CWE-862 · Missing Authorization (page 8)
Page 8 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-15247 | Medium | 5.4 | 2026-09-05 | The Search Atlas SEO WordPress plugin before 2.6.24 does not perform a nonce or capability check before processing a settings update in one of its early-prior… |
CVE-2026-83628 | Medium | 4.3 | 2026-09-05 | The Theme My Login plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 7.1.15 on Multisite installations. This is due… |
CVE-2026-52766 | Critical | 9.1 | 2026-09-05 | YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a supp… |
CVE-2026-86091 | High | 7.1 | 2026-09-04 | ntopng before 6.7.260717 fails to check user privileges in the pools bulk-delete endpoint, allowing authenticated non-administrators to delete all host pools a… |
CVE-2026-86090 | High | 7.1 | 2026-09-04 | ntopng before 6.7.260717 fails to perform authorization checks in the delete endpoints and recipients REST v2 handlers. Authenticated non-administrator users c… |
CVE-2026-82684 | High | 8.1 | 2026-09-04 | Tycon Systems TPDIN-Monitor-WEB3 versions 2.2.9 and prior are vulnerable to a Missing Authorization vulnerability. This could allow an attacker to extract syst… |
CVE-2026-53769 | Medium | 6.5 | 2026-09-04 | Avo is a framework to create admin panels for Ruby on Rails apps. From version 2.28.0 to before version 3.32.0, Avo's direct attachment upload endpoint lacks s… |
CVE-2026-63464 | High | 7.7 | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. From version 0.6.0 to before version 0.7.2, non-admin operators (role user) can set allow… |
CVE-2026-53602 | | 2026-09-04 | nebula-mesh is a self-hosted control plane for Slack Nebula mesh VPN. Prior to version 0.3.7, two related authorization gaps let a host that should no longer b… | |
CVE-2026-78328 | Critical | 9.1 | 2026-09-04 | A missing authorization vulnerability in the SonicWall Network Security Manager (NSM) On-Prem Management interface allows a lower-privileged Admin user to esca… |
CVE-2026-78970 | Medium | 6.5 | 2026-09-04 | JeecgBoot 3.9.2 and earlier contains an authorization bypass vulnerability in the SystemApiController component. An authenticated attacker with any valid JWT t… |
CVE-2026-85669 | Medium | 6.5 | 2026-09-04 | potpie through 2.0.0 fails to verify user ownership on the POST /conversations/{conversation_id}/code-changes/sync endpoint. Authenticated attackers can write… |
CVE-2026-85651 | High | 8.5 | 2026-09-04 | Trigger.dev versions before 4.5.2 fail to validate environment membership during run replay operations, allowing authenticated attackers to inject task runs in… |
CVE-2026-85605 | Medium | 5.3 | 2026-09-04 | Slink before 1.12.3 fails to properly authorize access to image comment endpoints, allowing unauthenticated attackers to read comment threads via GET /api/imag… |
CVE-2026-19081 | Medium | 4.3 | 2026-09-04 | Missing Authorization vulnerability in Gastromenum Gastromenum Ticket and QR Menu System allows Accessing Functionality Not Properly Constrained by ACLs. This… |
CVE-2026-85589 | | 2026-09-04 | phpMyFAQ before 4.2.0-alpha.2 contains a missing authorization vulnerability in the admin dashboard API endpoints searches and content-health that enforce only… | |
CVE-2026-85578 | Medium | 6.5 | 2026-09-04 | SiYuan through 3.8.1 contains an authorization bypass vulnerability in the /api/file/getFile endpoint that allows readers to retrieve files from notebooks expl… |
CVE-2026-19043 | Medium | 4.3 | 2026-09-04 | Missing Authorization vulnerability in Menulux Software Inc. Menulux Portal allows Accessing Functionality Not Properly Constrained by ACLs. This issue affect… |
CVE-2026-85512 | High | 7.3 | 2026-09-04 | A security flaw has been discovered in SourceCodester Class and Exam Timetabling System 1.0. This vulnerability affects unknown code of the file /admin/session… |
CVE-2026-27347 | Medium | 5.3 | 2026-09-04 | Missing Authorization vulnerability in Crocoblock JetPopup allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects JetPopu… |
CVE-2026-82923 | Critical | 9.8 | 2026-09-04 | The AI Website Builder WordPress plugin (GitHub build) 1.0.0 does not perform any authorisation or nonce check on its REST API routes, allowing unauthenticated… |
CVE-2026-85533 | | 2026-09-04 | An authorization flaw in MISP allowed an authenticated user to submit a sharing_group_id without verifying that the user was authorized to use the referenced S… | |
CVE-2026-85311 | Medium | 5.3 | 2026-09-04 | Missing Authorization vulnerability in Kings Plugins MarketKing allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Ma… |
CVE-2026-32480 | Medium | 5.3 | 2026-09-04 | Missing Authorization vulnerability in WC Lovers WCFM Membership allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects W… |
CVE-2026-84066 | Low | 3.1 | 2026-09-04 | The Directorist: AI-Powered Business Directory, Listings & Classified Ads WordPress plugin before 8.9 does not verify that the requesting user owns the post be… |
CVE-2026-79632 | Medium | 5.3 | 2026-09-04 | The WPFunnels WordPress plugin before 3.13.0 does not perform any authorisation or nonce check in one of its opt-in submission handlers, and takes the notific… |
CVE-2026-67398 | | 2026-09-04 | Missing authorization vulnerability has been discovered in 2Checkout payment gateway of WHMCS from 8.13.0 before 8.13.7, from 9.0.0 before 9.0.8, all other EOL… | |
CVE-2026-85433 | Critical | 9.8 | 2026-09-03 | MOOS essential-moos pShare through 10.0.1 fails to properly authorize PSHARE_CMD messages, allowing any publisher to reconfigure network routes and listeners a… |
CVE-2026-70178 | High | 8.5 | 2026-09-03 | Missing authorization in Microsoft Fabric allows an authorized attacker to elevate privileges over a network. |
CVE-2026-85395 | High | 7.1 | 2026-09-03 | UnoPim before 2.1.3 fails to include integration store, update, and key-generation routes in its ACL map, allowing any admin user to bypass permission checks… |
CVE-2026-85390 | High | 7.1 | 2026-09-03 | Checkmate through 3.11.0 omits the isAllowed role guard middleware on maintenance-window, notification, and check-deletion routes, allowing read-only users to… |
CVE-2026-78596 | Medium | 4.3 | 2026-09-03 | Missing Authorization in Kibana Leading to Unauthorized Modification of Data / Missing Authorization (CWE-862) in Kibana can lead to unauthorized modification… |
CVE-2026-78595 | Medium | 4.3 | 2026-09-03 | Missing Authorization in Kibana Leading to Information Disclosure / Missing Authorization (CWE-862) in the Kibana Fleet feature can lead to information disclos… |
CVE-2026-63219 | High | 8.6 | 2026-09-03 | GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatte… |
CVE-2026-85309 | Medium | 5.3 | 2026-09-03 | Missing Authorization vulnerability in Supsystic Ultimate Maps by Supsystic allows Exploiting Incorrectly Configured Access Control Security Levels. This issu… |
CVE-2026-85306 | Medium | 6.5 | 2026-09-03 | Missing Authorization vulnerability in Cascadia Web Services MountDev AI MCP Connector for WordPress allows Exploiting Incorrectly Configured Access Control Se… |
CVE-2026-85304 | Medium | 5.3 | 2026-09-03 | Missing Authorization vulnerability in Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) allows Exploiting Incorrectly Conf… |
CVE-2026-84847 | High | 7.5 | 2026-09-03 | Unauthenticated Broken Access Control in Quick Event Manager <= 9.17 versions. |
CVE-2026-84779 | High | 8.1 | 2026-09-03 | Subscriber Broken Access Control in Agentimus – AI SEO, llms.txt & MCP for AI Agents <= 1.51.0 versions. |
CVE-2026-84758 | Medium | 6.5 | 2026-09-03 | Unauthenticated Broken Access Control in Business Directory <= 6.4.26 versions. |
CVE-2026-84757 | High | 8.2 | 2026-09-03 | Unauthenticated Settings Change in WP Compress <= 7.21.28 versions. |
CVE-2026-84755 | Medium | 6.5 | 2026-09-03 | Unauthenticated Broken Access Control in Mail Mint <= 1.31.0 versions. |
CVE-2026-84754 | Medium | 6.5 | 2026-09-03 | Unauthenticated Broken Access Control in WPFunnels <= 3.12.13 versions. |
CVE-2026-84238 | Critical | 9.8 | 2026-09-03 | Unauthenticated Broken Access Control in YITH Request a Quote for WooCommerce Premium < 4.46.0 versions. |
CVE-2026-84215 | Medium | 6.5 | 2026-09-03 | Unauthenticated Broken Access Control in Timetics <= 1.0.61 versions. |
CVE-2026-55658 | High | 7.7 | 2026-09-03 | Gardens v2 is a modular governance framework that enables communities to create and manage multiple governance pools with customizable parameters and voting me… |
CVE-2026-85226 | Medium | 4.3 | 2026-09-03 | MISP contains an authorization flaw in the OnDemand correlation engine where correlations were calculated solely from matching attribute values without applyin… |
CVE-2026-85213 | High | 7.6 | 2026-09-03 | Kill Bill through 0.24.21 fails to enforce permission annotations on several AdminResource endpoints including getQueueEntries, invalidatesCache, and putOutOfR… |
CVE-2026-85212 | High | 8.3 | 2026-09-03 | CRMEB contains an authentication bypass vulnerability in the verifyAuth() method of SystemRoleServices.php that returns true from both conditional branches. Su… |
CVE-2026-85210 | Medium | 4.3 | 2026-09-03 | Oppia's AdminRoleHandler GET endpoint in core/controllers/admin.py is decorated with open_access, allowing any registered user to enumerate privileged accounts… |
CVE-2026-84989 | High | 7.1 | 2026-09-03 | ntopng is a web-based network traffic monitoring application. In versions 6.7.0 through 6.7.260717, two REST v2 endpoints that manage ntopng's tag/badge featur… |
CVE-2026-78069 | | 2026-09-03 | Joomla Extension - j2commerce.com - Missing authorization on Apps controller delegation chain in J2Store 1.0.0-3.3.21, 4.0.0-4.0.21, 4.1.0-4.1.6 - `J2StoreCont… | |
CVE-2026-53635 | High | 7.6 | 2026-09-02 | Open edX Platform enables the authoring and delivery of online learning at any scale. Prior to commit 59bb6d6, the view function set_course_mode_price() at lms… |
CVE-2026-45730 | High | 8.3 | 2026-09-02 | Nuclio is a "Serverless" framework for Real-Time Events and Data Processing. Prior to version 1.16.0, there is a vulnerability in Nuclio Dashboard's project ma… |
CVE-2026-84674 | Medium | 5.4 | 2026-09-02 | Missing permission checks in Jenkins XebiaLabs XL Deploy Plugin 26.1.0 and earlier allow attackers with Overall/Read permission to enumerate credentials IDs of… |
CVE-2026-84661 | Medium | 5.4 | 2026-09-02 | A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds awaited by the `waitForBuild` step… |
CVE-2026-84660 | Medium | 5.4 | 2026-09-02 | A missing permission check in Jenkins Pipeline: Build Step Plugin 599.v4b_67ea_11b_152 and earlier causes downstream builds triggered by the `build` step to be… |
CVE-2026-84659 | Medium | 4.3 | 2026-09-02 | Jenkins Script Security Plugin 1412.v7737b_3405f86 and earlier does not enforce a permission check in the method that controls the "Force the use of the sandbo… |
CVE-2026-84657 | Medium | 4.2 | 2026-09-02 | In Jenkins 2.579 and earlier, LTS 2.568.2 and earlier, the build CLI command does not check the Item/Cancel permission when using the -s flag to cancel a build… |
CVE-2026-84656 | Medium | 4.3 | 2026-09-02 | A missing permission check in Jenkins 2.579 and earlier, LTS 2.568.2 and earlier allows attackers with Item/Read permission on at least one job to read build p… |
CVE-2026-84653 | Low | 3.5 | 2026-09-02 | Jenkins 2.421 through 2.579 (both inclusive), LTS 2.426.1 through 2.568.2 (both inclusive) does not correctly perform permission checks in the Appearance confi… |
CVE-2026-18058 | High | 7.5 | 2026-09-02 | The mobile Smart Connect dashboard UI was subject to manipulation by 3rd party apps. When paired with a phishing attack, this manipulation could result in esca… |
CVE-2026-78601 | Medium | 5.5 | 2026-09-02 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to a Kib… |
CVE-2026-17563 | Medium | 5.3 | 2026-09-02 | The User Frontend WordPress plugin before 4.3.11 does not enforce its subscription-purchase requirement when processing frontend post submissions, only when re… |
CVE-2025-15485 | High | 8.2 | 2026-09-02 | The Auto x LINE WordPress plugin through 1.0.0 does not have authorization checks in some of its REST endpoints, allowing unauthenticated users to call them an… |
CVE-2026-81269 | Medium | 5.3 | 2026-09-02 | Missing Authorization vulnerability in Drupal Data field allows Forceful Browsing. This issue affects Data field versions: from 0.0.0 to 2.0.13. |
CVE-2026-81166 | Medium | 5.3 | 2026-09-02 | Missing Authorization vulnerability in Drupal Digital Signage Framework allows Forceful Browsing. This issue affects Digital Signage Framework versions: from 0… |
CVE-2026-81164 | Medium | 5.4 | 2026-09-02 | Missing Authorization vulnerability in Drupal Entity PDF allows Forceful Browsing. This issue affects Entity PDF versions: from 0.0.0 to 2.1.5. |
CVE-2026-84835 | Medium | 5.3 | 2026-09-02 | Missing Authorization vulnerability in DimaFreund Rentsyst rentsyst allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects… |
CVE-2026-84805 | Medium | 4.3 | 2026-09-02 | Kimai versions from 2.61.0 before 2.63.0 fail to disable admin-only work-contract preferences for low-privilege users in the PATCH /api/users/{id}/preferences… |
CVE-2026-84802 | Medium | 4.3 | 2026-09-02 | Craft CMS versions from 5.7.0 before 5.10.12 contain an information disclosure vulnerability in AssetsController::actionMoveInfo that fails to enforce volume p… |
CVE-2026-84801 | High | 8.8 | 2026-09-02 | Craft CMS versions before 5.10.11 fail to validate admin status in the actionGetPasswordResetUrl endpoint, allowing non-admin users with administrateUsers perm… |
CVE-2026-84800 | High | 7.1 | 2026-09-02 | Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 contain a missing authorization vulnerability in AssetsController::actionReplaceFile. When a request supplies sou… |
CVE-2026-84798 | High | 7.1 | 2026-09-02 | Craft CMS versions >= 5.0.0-RC1 and < 5.10.11 fail to perform an independent authorization check in ElementsController::actionDeleteForSite(). The method loads… |
CVE-2026-84797 | Medium | 6.3 | 2026-09-02 | Craft CMS versions before 5.10.11 contain an authorization bypass vulnerability in ElementsController::actionDuplicate() that allows authenticated users with c… |
CVE-2026-84794 | High | 7.1 | 2026-09-02 | Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset… |
CVE-2026-84792 | Medium | 4.3 | 2026-09-02 | Craft CMS versions before 5.10.11 contain a broken access control vulnerability in the element-indexes/save-elements endpoint that allows control panel users t… |
CVE-2026-84760 | Medium | 5.3 | 2026-09-02 | Unauthenticated Broken Access Control in Ultimate Gift Cards For WooCommerce <= 3.2.9 versions. |
CVE-2026-84217 | Medium | 5.4 | 2026-09-02 | Missing Authorization vulnerability in Mamunur Rashid Classified Listing classified-listing allows Accessing Functionality Not Properly Constrained by ACLs.Thi… |
CVE-2026-82223 | Medium | 6.5 | 2026-09-02 | Unauthenticated Broken Access Control in WP Event SOlution <= 4.1.22 versions. |
CVE-2026-81427 | Medium | 4.3 | 2026-09-02 | The WC Vendors WordPress plugin before 2.7.2.1 does not verify that the vendor submitting a front-end order shipment status change owns the referenced order… |
CVE-2026-77787 | Low | 2.7 | 2026-09-02 | The Rank Math SEO WordPress plugin before 1.0.277 does not perform a capability check when bulk metadata updates target taxonomy terms, and reuses the supplie… |
CVE-2026-74927 | Medium | 5.3 | 2026-09-02 | The MultiVendorX WordPress plugin before 5.0.15 does not have proper authorisation controls on one of its REST API listing routes, allowing unauthenticated us… |
CVE-2026-14357 | High | 8.8 | 2026-09-02 | The DevKit Pro plugin for WordPress is vulnerable to Missing Authorization in versions up to, and including, 2.3.0. This is due to a missing capability check a… |
CVE-2026-14215 | Medium | 6.5 | 2026-09-02 | The Booking for Appointments and Events Calendar WordPress plugin before 2.4.9 does not require authentication or a valid request token before running the pos… |
CVE-2026-84715 | High | 8.8 | 2026-09-02 | FeatherPanel versions before 1.3.7.10 fail to validate permissions in the SubuserController updateSubuser handler, allowing authenticated subusers to modify th… |
CVE-2026-84328 | Low | 3.1 | 2026-09-02 | Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process to bypass web or… |
CVE-2026-84323 | Medium | 5.3 | 2026-09-02 | Missing authorization in FileSystem in Google Chrome prior to 152.0.7977.75 allowed a remote attacker who had compromised the renderer process and leveraged so… |
CVE-2026-84470 | Medium | 6.4 | 2026-09-01 | A flaw was found in Ansible Automation Platform's automation-controller (AWX). The Bulk Job Launch API (POST /api/v2/bulk/job_launch/) authorizes the requested… |
CVE-2026-78608 | Medium | 6.5 | 2026-09-01 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Privilege Abuse (CAPEC-122). An authorization control was not applied to an in… |
CVE-2026-78607 | Medium | 5.4 | 2026-09-01 | Missing Authorization (CWE-862) in the Elasticsearch custom inference service can lead to information disclosure via Privilege Abuse (CAPEC-122). A user holdin… |
CVE-2026-78603 | Medium | 4.3 | 2026-09-01 | Missing Authorization (CWE-862) in Kibana can lead to information disclosure via Exploiting Incorrectly Configured Access Control Security Levels (CAPEC-180)… |
CVE-2026-78597 | Medium | 4.3 | 2026-09-01 | Missing Authorization (CWE-862) in the Kibana Entity Store feature can lead to unauthorized credential creation via Accessing Functionality Not Properly Constr… |
CVE-2026-84204 | Medium | 6.5 | 2026-09-01 | GROWI contains an access control vulnerability in the GET /_api/v3/attachment/:id endpoint that fails to validate page access permissions. Authenticated attack… |
CVE-2026-13611 | Medium | 5.3 | 2026-09-01 | The KiviCare WordPress plugin before 4.5.5 does not perform authorization checks on some of its REST endpoints, allowing unauthenticated attackers to disclose… |
CVE-2026-19948 | Medium | 5.3 | 2026-09-01 | The Cozy Blocks – Page Builder for Gutenberg Editor & FSE with 700+ Patterns, 58 Blocks & Templates plugin for WordPress is vulnerable to authorization bypass… |
CVE-2026-82746 | | 2026-09-01 | Missing Authorization vulnerability in ash-project ash allows an actor to update records forbidden by resource policies through the atomic path of Ash.update_m… | |
CVE-2026-82882 | High | 8.8 | 2026-08-31 | Devtron through 2.2.0 fails to enforce authorization checks on the GET /orchestrator/api-token/webhook endpoint, allowing authenticated users to retrieve admin… |
CVE-2026-82394 | | 2026-08-31 | Sulu is an open-source PHP content management system based on the Symfony framework. Prior to versions 2.6.25 and 3.0.8, the preview-link endpoint and src/Sulu… | |
CVE-2026-81892 | High | 8.1 | 2026-08-31 | EasyAdmin is a fast and modern admin generator for Symfony applications. From 4.0.0 until 4.29.16 and 5.5.1, EasyAdmin serves all backend requests through a si… |