CWE-862 · Missing Authorization (page 8)
Page 8 of 92 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-58473 | Critical | 9.1 | 2026-07-07 | Cognee before 1.2.0 contains an improper access control vulnerability that allows unauthenticated attackers to overwrite the global LLM provider configuration… |
CVE-2026-55417 | | 2026-07-07 | Chevereto is a self-hosted media-sharing platform. Starting in version 3.7.5 and prior to version 4.5.4, when a user enables the private profile option, visiti… | |
CVE-2026-53730 | | 2026-07-07 | DataEase is an open source data visualization and analysis tool. Prior to 2.10.24, the /de2api/datasetData/previewSql endpoint lacks the mandatory @DePermit pe… | |
CVE-2026-50007 | | 2026-07-07 | Actual is an open-source personal finance application. Prior to 26.7.0, a missing authorization issue allows a shared user with user_access on a budget file to… | |
CVE-2026-59708 | High | 7.5 | 2026-07-07 | The GET /api/v1/public/:accessId/portfolio endpoint in ghostfolio accepts private access IDs without validating granteeUserId filtering, allowing unauthenticat… |
CVE-2026-59709 | Medium | 4.3 | 2026-07-07 | Ghostfolio's PUT /api/v1/portfolio/holding/:dataSource/:symbol/tags endpoint fails to verify Access.permissions field when processing the Impersonation-Id head… |
CVE-2026-11340 | High | 8.3 | 2026-07-07 | Missing Authorization vulnerability in HAVELSAN Inc. Liman MYS allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Liman MYS… |
CVE-2026-8377 | High | 8.2 | 2026-07-07 | Missing Authorization vulnerability in Armiya Information Technologies Ltd. Co. Access Control System (GKS) allows Collect Data from Common Resource Locations… |
CVE-2026-34048 | Critical | 9.9 | 2026-07-07 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, terminal websocket bootstrap route… |
CVE-2026-53647 | | 2026-07-07 | FOSSBilling is a free, open-source billing and client management system. In versions 0.5.3 through 0.7.2, the Guest `serviceapikey/get_info` API endpoint is ac… | |
CVE-2026-53643 | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Versions prior to 0.8.0 allow low-privileged staff accounts to perform unauthorized ac… | |
CVE-2026-53640 | | 2026-07-06 | FOSSBilling is a free, open-source billing and client management system. Prior to version 0.8.0, low-privileged staff accounts may read sensitive data via admi… | |
CVE-2026-34050 | Medium | 6.5 | 2026-07-06 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.471, the Settings/Updates Livewire comp… |
CVE-2026-14800 | Medium | 4.3 | 2026-07-06 | A weakness has been identified in imhamzaazam ecommerceFlask up to cb7d9e24c30a99379651b7493b32048126ef402b. The affected element is an unknown function. This… |
CVE-2026-6509 | High | 7.8 | 2026-07-05 | Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute Pardus Update allows Privilege Escalation. This issue affects P… |
CVE-2026-27783 | Medium | 4.3 | 2026-07-03 | Gitea versions up to and including 1.26.1 do not enforce repository-unit authorization on issue-template API endpoints. |
CVE-2026-27771 | High | 8.2 | 2026-07-03 | Gitea versions up to and including 1.26.1 have insufficient permission checks for Composer package source links, which can expose private or internal package s… |
CVE-2026-25714 | Medium | 4.3 | 2026-07-03 | Gitea versions up to and including 1.26.1 do not apply public-only token filtering consistently to the user organization API, leaving an incomplete fix for CVE… |
CVE-2026-25038 | High | 7.5 | 2026-07-03 | Gitea 1.26.2 allows unauthorized users to access labels of private organizations. |
CVE-2026-14460 | High | 8.8 | 2026-07-03 | Missing Authorization vulnerability in TUBITAK BILGEM Software Technologies Research Institute pardus-software allows Argument Injection. This issue affects p… |
CVE-2026-11398 | Medium | 5.3 | 2026-07-03 | The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inclu… |
CVE-2026-9230 | Medium | 4.3 | 2026-07-03 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-12557 | Medium | 5.3 | 2026-07-03 | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.3.29. This is due to the plug… |
CVE-2026-12729 | Medium | 4.3 | 2026-07-03 | The weDocs: AI Powered Knowledge Base, Docs, Documentation, Wiki & AI Chatbot plugin for WordPress is vulnerable to Missing Authorization in versions up to and… |
CVE-2026-59097 | Medium | 5.3 | 2026-07-02 | Taiga before 6.10.2 contains a missing authorization vulnerability that allows unauthenticated remote attackers to create default due-date records in any proje… |
CVE-2026-50282 | | 2026-07-02 | Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 and above, prior to 5.9.21 and versions 4.0.0-RC1 and above prior to 4.17.14 contain an auth… | |
CVE-2026-57760 | Medium | 5.3 | 2026-07-02 | Missing Authorization vulnerability in Sendcloud Sendcloud Shipping allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affect… |
CVE-2026-57750 | Medium | 5.3 | 2026-07-02 | Unauthenticated Broken Access Control in ez Form Calculator Premium <= 2.14.1.2 versions. |
CVE-2026-57746 | High | 7.1 | 2026-07-02 | Subscriber Broken Access Control in Booked <= 3.0.0 versions. |
CVE-2026-57731 | Medium | 6.5 | 2026-07-02 | Contributor Broken Access Control in Flatsome <= 3.20.5 versions. |
CVE-2026-57730 | Medium | 4.3 | 2026-07-02 | Subscriber Broken Access Control in Flatsome <= 3.20.5 versions. |
CVE-2026-57689 | Medium | 4.3 | 2026-07-02 | Subscriber Broken Access Control in Werkstatt <= 4.7.2 versions. |
CVE-2026-57688 | High | 8.2 | 2026-07-02 | Unauthenticated Broken Access Control in POS Entegratör <= 3.7.103 versions. |
CVE-2026-57685 | Medium | 4.3 | 2026-07-02 | Subscriber Broken Access Control in Martfury - WooCommerce Marketplace WordPress Theme <= 3.2.8 versions. |
CVE-2026-57669 | Medium | 6.5 | 2026-07-02 | Subscriber Broken Access Control in Advanced Contact form 7 DB <= 2.0.9 versions. |
CVE-2026-57355 | Medium | 6.5 | 2026-07-02 | Subscriber Broken Access Control in Classified Listing <= 5.4.2 versions. |
CVE-2026-57353 | Medium | 6.5 | 2026-07-02 | Subscriber Broken Access Control in Link Whisper Premium <= 2.9.0 versions. |
CVE-2026-39448 | High | 7.5 | 2026-07-02 | Unauthenticated Broken Access Control in NOWPayments for WooCommerce <= 1.4.0 versions. |
CVE-2026-27433 | Medium | 6.5 | 2026-07-02 | Unauthenticated Broken Access Control in Motors <= 5.6.80 versions. |
CVE-2025-69134 | High | 7.5 | 2026-07-02 | Unauthenticated Arbitrary Content Deletion in OpenAI Chatbot for WordPress – Helper <= 1.1.4 versions. |
CVE-2025-66076 | Medium | 5.3 | 2026-07-02 | Unauthenticated Broken Access Control in Woostify Sites Library <= 1.6.2 versions. |
CVE-2026-13459 | Medium | 5.3 | 2026-07-02 | The JetFormBuilder — Dynamic Blocks Form Builder plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 3.6.3. This i… |
CVE-2026-12472 | Medium | 5.3 | 2026-07-02 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-12134 | Medium | 4.3 | 2026-07-02 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to authorization bypass in all versions up to, and includ… |
CVE-2026-12122 | Medium | 5.3 | 2026-07-02 | The Kirki – Freeform Page Builder, Website Builder & Customizer plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and… |
CVE-2026-11600 | Medium | 4.3 | 2026-07-02 | The Envo's Templates & Widgets for Elementor and WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization c… |
CVE-2026-11592 | Medium | 4.3 | 2026-07-02 | The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to authorization… |
CVE-2026-50284 | | 2026-07-01 | Craft CMS is a content management system (CMS). In versions 5.0.0-RC1 through 5.9.21 and 4.0.0-RC1 through 4.17.14, theAssetsController::actionDeleteFolder() o… | |
CVE-2026-50283 | | 2026-07-01 | Craft CMS is a content management system (CMS). Versions 5.0.0-RC1 through 5.9.20, and 4.0.0-RC1 through 4.17.13 contain an authorization issue in the AssetsCo… | |
CVE-2026-55628 | Medium | 5.5 | 2026-07-01 | ImageMagick is free and open-source software used for editing and manipulating digital images. In versions prior to 7.1.2-26he, the `-concatenate` operation is… |
CVE-2026-57721 | Medium | 5.3 | 2026-07-01 | Missing Authorization vulnerability in WP Reloaded ApplyOnline allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects App… |
CVE-2026-57720 | Medium | 4.3 | 2026-07-01 | Missing Authorization vulnerability in Codexpert Inc ThumbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Th… |
CVE-2026-27409 | Medium | 5.3 | 2026-07-01 | Missing Authorization vulnerability in Webba Plugins Webba Booking allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects… |
CVE-2026-23537 | Critical | 9.1 | 2026-07-01 | A vulnerability has been identified in the Feast Feature Server’s `/save-document` endpoint that allows an unauthenticated remote attacker to write arbitrary J… |
CVE-2026-27435 | Medium | 5.3 | 2026-07-01 | Missing Authorization vulnerability in WofficeIO Woffice allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Woffice… |
CVE-2026-12435 | Medium | 4.3 | 2026-07-01 | The Motors – Car Dealership & Classified Listings Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 1.4.1… |
CVE-2026-1239 | High | 7.5 | 2026-07-01 | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to unauthorized access of data due to a missing authorization… |
CVE-2026-13468 | High | 7.5 | 2026-07-01 | The Visualizer – Tables & Charts Manager with Built-in AI Generator plugin for WordPress is vulnerable to authorization bypass in all versions up to, and inclu… |
CVE-2026-12902 | Medium | 4.3 | 2026-07-01 | The Kadence Blocks — Page Builder Toolkit for Gutenberg Editor plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-12133 | Medium | 4.3 | 2026-07-01 | The JoomSport – for Sports: Team & League, Football, Hockey & more plugin for WordPress is vulnerable to Missing Authorization to Arbitrary Group Deletion in v… |
CVE-2026-12113 | Medium | 4.3 | 2026-07-01 | The Appointment Booking Calendar plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.4.02 via the cpab… |
CVE-2026-14156 | Medium | 6.5 | 2026-06-30 | Insufficient policy enforcement in StorageAccessAPI in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process… |
CVE-2026-58448 | Medium | 6.5 | 2026-06-30 | yudao-cloud before 2026.06 contains a broken access control vulnerability in the BPM module that allows any authenticated user to access arbitrary process inst… |
CVE-2026-9132 | Medium | 6.5 | 2026-06-30 | A missing authorization vulnerability was identified in GitHub Enterprise Server that allowed an authenticated user to read source code from private repositori… |
CVE-2026-58377 | High | 8.1 | 2026-06-30 | JeecgBoot through 3.9.2 contains a broken access control vulnerability that allows authenticated low-privilege users to perform full create, read, update, and… |
CVE-2026-58373 | Medium | 4.3 | 2026-06-30 | CVAT before 2.69.0 contains an improper authorization vulnerability in QualityReportViewSet.get_queryset that allows authenticated attackers to enumerate quali… |
CVE-2026-58176 | Medium | 6.5 | 2026-06-30 | RuoYi-Vue-Plus through 5.6.2, fixed in commit 88d03d9, exposes workflow task management endpoints under /workflow/task (FlwTaskController) without any permissi… |
CVE-2026-58168 | High | 8.8 | 2026-06-30 | DeepTutor before version 1.4.10 contains an authorization bypass vulnerability that allows low-privilege users to invoke unrestricted MCP tools due to the allo… |
CVE-2026-58167 | Medium | 6.5 | 2026-06-30 | Nightingale (n9e) before 9.0.0-beta.2 exposes full datasource configurations, including plaintext database passwords, HTTP bearer tokens, HTTP basic-auth passw… |
CVE-2026-58165 | High | 8.8 | 2026-06-30 | OpenZiti through 2.0.0, fixed in commit 3027fdf, contains a privilege escalation vulnerability that allows authenticated non-admin identities with fine-grained… |
CVE-2026-54475 | High | 7.5 | 2026-06-30 | Missing Authorization vulnerability in Apache ActiveMQ Broker, Apache ActiveMQ All, Apache ActiveMQ. Apache ActiveMQ Classic temporary destinations are expect… |
CVE-2026-12349 | Medium | 5.3 | 2026-06-30 | The Premium Addons for KingComposer plugin for WordPress is vulnerable to unauthorized modification and loss of data in versions up to, and including, 1.1.1. T… |
CVE-2026-57498 | Critical | 9.6 | 2026-06-29 | Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, Coolify's API controllers consiste… |
CVE-2026-57954 | Medium | 4.3 | 2026-06-29 | Elide through 7.1.17 fails to enforce @ReadPermission on client-supplied sort expressions in SortingImpl.getValidSortingRules, allowing attackers to sort colle… |
CVE-2026-57952 | Medium | 5.3 | 2026-06-29 | Mythic before 3.4.0.60 contains an authorization bypass vulnerability in four REST endpoints (c2profile_config_check_webhook, c2profile_redirect_rules_webhook… |
CVE-2026-57949 | Medium | 6.5 | 2026-06-29 | ruoyi-vue-pro through 2026.05, fixed in commit c779a47, contains a missing authorization vulnerability in the CRM module's GET /admin-api/crm/follow-up-record/… |
CVE-2026-57946 | Low | 3.7 | 2026-06-29 | Invidious before version 2.20260626.0 contains a broken access control vulnerability that allows unauthenticated attackers to retrieve private playlist content… |
CVE-2026-57340 | Medium | 6.5 | 2026-06-29 | Unauthenticated Broken Access Control in Japanized For WooCommerce <= 2.9.12 versions. |
CVE-2026-57339 | Medium | 6.5 | 2026-06-29 | Unauthenticated Broken Access Control in Business Directory <= 6.4.23 versions. |
CVE-2026-57335 | Medium | 6.5 | 2026-06-29 | Subscriber Broken Access Control in Ads by WPQuads <= 3.0.3 versions. |
CVE-2026-57334 | Medium | 6.5 | 2026-06-29 | Unauthenticated Broken Access Control in WP User Frontend <= 4.3.7 versions. |
CVE-2026-57332 | High | 7.1 | 2026-06-29 | Subscriber Broken Access Control in Wallet System for WooCommerce <= 2.7.6 versions. |
CVE-2026-57327 | Medium | 6.3 | 2026-06-29 | Subscriber Broken Access Control in MainWP <= 6.1.1 versions. |
CVE-2025-2902 | High | 8.3 | 2026-06-29 | Improper Authorization Vulnerability of Maintenance Utility in Hitachi Virtual Storage Platform. This issue affects Hitachi Virtual Storage Platform E390, E59… |
CVE-2026-13537 | Medium | 4.3 | 2026-06-29 | A vulnerability was found in CodeAstro Human Resource Management System 1.0. Impacted is an unknown function. The manipulation results in cross-site request fo… |
CVE-2026-13484 | Medium | 5.0 | 2026-06-28 | A vulnerability has been found in MLflow up to 4666cffc7912ea606d592fc38d6a75e2935f65e7. The impacted element is an unknown function of the component Experimen… |
CVE-2026-9233 | Medium | 4.3 | 2026-06-27 | The Quiz and Survey Master (QSM) – Easy Quiz and Survey Maker plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-3462 | Medium | 6.5 | 2026-06-27 | The Frisbii Pay plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'upload_csv' and 'process_batch… |
CVE-2026-12471 | Medium | 4.3 | 2026-06-27 | The Spexo theme for WordPress is vulnerable to unauthorized access due to a missing capability check on the activate_plugin function in all versions up to, and… |
CVE-2026-12432 | Medium | 5.3 | 2026-06-27 | The WP Full Stripe Free plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 8.4.3 via the wpfs_update_failed_payment_… |
CVE-2026-11773 | Medium | 4.3 | 2026-06-27 | The Masteriyo LMS – LMS Course Builder, Quizzes & Certificates plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including… |
CVE-2026-11364 | Medium | 4.3 | 2026-06-27 | The Product Specifications for WooCommerce plugin for WordPress is vulnerable to unauthorized modification, creation, and deletion of data in versions up to an… |
CVE-2026-12404 | Medium | 5.3 | 2026-06-27 | The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 9.2.2. Thi… |
CVE-2026-50137 | Critical | 9.4 | 2026-06-26 | Budibase is an open-source low-code platform. Prior to 3.39.0, an anonymous attacker who knows or can enumerate a workspace id (app_...) and an S3-source datas… |
CVE-2026-55838 | Medium | 4.3 | 2026-06-26 | RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.7 and earlier, the real-time metrics endpoint at /rustfs/admin/v3/metrics is accessi… |
CVE-2026-55189 | High | 7.7 | 2026-06-26 | RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, when the FTP frontend is enabled, the FTP read and probe ha… |
CVE-2026-55188 | High | 8.2 | 2026-06-26 | RustFS is a distributed object storage system built in Rust. From 1.0.0-alpha.1 until 1.0.0-beta.9, RustFS contains an authorization bypass in the bucket repli… |
CVE-2026-49991 | High | 8.6 | 2026-06-26 | RustFS is a distributed object storage system built in Rust. In 1.0.0-beta.4, authenticated users with only PutObject permission on their own bucket can exploi… |
CVE-2026-47193 | High | 7.5 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.3 and 17.4.1, the journal diff endpoint discloses hidden historical field valu… |
CVE-2026-44734 | Medium | 6.5 | 2026-06-26 | OpenProject is open-source, web-based project management software. Prior to 17.3.2 and 17.4.0, a Missing Authorization vulnerability exists in OpenProject's Co… |