CWE-862 · Missing Authorization (page 7)
Page 7 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-57378 | High | 7.5 | 2026-07-13 | Missing Authorization vulnerability in Phil Kurth Advanced Forms advanced-forms allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-57377 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in WPXPO WowAddons product-addons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affect… |
CVE-2026-57375 | Medium | 6.5 | 2026-07-13 | Missing Authorization vulnerability in FluxBuilder MStore API mstore-api allows Exploiting Incorrectly Configured Access Control Security Levels.This issue aff… |
CVE-2026-10085 | Medium | 5.4 | 2026-07-13 | Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.11.x <= 10.11.19 fail to restrict the group_constrained channel flag to public and private channels… |
CVE-2026-57830 | Critical | 9.1 | 2026-07-13 | Joomla Extension - joomshaper.com - Unauthenticated arbitrary file deletion in Helix Ultimate < 2.2.7 - The Joomla extension Helix Ultimate is vulnerable to an… |
CVE-2026-15541 | High | 7.3 | 2026-07-13 | A flaw has been found in will-moss Isaiah up to 1.36.9. The impacted element is the function Server.Handle of the file app/server/server/server.go of the compo… |
CVE-2026-15507 | Medium | 6.3 | 2026-07-12 | A vulnerability was detected in coollabsio Coolify up to 4.1.1. The impacted element is an unknown function of the file /app/Policies/ of the component Policy… |
CVE-2026-61442 | High | 7.1 | 2026-07-11 | PraisonAI Platform (praisonai-platform) before 0.1.9 fails to enforce owner/admin authorization on the PATCH routes for projects, issues, and agents, which onl… |
CVE-2026-9017 | Medium | 5.3 | 2026-07-11 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. Thi… |
CVE-2026-12994 | Medium | 5.3 | 2026-07-11 | The WCFM – Frontend Manager for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.7.27. This is du… |
CVE-2026-12738 | Medium | 4.3 | 2026-07-11 | The WP Easy Pay – Payment and Donation form Builder for Square plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-12103 | Medium | 4.3 | 2026-07-11 | The Wallet for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.6.4. This is due to the plugin no… |
CVE-2026-7620 | Medium | 4.3 | 2026-07-11 | The Notification for Telegram plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.5.1. This is due to the plugin… |
CVE-2026-7559 | Medium | 4.3 | 2026-07-11 | The Affilia – Affiliate Program & Referral Tracking for WordPress plugin for WordPress is vulnerable to unauthorized access in all versions up to, and includin… |
CVE-2026-6804 | Medium | 5.3 | 2026-07-11 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.12. This is d… |
CVE-2026-6803 | Medium | 5.3 | 2026-07-11 | The AI Chatbot & Workflow Automation by AIWU plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.4.12. This is… |
CVE-2026-3552 | Medium | 4.3 | 2026-07-11 | The SurfLink - Ultimate Link Manager plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the ajax_import_… |
CVE-2026-1832 | Medium | 4.3 | 2026-07-11 | The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base plugin for WordPress is vulnerable to unauthorized cache deletion due to a missing capability… |
CVE-2026-13250 | Medium | 5.3 | 2026-07-11 | The Solace Extra plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.5.3. This is due to the plugin not properly… |
CVE-2026-8678 | Medium | 4.3 | 2026-07-11 | The MyParcel plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.25.1. This is due to the plugin not properly ve… |
CVE-2026-10628 | Medium | 4.3 | 2026-07-11 | The Points and Rewards for WooCommerce plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.10.0. This is due to… |
CVE-2026-58590 | Medium | 5.4 | 2026-07-10 | Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0. |
CVE-2026-58589 | Medium | 5.4 | 2026-07-10 | Missing Authorization vulnerability in Drupal FlowDrop allows Forceful Browsing. This issue affects FlowDrop versions: from 0.0.0 to 1.6.0. |
CVE-2026-49394 | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.19.0, authorization bypass was possible via the update_page endpoint in Workspace because public… | |
CVE-2026-48127 | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 16.20.0 and 15.110.0, users without write access could attach files to any doctype through file-hand… | |
CVE-2026-47422 | | 2026-07-10 | Frappe is a full-stack web application framework. Prior to 15.107.5 and 16.18.2, an endpoint in reportview lacked appropriate permission checks and that has si… | |
CVE-2026-13241 | Medium | 6.5 | 2026-07-10 | Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0. |
CVE-2026-13240 | Medium | 6.5 | 2026-07-10 | Missing Authorization vulnerability in Drupal Paragraphs allows Forceful Browsing. This issue affects Paragraphs versions: from 0.0.0 to 1.21.0. |
CVE-2026-13239 | Medium | 6.5 | 2026-07-10 | Missing Authorization vulnerability in Drupal WissKI allows Forceful Browsing. This issue affects WissKI versions: from 0.0.0 to 4.2.0. |
CVE-2026-13236 | Medium | 4.2 | 2026-07-10 | Missing Authorization vulnerability in Drupal AI Agents allows Forceful Browsing. This issue affects AI Agents versions: from 0.0.0 to 1.1.4, from 1.2.0 to 1.2… |
CVE-2026-13235 | Low | 3.3 | 2026-07-10 | Missing Authorization vulnerability in Drupal AI (Artificial Intelligence) allows Forceful Browsing. This issue affects AI (Artificial Intelligence) versions… |
CVE-2026-11909 | Low | 3.3 | 2026-07-10 | Missing Authorization vulnerability in Drupal Examples for Developers allows Forceful Browsing. This issue affects Examples for Developers versions: from 0.0.0… |
CVE-2026-10768 | Critical | 9.8 | 2026-07-10 | Missing Authorization vulnerability in Drupal LocalGov Workflows allows Forceful Browsing. This issue affects LocalGov Workflows versions: from 0.0.0 to 1.6.0. |
CVE-2026-57221 | Medium | 5.0 | 2026-07-10 | RabbitMQ is a messaging and streaming broker. Prior to 3.13.15, 4.0.20, 4.1.11, and 4.2.6, RabbitMQ does not perform authorization checks on passive queue.decl… |
CVE-2026-13039 | Medium | 5.3 | 2026-07-10 | The Eventin – Event Calendar, Event Registration, Tickets & Booking (AI Powered) plugin for WordPress is vulnerable to authorization bypass due to a regression… |
CVE-2026-57850 | High | 8.3 | 2026-07-10 | RustDesk before 1.4.9 does not enforce a session's authorized connection scope on the server side, so a peer granted a limited session type (FileTransfer, Port… |
CVE-2026-55476 | Medium | 4.3 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.0, POST /account/request/{itemType}/{itemId}/{cancel_by_admin?}/{requestingUser?} accepts cance… |
CVE-2026-54329 | High | 8.5 | 2026-07-10 | Snipe-IT is an IT asset/license management system. Prior to 8.6.2, the Accessories API create path mass-assigns request parameters to the Accessory model while… |
CVE-2026-56668 | High | 8.1 | 2026-07-10 | ZITADEL is an open source identity management platform. Prior to 4.15.3, ZITADEL's OAuth2 Token Exchange endpoint for urn:ietf:params:oauth:grant-type:token-ex… |
CVE-2026-55638 | High | 8.6 | 2026-07-10 | 9Router is an AI router & token saver. Prior to 0.5.2, 9router protects /v1, /v1beta, /api/v1, and /api/v1beta in src/dashboardGuard.js but omits /codex before… |
CVE-2026-1667 | High | 7.2 | 2026-07-10 | The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and includi… |
CVE-2026-61441 | Medium | 6.5 | 2026-07-10 | PraisonAI Platform (praisonai-platform) before 0.1.9 improperly authorizes deletion of issue dependencies. The DELETE dependency route accepts either endpoint… |
CVE-2026-59796 | High | 8.1 | 2026-07-10 | In JetBrains TeamCity before 2026.1.2 pipeline modification was possible due to improper permission checks |
CVE-2026-56279 | High | 7.5 | 2026-07-10 | Capgo before 12.128.2 contains an information disclosure vulnerability in the get_orgs_v7(userid) RPC function that remains publicly invokable despite intended… |
CVE-2026-9857 | Medium | 4.3 | 2026-07-10 | The Invoice123 plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.7.0. This is due to the plugin not properly v… |
CVE-2026-11990 | Medium | 5.3 | 2026-07-10 | The KiviCare – Clinic & Patient Management System (EHR) plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 4.4.0… |
CVE-2026-1946 | Medium | 4.3 | 2026-07-10 | The GW AI Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gwaiwebu_gravitywrit… |
CVE-2026-15026 | Medium | 4.3 | 2026-07-10 | The Import and export users and customers plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.0 via… |
CVE-2026-12955 | Medium | 4.3 | 2026-07-10 | The GDPR Cookie Consent plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check and missing nonce verificatio… |
CVE-2026-11992 | Medium | 4.3 | 2026-07-10 | The Easy Appointments plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.12.27. This is due to the plugin not p… |
CVE-2026-15332 | Medium | 6.3 | 2026-07-10 | A security flaw has been discovered in zhayujie CowAgent up to 2.1.0. The impacted element is an unknown function of the file channel/channel.py of the compone… |
CVE-2026-15293 | High | 8.0 | 2026-07-10 | The WP Business Intelligence Lite plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.2.0. This is due to the pl… |
CVE-2026-15291 | High | 7.5 | 2026-07-10 | The Chat Help – Click to Chat Button & Form plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.1.3 vi… |
CVE-2026-44918 | Medium | 5.5 | 2026-07-10 | OpenStack Ironic through before 37.0.1 allows creation or modification of nodes cross-project without authorization. |
CVE-2026-11818 | Medium | 5.4 | 2026-07-10 | The WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System plugin for WordPress is vulnerable to authorization bypass in all versions up to, and… |
CVE-2026-15320 | Medium | 5.4 | 2026-07-10 | A vulnerability was detected in Sipeed PicoClaw up to 0.2.9. This vulnerability affects the function rt.ReloadConfig of the file pkg/channels/pico/pico.go. Per… |
CVE-2026-59853 | Medium | 6.5 | 2026-07-09 | SiYuan is an open-source personal knowledge management system. Prior to 3.7.1, the /api/storage/getCriteria endpoint returns saved search criteria from data/st… |
CVE-2026-46413 | Medium | 6.5 | 2026-07-09 | Discourse is an open-source discussion platform. Prior to 2026.6.0, 2026.5.1, 2026.4.2, and 2026.1.5, regular users could route direct S3 multipart uploads thr… |
CVE-2026-33802 | Medium | 5.5 | 2026-07-09 | A Missing Authorization vulnerability in the CLI of Juniper Networks Junos OS on EX Series allows a local, authenticated attacker to cause a Denial-of-Service… |
CVE-2026-54695 | High | 7.5 | 2026-07-09 | Pipecat is an open-source Python framework for building real-time voice and multimodal conversational agents. Prior to 1.4.0, the pipecat development runner re… |
CVE-2026-54005 | | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites where a role has the pages.access permission disabled allowed authenti… | |
CVE-2026-54004 | | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clea… | |
CVE-2026-49274 | | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission… | |
CVE-2026-59227 | Medium | 4.3 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.11 before 0.10.0, POST /api/v1/images/edit required only a verif… |
CVE-2026-59226 | Low | 3.1 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.9.0 before 0.10.0, execute_automation rehydrated automation owners… |
CVE-2026-59225 | Medium | 5.4 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. From 0.8.12 before 0.10.0, an authenticated non-admin user with read acce… |
CVE-2026-59217 | Medium | 4.3 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, the file upload path accepted metadata.knowledge_id and… |
CVE-2026-59216 | High | 7.7 | 2026-07-09 | Open WebUI is an extensible, feature-rich, and user-friendly self-hosted AI platform. Prior to 0.10.0, get_event_call delivered execute:python and execute:tool… |
CVE-2026-12593 | | 2026-07-09 | The implementation of an internal and undocumented Dashboard API endpoint (POST /api/users/~/{user}/tokens) forgot to ensure an HTTP request for creating an AP… | |
CVE-2026-9240 | Medium | 4.3 | 2026-07-09 | The Colissimo Officiel : Méthodes de livraison pour WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabi… |
CVE-2026-9237 | Medium | 4.3 | 2026-07-09 | The Employee, Leave and Recruitment Management System – Crew HRM plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includin… |
CVE-2026-9235 | Medium | 4.3 | 2026-07-09 | The DHL eCommerce (Benelux) for WooCommerce plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check… |
CVE-2026-9028 | Medium | 5.3 | 2026-07-09 | The CorvusPay WooCommerce Payment Gateway plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.7.4. This is due t… |
CVE-2026-9021 | Medium | 5.3 | 2026-07-09 | The Easy Invoice plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.1.19. This is due to the plugin registering th… |
CVE-2026-4298 | Medium | 4.3 | 2026-07-09 | The DSGVO All in one for WP plugin for WordPress is vulnerable to Missing Authorization in all versions up to and including 4.9. This is due to the dsgvo_reset… |
CVE-2026-12428 | Medium | 6.5 | 2026-07-09 | The Blocks for ACF Fields plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the get_all_values() function… |
CVE-2026-8996 | Medium | 6.5 | 2026-07-09 | The Backup and Staging by WP Time Capsule plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.22.26 vi… |
CVE-2026-8848 | High | 7.2 | 2026-07-09 | The Popup Maker – Boost Sales, Conversions, Optins, Subscribers with the Ultimate WP Popup Builder plugin for WordPress is vulnerable to authorization bypass i… |
CVE-2026-7558 | Medium | 5.3 | 2026-07-09 | The Age Verification & Identity Verification by Token of Trust plugin for WordPress is vulnerable to unauthorized access in all versions up to and including 4… |
CVE-2026-14245 | Critical | 9.8 | 2026-07-09 | The miniOrange OTP Login, Verification and SMS Notifications plugin for WordPress is vulnerable to Authentication Bypass leading to Administrator Account Takeo… |
CVE-2026-12406 | Medium | 5.3 | 2026-07-09 | The User Frontend: AI Powered Frontend Posting, User Directory, Profile, Membership & User Registration plugin for WordPress is vulnerable to authorization byp… |
CVE-2026-11359 | Medium | 4.3 | 2026-07-09 | The Memberships and User Profiles for WooCommerce – ProfileGrid WooCommerce Integration plugin for WordPress is vulnerable to unauthorized plugin installation… |
CVE-2026-48492 | Medium | 6.5 | 2026-07-08 | Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, the GET /api/v1/{object}/selectlist API endpoint is missing an authorization check… |
CVE-2026-35552 | High | 8.1 | 2026-07-08 | In CAXperts UPVWebServices 2.4.2212.603 through 2.7.6 and UDiTH Portal 2026.0.0 through 2026.2.0, an authenticated remote user can invoke an administrative API… |
CVE-2026-31309 | Critical | 9.8 | 2026-07-08 | Improper authorization in the /tequilapi/config/user endpoint of Mysterium Node from v1.21.1-rc0 before v1.36.0 allows an unauthenticated attacker to arbitrari… |
CVE-2026-8472 | Medium | 4.3 | 2026-07-08 | GitLab has remediated an issue in GitLab EE affecting all versions from 18.9 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain cond… |
CVE-2026-7492 | Medium | 4.3 | 2026-07-08 | GitLab has remediated an issue in GitLab CE/EE affecting all versions from 9.1 before 18.11.7, 19.0 before 19.0.4, and 19.1 before 19.1.2 that under certain co… |
CVE-2026-55542 | Medium | 4.3 | 2026-07-08 | Snipe-IT is an IT asset/license management system. Prior to version 8.6.1, Snipe-IT S3 signature image retrieval lacks authorization before temporary URL. On S… |
CVE-2026-59805 | Medium | 6.5 | 2026-07-08 | Gumroad before 2026.07.06.2 contains a broken access control vulnerability in the PurchasesController that allows authenticated sellers to manipulate purchase… |
CVE-2026-14373 | High | 7.7 | 2026-07-08 | HashiCorp Nomad and Nomad Enterprise did not enforce the allow_privileged restriction for the Docker task driver's host namespace mode options. This may allow… |
CVE-2026-59262 | Medium | 6.5 | 2026-07-08 | AFFiNE's histories GraphQL field fails to validate Doc.Read permission before exposing document edit history, allowing authenticated workspace members to retri… |
CVE-2026-60124 | | 2026-07-08 | An authorization bypass in MISP’s EventsController::importModule() allowed authenticated users or read-only API keys with event view access to persist data to… | |
CVE-2026-56250 | High | 7.5 | 2026-07-08 | Capgo before 12.128.2 allows upload-scoped API keys to modify the mutable app_versions.r2_path field through PostgREST, enabling retargeting to arbitrary R2 bu… |
CVE-2026-15034 | Medium | 4.3 | 2026-07-08 | A vulnerability has been found in flask-dashboard Flask-MonitoringDashboard up to 5.0.2. Affected by this issue is some unknown functionality. Such manipulatio… |
CVE-2026-5356 | High | 7.5 | 2026-07-08 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and… |
CVE-2026-12153 | Critical | 9.8 | 2026-07-08 | The WP Learn Manager plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.1.8. This is due to the plugin not prop… |
CVE-2026-12097 | Medium | 5.3 | 2026-07-08 | The User Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.2. This is due to the plugin not properl… |
CVE-2026-55433 | Medium | 5.4 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the devcontainer r… |
CVE-2026-55432 | Medium | 5.4 | 2026-07-08 | Coder allows organizations to provision remote development environments via Terraform. Prior to versions 2.29.7, 2.32.7, 2.33.8, and 2.34.2, the `CreateSubAgen… |
CVE-2026-59704 | High | 7.1 | 2026-07-07 | Cap's GET /api/video/ai endpoint fails to validate user ownership or membership before returning private video AI metadata including titles, summaries, and cha… |