CWE-862 · Missing Authorization (page 7)
Page 7 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-87537 | High | 8.1 | 2026-09-09 | Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to potentially e… |
CVE-2026-87534 | Critical | 9.8 | 2026-09-09 | Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system… |
CVE-2026-87522 | Medium | 6.5 | 2026-09-09 | Missing authorization in WebView in Google Chrome on on Android prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to potentially b… |
CVE-2026-87513 | Medium | 6.5 | 2026-09-09 | Missing authorization in ControlledFrame in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system acces… |
CVE-2026-87511 | Medium | 4.3 | 2026-09-09 | Missing authorization in DevTools in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain cross-origin data via a crafted Chrome extension… |
CVE-2026-87498 | Low | 3.1 | 2026-09-09 | Missing authorization in WebUI in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin… |
CVE-2026-87493 | Medium | 6.5 | 2026-09-09 | Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access res… |
CVE-2026-87487 | High | 8.3 | 2026-09-09 | Missing authorization in FileSystem in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process and leveraged so… |
CVE-2026-87475 | Medium | 6.5 | 2026-09-09 | Missing authorization in Omnibox in Google Chrome prior to 153.0.8010.36 allowed a remote attacker leveraging social engineering to bypass system access restri… |
CVE-2026-87443 | Medium | 6.5 | 2026-09-09 | Missing authorization in Actor in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted HTML page. (Chro… |
CVE-2026-87441 | Medium | 6.5 | 2026-09-09 | Missing authorization in Downloads in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to bypass system access restrictions via a crafted Chrome… |
CVE-2026-87434 | Low | 3.1 | 2026-09-09 | Missing authorization in CORS in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass web origin p… |
CVE-2026-87431 | High | 7.5 | 2026-09-09 | Missing authorization in Extensions in Google Chrome prior to 153.0.8010.36 allowed a remote attacker to obtain sensitive information via a crafted Chrome exte… |
CVE-2026-87429 | Medium | 6.5 | 2026-09-09 | Missing authorization in ServiceWorker in Google Chrome prior to 153.0.8010.36 allowed a remote attacker who had compromised the renderer process to bypass sys… |
CVE-2026-86996 | Medium | 5.4 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the workflow setting named This workflow can be called by was enforced by the E… |
CVE-2026-86994 | Medium | 4.3 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, the /rest/active-workflows endpoint returned every active workflow I… |
CVE-2026-86993 | Medium | 4.9 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 1.123.76, 2.37.7, and 2.38.2, a Log Streaming event destination could reference a generic HTTP cre… |
CVE-2026-86085 | Medium | 4.9 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /rest/roles/:slug/assignments and /rest/roles/:slug/assignments/:projectId/… |
CVE-2026-86077 | Medium | 6.5 | 2026-09-08 | n8n is an open source workflow automation platform. Prior to 2.37.7 and 2.38.2, the /chat WebSocket route accepted a resumeToken and resumed a paused execution… |
CVE-2026-81904 | | 2026-09-08 | Concrete CMS below 9.5.3 registered view assets for every sub-block of a Stack, Container, or layout area without checking whether the requesting user could vi… | |
CVE-2026-86819 | High | 7.1 | 2026-09-08 | Waves Central for macOS contains a local privilege escalation in the privileged helper service. The helper authorizes connecting XPC clients by comparing the c… |
CVE-2026-84869 | Critical | 9.9 | 2026-09-08 | A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmat… |
CVE-2026-28652 | Low | 3.1 | 2026-09-08 | In multiple functions of RangingServiceImpl.java, there is a possible MITM due to a missing permission check. This could lead to remote information disclosure… |
CVE-2026-28623 | Low | 3.3 | 2026-09-08 | In writeToParcel of BleRssiRangingCapabilities.java, there is a possible way to obtain the Bluetooth MAC address due to a missing permission check. This could… |
CVE-2026-28622 | Low | 3.3 | 2026-09-08 | In getQueryBuilderInternal of MediaProvider.java, there is a possible way to retrieve location metadata due to a permissions bypass. This could lead to local i… |
CVE-2026-28611 | High | 7.8 | 2026-09-08 | In multiple functions of NfcService.java, there is a possible silent payment session hijacking enablement due to a missing permission check. This could lead to… |
CVE-2026-28582 | Low | 3.3 | 2026-09-08 | In onCreate of ConfirmDeviceCredentialActivity.java, there is a possible unauthorized access to and modification of device credentials due to a missing permiss… |
CVE-2026-0054 | Low | 3.3 | 2026-09-08 | In isCallerAllowed of WalletContextualLocationsService.kt, there is a possible way to get wallet information due to a missing permission check. This could lead… |
CVE-2026-83942 | High | 7.8 | 2026-09-08 | Missing authorization in Windows Kernel allows an authorized attacker to elevate privileges locally. |
CVE-2026-83941 | Critical | 9.9 | 2026-09-08 | Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network. |
CVE-2026-81823 | Medium | 5.3 | 2026-09-08 | The vulnerability, if exploited, could allow an unauthenticated miscreant to perform read operations intended only for PIMBoards users, resulting in informatio… |
CVE-2026-73014 | High | 7.8 | 2026-09-08 | Missing authorization in Data Sharing Service Client allows an authorized attacker to elevate privileges locally. |
CVE-2026-72966 | Medium | 5.5 | 2026-09-08 | Missing authorization in Windows Remote Access Connection Manager allows an authorized attacker to perform tampering locally. |
CVE-2026-69724 | High | 8.8 | 2026-09-08 | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-69641 | Critical | 9.1 | 2026-09-08 | Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-69553 | High | 7.1 | 2026-09-08 | Missing authorization in Windows Hyper-V allows an authorized attacker to elevate privileges over a network. |
CVE-2026-69465 | High | 8.8 | 2026-09-08 | Missing authorization in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. |
CVE-2026-69453 | Medium | 5.5 | 2026-09-08 | Missing authorization in Microsoft Windows Search Component allows an authorized attacker to perform tampering locally. |
CVE-2026-69403 | Medium | 5.5 | 2026-09-08 | Missing authorization in Windows SMB Server allows an authorized attacker to disclose information locally. |
CVE-2026-69380 | High | 8.1 | 2026-09-08 | Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. |
CVE-2026-69377 | High | 7.8 | 2026-09-08 | Missing authorization in Windows Modern Device Management (MDM) allows an authorized attacker to elevate privileges locally. |
CVE-2026-47625 | High | 7.5 | 2026-09-08 | NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could abuse missing authorization. A successful exploit of this vulnerabili… |
CVE-2026-86840 | Critical | 9.1 | 2026-09-08 | The `vtoken-minting` and `slpx` pallets in Bifrost contain an improper authorization vulnerability in channel commission attribution. A signed account can supp… |
CVE-2026-86737 | Medium | 4.3 | 2026-09-08 | snipe-it versions before 8.7.0 fail to enforce asset view authorization in the GET /hardware/{asset}/barcode endpoint. Authenticated attackers can iterate asse… |
CVE-2026-86731 | Medium | 6.5 | 2026-09-08 | Craft CMS versions 5.0.0-RC1 through 5.10.11 are missing an admin-target guard in UsersController::actionActivateUser (the users/activate-user action). While t… |
CVE-2026-86665 | High | 7.3 | 2026-09-08 | A vulnerability was identified in aircheng-org iWebShop-5 up to 5.15. This issue affects the function Update::index of the file controllers/update.php. The man… |
CVE-2026-18851 | High | 8.8 | 2026-09-08 | Missing authorization in Ivanti Endpoint Manager Mobile before version 12.10.0.0, 12.9.0.2, and 12.8.0.4 allows a remote authenticated attacker to escalate the… |
CVE-2026-12647 | Critical | 9.9 | 2026-09-08 | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. |
CVE-2026-12646 | Critical | 9.9 | 2026-09-08 | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. |
CVE-2026-12645 | Critical | 9.9 | 2026-09-08 | A Missing Authorization vulnerability in Ivanti Neurons for ITSM before 2026.2 allows a remote authenticated attacker to execute arbitrary code on the server. |
CVE-2026-77106 | High | 8.8 | 2026-09-08 | Cvlaunchd contained a missing authorization issue affecting command execution authorization. Software customers upgrade to resolved maintenance release. Update… |
CVE-2026-3174 | High | 7.5 | 2026-09-08 | The Event Tickets and Registration plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the Stripe OAut… |
CVE-2026-2520 | Medium | 5.4 | 2026-09-08 | The Online Scheduling and Appointment Booking System – Bookly plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capabili… |
CVE-2026-9331 | High | 7.1 | 2026-09-08 | The EDD Product Catalog Feed by PixelYourSite plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due… |
CVE-2026-85400 | | 2026-09-08 | Backend administrators without system maintainer privileges were able to schedule any of the configuration:read, configuration:set, and configuration:show comm… | |
CVE-2026-77132 | | 2026-09-08 | It has been discovered that several AJAX routes used for the backend localization wizard failed to perform authorization checks. This allowed authenticated, lo… | |
CVE-2026-81790 | High | 7.5 | 2026-09-08 | Missing Authorization vulnerability in Viszt Péter Csomagpontok és szállítási címkék WooCommerce-hez allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2026-81781 | High | 7.1 | 2026-09-08 | Missing Authorization vulnerability in Unbounce Unbounce Landing Pages unbounce allows Exploiting Incorrectly Configured Access Control Security Levels. This… |
CVE-2026-76963 | Medium | 4.3 | 2026-09-08 | Due to a missing authorization check in Application Server ABAP of SAP NetWeaver and ABAP Platform, an authenticated attacker could gain unauthorized access to… |
CVE-2026-76962 | Medium | 4.3 | 2026-09-08 | SAP S/4HANA (Manage Bank Chains app) does not perform sufficient authorization checks within certain affected functionality. An attacker with low privileges co… |
CVE-2026-86438 | High | 7.2 | 2026-09-07 | Lara Dashboard before 1.3.2 fails to authorize the MarketplaceModuleBrowser installModule Livewire action, allowing non-Superadmin administrators to install mo… |
CVE-2026-86436 | Medium | 5.4 | 2026-09-07 | Lara Dashboard before 1.3.2 fails to authorize access to the post-builder image and video upload endpoints, allowing authenticated accounts without content per… |
CVE-2026-86499 | Medium | 4.3 | 2026-09-07 | In JetBrains YouTrack before 2026.1.14047 predefined search fields leaked all group names to any user, regardless of visibility permission |
CVE-2026-86496 | Medium | 4.3 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18769 missing access control on Helpdesk authorized reporters exposed reporter email addresses |
CVE-2026-86495 | Medium | 6.5 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18687 missing permission checks allowed creating knowledge base articles in inaccessible projects |
CVE-2026-86494 | High | 7.7 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18634 cloning a whiteboard allowed unauthorized changes to links on inaccessible issues |
CVE-2026-86479 | High | 8.1 | 2026-09-07 | In JetBrains YouTrack before 2026.2.18788, 2026.1.14055, 2025.3.161254 missing authorisation allowed access to restricted REST API resources via IDOR |
CVE-2026-86307 | Medium | 4.3 | 2026-09-07 | A security vulnerability has been detected in light0011 cms c774dce31c6df0055568a8d5c53d964d99be199d/f72cf46f601efb2a0618c3814cc2f61380b38930. This vulnerabili… |
CVE-2026-8279 | Medium | 5.3 | 2026-09-07 | The Masteriyo LMS plugin for WordPress is vulnerable to unauthorized data deletion due to a missing capability check on the 'delete_item_permissions_check' fun… |
CVE-2026-86451 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP allow authenticated users to retrieve object-reference records by UUID through EventGraphTool::get_reference_data() without first che… |
CVE-2026-86441 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP contain inconsistent authorization checks across dashboard widgets that display organisation information. Several organisation-rela… |
CVE-2026-86418 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP expose organisation metadata through the dashboard organisation picker without applying the same visibility restrictions enforced by… |
CVE-2026-86417 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP inconsistently enforced email-address visibility in DashboardsController::listTemplates(). The query always fetched User.email, whi… |
CVE-2026-86416 | Medium | 5.4 | 2026-09-07 | ILIAS versions before 9.23, 10.11, and 11.4 contain an authorization bypass vulnerability in ilObjGroupGUI where saveMapSettingsObject() and updateGroupTypeObj… |
CVE-2026-86408 | Medium | 6.5 | 2026-09-07 | Affected versions of MISP do not enforce parent-event visibility when serving cryptographic keys through CryptographicKeysController::view(). The vulnerable… |
CVE-2026-61410 | Critical | 9.4 | 2026-09-07 | Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains a Missing Authorization vulnerability… |
CVE-2026-12853 | Medium | 5.4 | 2026-09-07 | The Flamingo plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.6.2. This is due to the plugin not properly ver… |
CVE-2026-86347 | Medium | 6.5 | 2026-09-07 | Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile() because the ACL entry for templates/uploadFile used the wild… |
CVE-2026-86342 | Medium | 4.3 | 2026-09-07 | Affected versions of MISP contain improper authorization checks in the freetext feed preview functionality. The preview performed correlation lookups against a… |
CVE-2026-86332 | Medium | 6.5 | 2026-09-07 | A flaw was found in odh-dashboard in Red Hat OpenShift AI. The backend-for-frontend route GET /api/nim-serving/:nimResource reads Kubernetes Secrets using the… |
CVE-2026-86281 | Medium | 4.3 | 2026-09-07 | A security flaw has been discovered in SourceCodester Syllabus-Aligned Learning Management & Examination System 1.0. This impacts an unknown function. Performi… |
CVE-2026-86274 | Medium | 5.3 | 2026-09-07 | A security vulnerability has been detected in projeto-siga siga up to 11.0.2.10/11.0.2.13/11.1.1. This affects the function ExAutenticacaoController.autenticar… |
CVE-2026-86271 | Medium | 4.7 | 2026-09-07 | A vulnerability was found in FluentCMS up to 0.0.5. This affects the function GetAccessible of the file src/Backend/FluentCMS.Services/Permissions/PermissionMa… |
CVE-2026-86283 | | 2026-09-06 | MISP's UiBeta theme collection view (app/View/Themed/UiBeta/Collections/view.ctp) performed a secondary query of member events by UUID without applying the cal… | |
CVE-2026-86254 | Medium | 6.8 | 2026-09-06 | wger versions through master contain an incomplete authorization bypass in wger/core/views/user.py where three views retain the original gym-scope check using… |
CVE-2026-86182 | Medium | 4.3 | 2026-09-06 | A vulnerability was determined in diem-project diem up to 5.1.3. This affects the function executeCommand of the file dmAdminPlugin/modules/dmConsole/actions/a… |
CVE-2026-85038 | Medium | 5.3 | 2026-09-06 | The B2BKing — Ultimate WooCommerce B2B and Wholesale Plugin — Wholesale Prices, Bulk Order Form & More WordPress plugin before 5.2.40 does not verify that a ro… |
CVE-2026-13159 | Medium | 4.3 | 2026-09-06 | The Real Estate Papi WordPress theme through 1.0.5 does not perform capability or CSRF checks on one of its AJAX actions, allowing any authenticated user, such… |
CVE-2026-86194 | | 2026-09-05 | Grav Form Plugin before 9.1.22 fails to verify page authorization when resolving forms by name across pages, allowing anonymous visitors to execute form action… | |
CVE-2026-15550 | Medium | 4.3 | 2026-09-05 | The Ninja Forms - Save Progress plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 3.0.30. This is due to the lack o… |
CVE-2026-12843 | Medium | 5.4 | 2026-09-05 | The LearnDash LMS plugin for WordPress is vulnerable to authorization bypass in versions 4.25.0 - 5.1.6. This is due to the plugin not properly verifying that… |
CVE-2025-9049 | High | 8.8 | 2026-09-05 | The Nokri – Job Board WordPress Theme theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'nokri_ac… |
CVE-2026-86178 | Medium | 5.4 | 2026-09-05 | Pixelfed through 0.12.9 fails to validate follower status in StoryComposeController react and comment endpoints, allowing authenticated users to access followe… |
CVE-2026-86177 | High | 8.8 | 2026-09-05 | Pterodactyl Panel before 1.14.1 fails to validate action-specific permissions in scheduled task creation, allowing subusers with only schedule.update permissio… |
CVE-2026-86118 | Medium | 4.3 | 2026-09-05 | gonic versions before 0.22.0 fail to validate administrator privileges in the startScan endpoint, allowing any authenticated user to trigger media library resc… |
CVE-2026-86116 | Medium | 6.5 | 2026-09-05 | Metabase versions before 0.63.1 fail to enforce data analyst permission checks on glossary API endpoints, allowing any authenticated user to create, modify, an… |
CVE-2026-86114 | Medium | 6.5 | 2026-09-05 | Arcane versions before 2.0.0 fail to properly restrict template operations, allowing default user role accounts to create, modify, and delete compose templates… |
CVE-2026-75018 | Medium | 4.3 | 2026-09-05 | The Custom Contact Forms plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 7.16. This is due to the plugin not p… |
CVE-2026-84927 | Low | 2.7 | 2026-09-05 | The EmbedPress WordPress plugin before 4.6.4 does not perform a sufficient authorization check on one of its Google Reviews REST API routes, allowing users wi… |
CVE-2026-84901 | Medium | 4.9 | 2026-09-05 | The Eventin WordPress plugin before 4.1.22 does not properly check authorization on several of its event-management REST routes, allowing users with contribut… |