CWE-862 · Missing Authorization (page 9)
Page 9 of 100 — CVEs classified under CWE-862, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-81762 | Medium | 6.5 | 2026-08-31 | Subscriber Broken Access Control in Booking and Rental Manager <= 2.7.6 versions. |
CVE-2026-81758 | Medium | 6.3 | 2026-08-31 | Subscriber Broken Access Control in OwnerRez API <= 1.2.6 versions. |
CVE-2026-81296 | High | 7.5 | 2026-08-31 | Unauthenticated Broken Access Control in Fluent Forms Pro Add On Pack <= 6.2.12 versions. |
CVE-2026-81278 | Medium | 5.4 | 2026-08-31 | Missing Authorization vulnerability in WPExperts Post SMTP allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Post SM… |
CVE-2026-71415 | | 2026-08-31 | Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant… | |
CVE-2026-52730 | Medium | 4.3 | 2026-08-31 | Xibo is an open source digital signage platform with a web content management system and Windows display player software. Prior to 4.4.3, missing Authorization… |
CVE-2026-79748 | Critical | 9.9 | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… |
CVE-2026-79745 | High | 7.1 | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… |
CVE-2026-79744 | High | 8.8 | 2026-08-31 | MCPHub is a unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies… |
CVE-2026-77966 | High | 8.8 | 2026-08-31 | The affected Ebyte product does not provide separation between limited and administrative management functions. A low privileged authenticated attacker coul… |
CVE-2026-19616 | High | 7.5 | 2026-08-31 | Missing Authorization vulnerability in TBC Technology Inc. KitLogistic allows Accessing Functionality Not Properly Constrained by ACLs. This issue affects Kit… |
CVE-2026-74010 | Medium | 5.3 | 2026-08-31 | Missing Authorization vulnerability in John James Jacoby bbPress allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects b… |
CVE-2026-82878 | Medium | 6.3 | 2026-08-31 | DataEase versions before 2.10.26 omit object-level authorization checks on geographic information, dashboard linkage, and chart detail REST endpoints, allowing… |
CVE-2026-82871 | High | 7.7 | 2026-08-31 | ToolJet before v3.16.208 fails to validate organization membership in database read routes, allowing any authenticated user to access other organizations' tabl… |
CVE-2026-82660 | Medium | 5.4 | 2026-08-31 | Nodemailer before 8.0.9 fails to enforce disableFileAccess and disableUrlAccess options during message normalization in jsonTransport. Attackers can read local… |
CVE-2026-77013 | Medium | 5.3 | 2026-08-31 | The 爱采集数据采集和发布插件 WordPress plugin through 1.0.0 does not restrict which of its handler methods a request may invoke, and performs no capability or nonce check… |
CVE-2026-82544 | Medium | 4.3 | 2026-08-30 | A flaw has been found in wger-project wger up to 2.6.0-alpha2. This issue affects the function reset_user_password of the file wger/gym/views/gym.py of the com… |
CVE-2026-82633 | Medium | 4.3 | 2026-08-30 | Dolibarr versions 10.0.0 before 24.0.0 fail to perform per-object authorization checks in the Users::getGroups REST API endpoint, allowing authenticated users… |
CVE-2026-82475 | High | 8.1 | 2026-08-29 | iFlytek astron-agent through 1.1.1 contains an authorization bypass vulnerability in the copyFlow endpoint that fails to validate workflow ownership. Authentic… |
CVE-2026-81346 | Medium | 4.3 | 2026-08-29 | The Frontend Admin by DynamiApps WordPress plugin before 3.29.11 does not perform a capability check on one of its AJAX actions, allowing any authenticated use… |
CVE-2026-19430 | Medium | 5.3 | 2026-08-29 | The Catfolders Document Gallery Pro WordPress plugin before 2.0.7 does not authorise some of its REST API routes, and the token identifying the requested conte… |
CVE-2026-18234 | Medium | 6.5 | 2026-08-29 | The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by its wallet payment handling belongs to the requester, and does not de… |
CVE-2026-18233 | Medium | 6.5 | 2026-08-29 | The MStore API WordPress plugin before 4.21.1 does not verify that the order targeted by one of its delivery endpoints belongs to the requester, allowing any… |
CVE-2026-82279 | High | 8.1 | 2026-08-28 | HyperDX through 1.10.1 fails to enforce role-based access controls in team management endpoints, allowing any team member to perform administrative actions. At… |
CVE-2026-82273 | Medium | 6.5 | 2026-08-28 | Mastra through 1.63.0 contains an authentication bypass vulnerability in the memory API thread ownership validation when mapUserToResourceId callback is omitte… |
CVE-2026-82267 | Medium | 5.4 | 2026-08-28 | Komodo through 2.3.2 discloses internal resource identifiers and writes audit entries before performing permission checks in the /execute and /execute/{variant… |
CVE-2026-56100 | High | 8.1 | 2026-08-28 | SpringBlade versions from 2.7.3 up to but not including 5.0.0 contain a privilege escalation vulnerability that allows authenticated attackers to create system… |
CVE-2026-55547 | Medium | 4.3 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits SystemPrivilege.ControlAccess checks from IamApi.listRoles, IamApi.getRole, and I… |
CVE-2026-55545 | Medium | 6.5 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs WebSocket subscription handlers fail to enforce the privileges required by equivalent R… |
CVE-2026-55521 | High | 8.8 | 2026-08-28 | Yamcs is a mission control framework. Prior to 5.12.8 and 5.13.2, Yamcs omits authorization checks in IndexesApi.listPacketIndex, IndexesApi.listEventIndex, Co… |
CVE-2026-55064 | Medium | 4.3 | 2026-08-28 | Vikunja is an open-source self-hosted task management platform. From 2.3.0 until 2.4.0, a user with Write but not Admin permission on a shared child project ca… |
CVE-2026-54746 | Medium | 6.4 | 2026-08-28 | Hatchet is a platform for orchestrating background tasks, AI agents, and durable workflows at scale. From 0.40.0 until 0.91.1, the Dispatcher gRPC service does… |
CVE-2026-81767 | High | 7.5 | 2026-08-28 | Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions. |
CVE-2026-81761 | Medium | 4.3 | 2026-08-28 | Subscriber Broken Access Control in WpEvently <= 5.5.0 versions. |
CVE-2026-81759 | Medium | 5.4 | 2026-08-28 | Contributor Broken Access Control in WpEvently <= 5.5.0 versions. |
CVE-2026-81284 | Medium | 4.3 | 2026-08-28 | Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions. |
CVE-2026-82245 | High | 8.1 | 2026-08-28 | Budibase before 3.41.3 fails to enforce role-based authorization on license management endpoints, allowing any authenticated user to delete license keys or man… |
CVE-2026-82242 | High | 7.7 | 2026-08-28 | Budibase versions before 3.41.3 contain a missing authorization vulnerability in the POST /api/resources/duplicate endpoint that allows authenticated builders… |
CVE-2026-82240 | High | 8.1 | 2026-08-28 | Budibase before 3.41.3 fails to validate app-scoped builder role assignments in the public user create and update endpoints, allowing an authenticated app-scop… |
CVE-2026-82239 | High | 8.1 | 2026-08-28 | Budibase before 3.41.3 fails to enforce per-table role restrictions on the POST /api/datasources/query endpoint, allowing low-privilege BASIC users to read, cr… |
CVE-2026-77701 | Medium | 5.3 | 2026-08-28 | The WCFM Marketplace WordPress plugin before 3.8.2 does not correctly verify that the person requesting a refund owns the order, allowing unauthenticated user… |
CVE-2026-12514 | Medium | 5.3 | 2026-08-28 | The Shared Files WordPress plugin before 1.7.67, shared-files-pro WordPress plugin before 1.7.70 do not perform a capability check in their file-upload handle… |
CVE-2026-75813 | High | 7.5 | 2026-08-28 | Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access or modify sensitive device settings… |
CVE-2026-75339 | High | 8.8 | 2026-08-28 | The storage endpoint /storage/upload of cjbi admin3 v3.0.0 are missing permission checks. /Any logged-in user can upload arbitrary files, and any anonymous att… |
CVE-2026-68929 | | 2026-08-28 | FastGPT is an open-source LLM platform for building AI applications on a knowledge base. In versions prior to 4.15.2, the WeChat (iLink) share-channel endpoint… | |
CVE-2026-18965 | High | 8.8 | 2026-08-28 | PayRange API is missing proper authorization on management endpoints, which allows verbose details of every device on the PayRange network to be publicly acces… |
CVE-2026-65931 | | 2026-08-27 | LimeSurvey Community Edition 7.0.5 contains an authenticated improper authorization vulnerability in the survey menu entry creation endpoint. An authenticat… | |
CVE-2026-81819 | | 2026-08-27 | Affected versions of Flowintel expose the /my_assignment/user API endpoint to any authenticated API user. The endpoint accepts a user_id parameter identifying… | |
CVE-2026-81335 | High | 7.5 | 2026-08-27 | Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch and record-name views in backend/src/b… |
CVE-2026-81279 | Medium | 5.4 | 2026-08-27 | Subscriber Broken Access Control in Push Notification for Post and BuddyPress <= 3.20 versions. |
CVE-2026-81276 | Medium | 5.3 | 2026-08-27 | Unauthenticated Broken Access Control in Kali Forms <= 2.4.23 versions. |
CVE-2026-81274 | Medium | 5.3 | 2026-08-27 | Subscriber Broken Access Control in Ditty <= 3.1.67 versions. |
CVE-2026-81272 | Medium | 4.9 | 2026-08-27 | Editor Broken Access Control in FluentPlayer Pro <= 1.3.2 versions. |
CVE-2026-80433 | High | 7.5 | 2026-08-27 | Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions. |
CVE-2026-27330 | High | 8.6 | 2026-08-27 | Unauthenticated Broken Access Control in Mobile App for WooCommerce <= 0.4.62 versions. |
CVE-2026-78137 | High | 7.5 | 2026-08-27 | The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthenticated actions, allowing unauthenticat… |
CVE-2026-13414 | Medium | 4.8 | 2026-08-27 | The CMP WordPress plugin before 4.1.18 does not perform authorization checks on one of its AJAX actions and relies on a nonce that is skipped for certain (an… |
CVE-2026-77507 | Medium | 5.3 | 2026-08-26 | Weblate is a web-based continuous localization platform used to manage software translations. In versions prior to 2026.8, Weblate's object-scoped RSS feeds do… |
CVE-2026-81035 | High | 8.1 | 2026-08-26 | Midday allows any member of a team to delete it. The delete procedure in apps/api/src/trpc/routers/team.ts authorises the caller with the team-access helper, w… |
CVE-2026-81027 | High | 8.5 | 2026-08-26 | one-api gates one of its two channel-pinning paths and not the other. middleware/auth.go permits a request to name a specific channel either through a suffix o… |
CVE-2026-54569 | Critical | 9.8 | 2026-08-26 | SENAITE.CORE is the core framework for the SENAITE laboratory information management system. From 2.0.0 to 2.6.0, the SENAITE.CORE JSON API permits unauthentic… |
CVE-2026-54523 | Critical | 9.6 | 2026-08-26 | Kyverno is a policy engine designed for cloud native platform engineering teams. From 1.18.0 until 1.18.2, the NamespacedMutatingPolicy CEL compiler exposes th… |
CVE-2026-80348 | High | 8.8 | 2026-08-26 | TarsWeb enforces its per-application roles by calling AuthService from individual controller methods, and four methods in app/controller/patch/PatchController… |
CVE-2026-80346 | High | 7.1 | 2026-08-26 | StarRocks performs no privilege check when a legacy synchronous materialized view is dropped. Every other statement type routed through AuthorizerStmtVisitor c… |
CVE-2026-19197 | Medium | 6.3 | 2026-08-26 | A user with organization administrator permissions can delete dashboard snapshots belonging to other organizations on the same Grafana instance, and can recove… |
CVE-2026-18431 | Critical | 9.8 | 2026-08-26 | The Avada theme for WordPress is vulnerable to Arbitrary File Write in all versions up to, and including, 7.16 when the Fusion Builder plugin is installed and… |
CVE-2026-77694 | Medium | 5.3 | 2026-08-26 | The Eventin WordPress plugin before 4.1.19 does not properly restrict which changes a guest checkout token is allowed to authorise on an order, allowing unaut… |
CVE-2026-75798 | Medium | 5.3 | 2026-08-26 | The AI Engine WordPress plugin before 3.7.2 does not perform an authorisation check on one of its administration-only features, relying instead on a token it… |
CVE-2026-74928 | High | 7.5 | 2026-08-26 | The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing unauthenticated users to create WordPre… |
CVE-2026-14550 | Medium | 5.3 | 2026-08-26 | The WPCafe WordPress plugin before 3.0.18 does not perform an authorization check when creating a reservation through its REST API, verifying only a publicly… |
CVE-2026-13406 | Medium | 5.3 | 2026-08-26 | The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not perform any capability or nonce check before returning taxonomy term data for an arbi… |
CVE-2026-13172 | Medium | 5.3 | 2026-08-26 | The Eventin WordPress plugin before 4.1.22 does not restrict access to non-published content by status or ownership in one of its REST API namespaces, allowin… |
CVE-2026-80193 | High | 8.8 | 2026-08-26 | Kimai before 2.62.0 fails to validate create_other_timesheet permission in the QuickEntry controller when creating new timesheets. Authenticated users with vie… |
CVE-2026-80191 | High | 7.5 | 2026-08-26 | GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated user. retrieveAttachmentFromIdParam in app… |
CVE-2026-16645 | Critical | 9.1 | 2026-08-25 | Missing Authorization vulnerability in Drupal PhotoSwipe - Responsive JavaScript Modal Image Gallery allows Forceful Browsing. This issue affects PhotoSwipe -… |
CVE-2026-15916 | Medium | 4.2 | 2026-08-25 | Missing Authorization vulnerability in Drupal Drupal core allows Forceful Browsing. This issue affects Drupal core versions: from 0.0.0 to 10.6.13, from 11.3.0… |
CVE-2026-62861 | | 2026-08-25 | TypeBot is a chatbot builder tool. Prior to 3.18.0, any authenticated non-guest workspace member can remove another workspace's public custom domain and make t… | |
CVE-2026-79286 | High | 7.4 | 2026-08-25 | Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to potentially execute arbitrary code outsid… |
CVE-2026-79212 | Medium | 4.3 | 2026-08-25 | Missing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged soc… |
CVE-2026-79208 | Medium | 5.9 | 2026-08-25 | Missing authorization in HTTP2 in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to leak sensitive information via crafted network traffic. (Ch… |
CVE-2026-79184 | Medium | 4.3 | 2026-08-25 | Missing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origi… |
CVE-2026-79154 | Medium | 6.5 | 2026-08-25 | Missing authorization in DevTools in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive informati… |
CVE-2026-79116 | Medium | 4.3 | 2026-08-25 | Missing authorization in Viz in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origin po… |
CVE-2026-79110 | Medium | 4.3 | 2026-08-25 | Missing authorization in Preload in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass web origin policy via a crafted HTML page. (Chromi… |
CVE-2026-79104 | Medium | 5.3 | 2026-08-25 | Missing authorization in Sensor in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to obtain sensitive… |
CVE-2026-79099 | Medium | 6.5 | 2026-08-25 | Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker to bypass system access restrictions via a crafted HTML page… |
CVE-2026-79086 | Medium | 5.1 | 2026-08-25 | Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to obtain sensitive information via a co-ins… |
CVE-2026-79085 | Medium | 4.3 | 2026-08-25 | Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass web origi… |
CVE-2026-79067 | Medium | 4.3 | 2026-08-25 | Missing authorization in Network in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system ac… |
CVE-2026-79058 | Critical | 9.1 | 2026-08-25 | Missing authorization in Passwords in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to spoof UI eleme… |
CVE-2026-79053 | Low | 3.1 | 2026-08-25 | Missing authorization in Lighthouse in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process and leveraged so… |
CVE-2026-79044 | Medium | 5.3 | 2026-08-25 | Missing authorization in WebAppInstalls in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer proces… |
CVE-2026-79042 | Medium | 4.3 | 2026-08-25 | Missing authorization in Payments in Google Chrome on on Android prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to potentially… |
CVE-2026-79041 | Medium | 4.3 | 2026-08-25 | Missing authorization in Browser in Google Chrome on on Mac prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to bypass web origin… |
CVE-2026-79021 | Medium | 6.5 | 2026-08-25 | Missing authorization in InterestGroups in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass sy… |
CVE-2026-78968 | Medium | 6.5 | 2026-08-25 | Missing authorization in Core in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to potentially spoof a… |
CVE-2026-78967 | Medium | 6.5 | 2026-08-25 | Missing authorization in BFCache in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass system ac… |
CVE-2026-78953 | Low | 3.1 | 2026-08-25 | Missing authorization in SiteIsolation in Google Chrome prior to 152.0.7977.65 allowed a remote attacker who had compromised the renderer process to bypass sit… |
CVE-2026-78897 | Medium | 6.5 | 2026-08-25 | Missing authorization in BrowserTag in Google Chrome prior to 152.0.7977.65 allowed a remote attacker leveraging social engineering to obtain sensitive informa… |
CVE-2026-70550 | Medium | 6.5 | 2026-08-25 | An authorization weakness in JFrog Artifactory Composer repository handling may allow an authenticated user, under specific conditions, to read package metadat… |