CVE-2026-12715 | | 2026-07-17 | Missing Authorization in Google Cloud Firebase Studio versions prior to 2026-04-15 on Google Cloud Platform allows an attacker to download other users' deploye… | |
CVE-2026-16017 | Medium | 6.3 | 2026-07-17 | A security flaw has been discovered in mosaxiv clawlet up to 0.2.10. Impacted is the function list/remove of the file tools/tool_cron.go of the component cron… |
CVE-2026-11575 | High | 7.5 | 2026-07-17 | The PhonePe Payment Solutions WordPress plugin before 3.1.0 does not properly verify the authenticity of incoming payment callbacks: the secret used to validat… |
CVE-2026-15349 | Medium | 4.3 | 2026-07-17 | The ERP: Complete HR, Accounting & CRM Suite Built for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includ… |
CVE-2026-13765 | High | 7.5 | 2026-07-17 | The LearnPress – WordPress LMS Plugin for Create and Sell Online Courses plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions u… |
CVE-2026-8616 | Medium | 5.3 | 2026-07-17 | The Fense Proxy & VPN Blocker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce valid… |
CVE-2026-62235 | Medium | 6.3 | 2026-07-17 | Grav Flex-Objects before version 1.4.3 contains a broken access control vulnerability in the admin-next REST API that allows authenticated users with only api… |
CVE-2026-62233 | High | 8.8 | 2026-07-17 | grav-plugin-api before 1.0.6 fails to validate super-admin status in createApiKey, generate2fa, and disable2fa endpoints, allowing non-super api.users.write ma… |
CVE-2026-62232 | High | 7.4 | 2026-07-17 | Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FASecret task checks only user existence… |
CVE-2026-62218 | High | 8.8 | 2026-07-17 | OpenClaw 2026.1.20 before 2026.5.27 contain an authorization bypass vulnerability in the device.pair.approve feature that allows lower-trust callers to bypass… |
CVE-2026-62207 | High | 8.8 | 2026-07-17 | OpenClaw versions before 2026.6.5 contain an authentication bypass vulnerability that allows lower-trust callers to reach admin-scoped tools. Attackers can per… |
CVE-2026-62206 | High | 7.1 | 2026-07-17 | OpenClaw versions before 2026.6.9 contain a missing authorization vulnerability in Discord moderation actions. In affected versions, a lower-trust caller or co… |
CVE-2026-62205 | High | 7.1 | 2026-07-17 | OpenClaw versions 2026.4.12-beta.1 before 2026.6.6 contain a missing-authorization vulnerability in the MS Teams message actions feature. When the affected fea… |
CVE-2026-45334 | | 2026-07-16 | Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content-locking feature returned lock information without checking… | |
CVE-2026-44176 | | 2026-07-16 | Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the `pages.access` permission during page draft rendering. P… | |
CVE-2026-61718 | Medium | 5.4 | 2026-07-16 | bunkerweb is an Open-source and next-generation Web Application Firewall (WAF). From 1.6.2 until 1.6.12, the BunkerWeb web UI BiscuitMiddleware authorization b… |
CVE-2026-47089 | Medium | 4.3 | 2026-07-16 | An issue was discovered in cyrus-imapd in Cyrus IMAP through 3.12.2. LISTRIGHTS os not limited to users with admin access. An authenticated user could call IMA… |
CVE-2026-46515 | | 2026-07-16 | Frogman provides headless PBX control through MCP and HTTP API. Prior to 1.6.3, PERM_READ access was sufficient to call fm_list_managers, fm_list_pinsets, fm_s… | |
CVE-2026-55548 | Medium | 4.3 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, the PacketsApi.exportPackets endpoint in yamcs-core/src/main/java/org/yamcs/http/api/PacketsA… |
CVE-2026-44595 | Medium | 4.3 | 2026-07-16 | Yamcs is a mission control framework. Prior to 5.12.7, the IAM API endpoints listUsers, getUser, listGroups, and getGroup in yamcs-core did not enforce the req… |
CVE-2026-63082 | Medium | 5.4 | 2026-07-16 | Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agen… |
CVE-2026-57206 | High | 8.6 | 2026-07-16 | SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.206, several plugin va… |
CVE-2026-57205 | Medium | 4.3 | 2026-07-16 | SimpleChat is a secure AI conversation application with personal and group workspaces for document-grounded interactions. Prior to 0.241.203, the authenticated… |
CVE-2026-55440 | Medium | 6.5 | 2026-07-16 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. Prior to 3.0.7, the COMMAND_RESULTS handler in ufo/server/ws/handl… |
CVE-2026-54568 | Medium | 4.3 | 2026-07-16 | Microsoft UFO open-source framework for intelligent automation across devices and platforms. From 3.0.0 until 3.0.6, a client connected to the UFO WebSocket se… |
CVE-2026-15610 | Medium | 4.3 | 2026-07-16 | The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inc… |
CVE-2026-15407 | Medium | 4.3 | 2026-07-16 | The Themify Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.7.7. This is due to the plugin not prope… |
CVE-2026-15350 | Medium | 4.3 | 2026-07-16 | The The Cache Purger plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.20. This is due to the plugin not pro… |
CVE-2026-15106 | Medium | 5.3 | 2026-07-16 | The WPBot – AI ChatBot for Live Support, Lead Generation, AI Services plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inc… |
CVE-2026-12907 | Low | 2.7 | 2026-07-16 | The RTMKit WordPress plugin before 2.0.9 does not perform a proper capability check on one of its -builder AJAX actions, allowing users with at least the Autho… |
CVE-2026-15336 | Medium | 4.3 | 2026-07-16 | The Catch Themes Demo Import plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.3. This is due to the catch_themes… |
CVE-2026-12434 | Medium | 4.3 | 2026-07-16 | The List category posts plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 0.95.0 via the sanitize_stat… |
CVE-2026-53447 | Medium | 6.5 | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.35, the Wekan cloneBoard Meteor method in models/import.js uses caller-supplied sourceBoardId to buil… |
CVE-2026-53445 | | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.32, the Wekan copyBoard Meteor DDP method in server/publications/boards.js copies a board by caller-s… | |
CVE-2026-53444 | | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan OIDC-related Meteor methods in packages/wekan-oidc/oidc_server.js, server/models/org.js, an… | |
CVE-2026-52892 | Medium | 6.5 | 2026-07-15 | Wekan is open source kanban built with Meteor. Prior to 9.32, Wekan REST handlers in server/models/customFields.js use read-level Authentication.checkBoardAcce… |
CVE-2026-54052 | Critical | 9.9 | 2026-07-15 | n8n-MCP is an MCP server that provides AI assistants access to n8n node documentation, properties, and operations. Prior to 2.56.1, in HTTP mode with multi-ten… |
CVE-2026-33684 | Medium | 5.3 | 2026-07-15 | WWBN AVideo is an open source video platform. Prior to version 29.0, Privilege Escalation is possible through unguarded permission parameters in signUp API, wh… |
CVE-2026-56742 | Medium | 5.9 | 2026-07-15 | Cilium is a networking, observability, and security solution. Prior to 1.17.17, 1.18.11, and 1.19.5, Cilium clusters using Gateway API allow users with permiss… |
CVE-2026-52870 | High | 7.6 | 2026-07-15 | The MCP Python SDK, called mcp on PyPI, is a Python implementation of the Model Context Protocol (MCP). From 1.23.0 until 1.27.2, default handlers installed by… |
CVE-2026-62348 | Medium | 5.4 | 2026-07-15 | TDengine is a time-series database optimized for Internet of Things devices. Prior to 3.4.1.15, TDengine Enterprise allowed an authenticated low-privilege SQL… |
CVE-2026-59255 | High | 7.1 | 2026-07-15 | BloodHound through 9.4.0, fixed in commit 8f79035, contains a missing authorization vulnerability in the custom-nodes API endpoints that allows any authenticat… |
CVE-2026-53514 | High | 7.7 | 2026-07-15 | Better Auth is an authentication and authorization library for TypeScript. Prior to 1.6.11, and in 1.6.14 and later when invitation IDs can be obtained outside… |
CVE-2025-32781 | Medium | 6.5 | 2026-07-15 | Apollo is a reliable configuration management system suitable for microservice configuration management scenarios. Prior to 2.5.0, Apollo Portal does not verif… |
CVE-2026-46459 | | 2026-07-15 | ICU Scandinavia Boomerang is vulnerable to a missing authentication flaw in its device receiver endpoints. This allows an unauthenticated remote attacker to re… | |
CVE-2026-61440 | Medium | 6.5 | 2026-07-15 | PraisonAI Platform before 0.1.9 fails to properly authorize label and issue-label mutations, allowing workspace members to rename and recolor shared labels and… |
CVE-2026-14251 | High | 7.7 | 2026-07-15 | A flaw was found in the OpenShift GitOps operator. The ClusterRole reconciler does not validate resource ownership when reconciling ClusterRole objects. A name… |
CVE-2026-15752 | High | 7.3 | 2026-07-14 | A vulnerability was found in zhinianboke xianyu-auto-reply up to dcb445ad97816ad65299a7580ee0c8c8f929da84. Affected is an unknown function of the file /api/v1/… |
CVE-2026-53633 | Critical | 9.8 | 2026-07-14 | Vitest is a testing framework powered by Vite. From 3.0.0 until 3.2.5, 4.1.8, and 5.0.0-beta.4, Vitest Browser Mode exposed a cdp() API that forwarded raw Chro… |
CVE-2026-55052 | High | 8.8 | 2026-07-14 | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. |
CVE-2026-58279 | Medium | 6.5 | 2026-07-14 | Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network. |
CVE-2026-60119 | Medium | 5.4 | 2026-07-14 | Hi.Events before 1.11.0 contains a cross-site scripting vulnerability that allows authenticated attackers with event creation or edit permissions to inject arb… |
CVE-2026-60118 | Medium | 5.3 | 2026-07-14 | Hi.Events before 1.11.0 contains a missing server-side visibility enforcement vulnerability that allows unauthenticated attackers to purchase hidden tickets by… |
CVE-2026-52839 | Low | 3.3 | 2026-07-14 | Easy!Appointments is a self hosted appointment scheduler. Versions prior to 1.6.0 correctly filter provider-scoped appointments in the `appointments/search` re… |
CVE-2026-14504 | | 2026-07-14 | An authorization bypass in Nexus Repository 3's component upload API allowed a user with only read/browse privileges on a Swift, Terraform, or Conda hosted rep… | |
CVE-2026-12988 | Medium | 6.4 | 2026-07-14 | The WP 2FA WordPress plugin before 3.1.1.2 does not verify that the email address supplied during two-factor authentication setup belongs to the user, allowin… |
CVE-2026-11802 | Medium | 5.3 | 2026-07-14 | The FoodBook Lite - Online Food Ordering System plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.5.6. The re… |
CVE-2026-44771 | Medium | 4.3 | 2026-07-14 | SAP S/4HANA Draft operation does not perform necessary authorization checks for an authenticated user, a restricted user could access information within the en… |
CVE-2026-44770 | Medium | 4.3 | 2026-07-14 | SAP Create Single Payment does not perform necessary authorization checks for an authenticated user, a restricted user could access specific entity set keys re… |
CVE-2026-62328 | High | 7.5 | 2026-07-13 | 9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by se… |
CVE-2026-62194 | High | 8.8 | 2026-07-13 | OpenClaw versions 2026.5.20 before 2026.6.9 contain a privilege escalation vulnerability in plugin install commands that allows lower-trust callers to execute… |
CVE-2026-62191 | High | 7.1 | 2026-07-13 | OpenClaw versions 2026.6.6 before 2026.6.9 contain an authorization bypass vulnerability in message mutation handling that allows lower-trust callers to perfor… |
CVE-2026-62186 | High | 7.6 | 2026-07-13 | OpenClaw versions before 2026.6.8 contain an authorization bypass vulnerability in OpenAI-compatible HTTP model overrides that allows lower-trust callers to pe… |
CVE-2026-58410 | High | 7.1 | 2026-07-13 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, there was an authorization flaw in the family-scoped endpoints which allowed low-… |
CVE-2026-58408 | Medium | 6.5 | 2026-07-13 | ChurchCRM is an open-source church management system. Prior to version 7.4.0, a low-privileged user can bypass the /admin/export UI and exfiltrate the entire m… |
CVE-2026-9824 | Medium | 4.3 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to check the manage_shared_channels permission in the /share-channel autocompl… |
CVE-2026-9820 | Low | 3.8 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fail to sanitize team objects returned by the scheme teams endpoint, which allows a user with the Use… |
CVE-2026-14934 | | 2026-07-13 | A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between… | |
CVE-2026-61985 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in magepeopleteam Car Rental Manager car-rental-manager allows Exploiting Incorrectly Configured Access Control Security Le… |
CVE-2026-61983 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in andy_moyle Church Admin church-admin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue… |
CVE-2026-61968 | Medium | 5.4 | 2026-07-13 | Missing Authorization vulnerability in Saad Iqbal myCred mycred allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects myCr… |
CVE-2026-61958 | Medium | 5.4 | 2026-07-13 | Missing Authorization vulnerability in Saad Iqbal License Manager for WooCommerce license-manager-for-woocommerce allows Exploiting Incorrectly Configured Acce… |
CVE-2026-61952 | Medium | 4.9 | 2026-07-13 | Missing Authorization vulnerability in Jose Vega WooCommerce Bulk Edit Products – WP Sheet Editor woo-bulk-edit-products allows Exploiting Incorrectly Configur… |
CVE-2026-59523 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-57812 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in NSquared Simply Schedule Appointments simply-schedule-appointments allows Exploiting Incorrectly Configured Access Contr… |
CVE-2026-57797 | Medium | 4.3 | 2026-07-13 | Missing Authorization vulnerability in ThemeMove EduMall edumall allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Edu… |
CVE-2026-57782 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in PressTigers Universal Clocks universal-clocks allows Exploiting Incorrectly Configured Access Control Security Levels.Th… |
CVE-2026-57781 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in Sovlix MeetingHub meetinghub allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-57779 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in themebeez Fascinate fascinate allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-57778 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in wpdevart Booking calendar, Appointment Booking System booking-calendar allows Exploiting Incorrectly Configured Access C… |
CVE-2026-57776 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in vowelweb VW Wedding vw-wedding allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2026-57774 | Medium | 5.3 | 2026-07-13 | Missing Authorization vulnerability in vowelweb VW Food Corner vw-food-corner allows Exploiting Incorrectly Configured Access Control Security Levels.This issu… |
CVE-2026-57740 | High | 7.1 | 2026-07-13 | Missing Authorization vulnerability in AcyMailing Newsletter Team AcyMailing SMTP Newsletter acymailing allows Exploiting Incorrectly Configured Access Control… |
CVE-2026-57729 | High | 7.5 | 2026-07-13 | Missing Authorization vulnerability in UX-themes Flatsome flatsome allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects F… |
CVE-2026-57727 | High | 7.5 | 2026-07-13 | Missing Authorization vulnerability in Themeum Kirki kirki allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Kirki: fr… |
CVE-2026-57705 | High | 7.5 | 2026-07-13 | Missing Authorization vulnerability in Nexcess Event Tickets event-tickets allows Exploiting Incorrectly Configured Access Control Security Levels.This issue a… |
CVE-2026-57424 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in knitpay Razorpay Payment Links for WooCommerce rzp-woocommerce allows Exploiting Incorrectly Configured Access Control S… |
CVE-2026-57419 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in Fahad Mahmood Stock Locations for WooCommerce stock-locations-for-woocommerce allows Exploiting Incorrectly Configured A… |
CVE-2026-57418 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in BoldGrid Client Invoicing by Sprout Invoices sprout-invoices allows Exploiting Incorrectly Configured Access Control Sec… |
CVE-2026-57412 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in Codemenschen Gift Vouchers gift-voucher allows Exploiting Incorrectly Configured Access Control Security Levels.This iss… |
CVE-2026-57408 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in peachpayments Peach Payments Gateway wc-peach-payments-gateway allows Exploiting Incorrectly Configured Access Control S… |
CVE-2026-57406 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in Roxnor FundEngine wp-fundraising-donation allows Exploiting Incorrectly Configured Access Control Security Levels.This i… |
CVE-2026-57405 | High | 7.1 | 2026-07-13 | Missing Authorization vulnerability in themehunk Open Shop open-shop allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-57404 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in magepeopleteam Booking and Rental Manager booking-and-rental-manager-for-woocommerce allows Exploiting Incorrectly Confi… |
CVE-2026-57400 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in WP Swings Event Tickets Manager for WooCommerce event-tickets-manager-for-woocommerce allows Exploiting Incorrectly Conf… |
CVE-2026-57395 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tour… |
CVE-2026-57392 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in Themefic Tourfic tourfic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tour… |
CVE-2026-57390 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in EDGARROJAS Extra Product Options Builder for WooCommerce additional-product-fields-for-woocommerce allows Exploiting Inc… |