CWE-306— Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.— MITRE CWE catalog

3,514 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-306page 59 of 71

CVE-2025-55070MEDIUMCVSS 6.5EG 6.5
2025-11-14
Mattermost versions <11 fail to enforce multi-factor authentication on WebSocket connections which allows unauthenticated users to access sensitive information via WebSocket events
CVE-2025-40817MEDIUMCVSS 6.5EG 6.5
2025-11-11
A vulnerability has been identified in LOGO! 12/24RCE (6ED1052-1MD08-0BA2) (All versions < V1.84.05), LOGO! 12/24RCEo (6ED1052-2MD08-0BA2) (All versions < V1.84.05), LOGO! 230RCE (6ED1052-1FB08-0BA2) (All versions < V1.84.05), LOGO! 230RCE…
CVE-2025-10746MEDIUMCVSS 6.5EG 6.5
2025-10-04
The Integrate Dynamics 365 CRM plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 1.0.9. This is due to missing capability checks and nonce verification on functions hooked to 'init'. This makes…
CVE-2025-7045MEDIUMCVSS 6.5EG 6.5
2025-09-06
The Cloud SAML SSO plugin for WordPress is vulnerable to Identity Provider Deletion due to a missing capability check on the delete_config action of the csso_handle_actions() function in all versions up to, and including, 1.0.19. This make…
CVE-2025-6226MEDIUMCVSS 6.5EG 6.5
2025-07-18
Mattermost versions 10.5.x <= 10.5.6, 10.8.x <= 10.8.1, 10.7.x <= 10.7.3, 9.11.x <= 9.11.16 fail to verify authorization when retrieving cached posts by PendingPostID which allows an authenticated user to read posts in private channels the…
CVE-2025-32896MEDIUMCVSS 6.5EG 6.5
2025-06-19
# Summary Unauthorized users can perform Arbitrary File Read and Deserialization attack by submit job using restful api-v1. # Details Unauthorized users can access `/hazelcast/rest/maps/submit-job` to submit job. An attacker can set extr…
CVE-2025-27803MEDIUMCVSS 6.5EG 6.5
2025-05-21
The devices do not implement any authentication for the web interface or the MQTT server. An attacker who has network access to the device immediately gets administrative access to the devices and can perform arbitrary administrative actio…
CVE-2025-4560MEDIUMCVSS 6.5EG 6.5
2025-05-12
The ISOinsight from Netvision has a Missing Authentication vulnerability, allowing unauthenticated remote attackers to access certain system functions. These functions include viewing the administrator list, viewing and editing IP settings…
CVE-2025-32377MEDIUMCVSS 6.5EG 6.5
2025-04-18
Rasa Pro is a framework for building scalable, dynamic conversational AI assistants that integrate large language models (LLMs). A vulnerability has been identified in Rasa Pro where voice connectors in Rasa Pro do not properly implement a…
CVE-2025-3474MEDIUMCVSS 6.5EG 6.5
2025-04-09
Missing Authentication for Critical Function vulnerability in Drupal Panels allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Panels: from 0.0.0 before 4.9.0.
CVE-2024-57725MEDIUMCVSS 6.5EG 6.5
2025-02-14
An issue in the Arcadyan Livebox Fibra PRV3399B_B_LT allows a remote or local attacker to modify the GPON link value without authentication, causing an internet service disruption via the /firstconnection.cgi endpoint.
CVE-2024-51362MEDIUMCVSS 6.5EG 6.5
2024-11-05
The LSC Smart Connect Indoor IP Camera V7.6.32 is vulnerable to an information disclosure issue where live camera footage can be accessed through the RTSP protocol on port 8554 without requiring authentication. This allows unauthorized use…
CVE-2024-48442MEDIUMCVSS 6.5EG 6.5
2024-10-24
Incorrect access control in Shenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 allows attackers to access the SSH protocol without authentication.
CVE-2024-35294MEDIUMCVSS 6.5EG 6.5
2024-10-02
An unauthenticated remote attacker may use the devices traffic capture without authentication to grab plaintext administrative credentials.
CVE-2024-35151MEDIUMCVSS 6.5EG 6.5
2024-08-22
IBM OpenPages with Watson 8.3 and 9.0 could allow authenticated users access to sensitive information through improper authorization controls on APIs.
CVE-2024-6347MEDIUMCVSS 6.5EG 6.5
2024-08-15
* Unprotected privileged mode access through UDS session in the Blind Spot Detection Sensor ECU firmware in Nissan Altima (2022) allows attackers to trigger denial-of-service (DoS) by unauthorized access to the ECU's programming session. …
CVE-2024-7079MEDIUMCVSS 6.5EG 6.5
2024-07-24
A flaw was found in the Openshift console. The /API/helm/verify endpoint is tasked to fetch and verify the installation of a Helm chart from a URI that is remote HTTP/HTTPS or local. Access to this endpoint is gated by the authHandlerWithU…
CVE-2024-39601MEDIUMCVSS 6.5EG 6.5
2024-07-22
A vulnerability has been identified in CPCI85 Central Processing/Communication (All versions < V5.40), SICORE Base system (All versions < V1.4.0). Affected devices allow a remote authenticated user or an unauthenticated user with physical …
CVE-2024-33622MEDIUMCVSS 6.5EG 6.5
2024-06-18
Missing authentication for critical function vulnerability exists in ID Link Manager and FUJITSU Software TIME CREATOR. If this vulnerability is exploited, sensitive information may be obtained and/or the information stored in the database…
CVE-2024-5952MEDIUMCVSS 6.5EG 6.5
2024-06-13
Deep Sea Electronics DSE855 Restart Missing Authentication Denial-of-Service Vulnerability. This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of Deep Sea Electronics DSE855 devices. Aut…
CVE-2024-5947MEDIUMCVSS 6.5EG 6.5
2024-06-13
Deep Sea Electronics DSE855 Configuration Backup Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of Deep Sea Elec…
CVE-2024-1076MEDIUMCVSS 6.5EG 6.5
2024-05-08
The SSL Zen WordPress plugin before 4.6.0 does not properly prevent directory listing of the private keys folder, as it only relies on the use of .htaccess to prevent visitors from accessing the site's generated private keys, which allows…
CVE-2021-34983MEDIUMCVSS 6.5EG 6.5
2024-05-07
NETGEAR Multiple Routers httpd Missing Authentication for Critical Function Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of multiple …
CVE-2023-41186MEDIUMCVSS 6.5EG 6.5
2024-05-03
D-Link DAP-1325 CGI Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to access various functionality on affected installations of D-Link DAP-1325 routers. Authentication is n…
CVE-2023-27357MEDIUMCVSS 6.5EG 6.5
2024-05-03
NETGEAR RAX30 GetInfo Missing Authentication Information Disclosure Vulnerability. This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR RAX30 routers. Authentication is…
CVE-2022-38057MEDIUMCVSS 6.5EG 6.5
2024-03-25
Missing Authorization vulnerability in ThemeHunk Advance WordPress Search Plugin.This issue affects Advance WordPress Search Plugin: from n/a through 1.2.1.
CVE-2023-46096MEDIUMCVSS 6.5EG 6.5
2023-11-14
A vulnerability has been identified in SIMATIC PCS neo (All versions < V4.1). The PUD Manager of affected products does not properly authenticate users in the PUD Manager web service. This could allow an unauthenticated adjacent attacker t…
CVE-2023-4506MEDIUMCVSS 6.5EG 6.5
2023-09-27
The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible …
CVE-2023-35873MEDIUMCVSS 6.5EG 6.5
2023-07-11
The Runtime Workbench (RWB) of SAP NetWeaver Process Integration - version SAP_XITOOL 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical dat…
CVE-2023-35872MEDIUMCVSS 6.5EG 6.5
2023-07-11
The Message Display Tool (MDT) of SAP NetWeaver Process Integration - version SAP_XIAF 7.50, does not perform authentication checks for certain functionalities that require user identity. An unauthenticated user might access technical da…
CVE-2023-34761MEDIUMCVSS 6.5EG 6.5
2023-06-28
An unauthenticated attacker within BLE proximity can remotely connect to a 7-Eleven LED Message Cup, Hello Cup 1.3.1 for Android, and bypass the application's client-side chat censor filter.
CVE-2022-4240MEDIUMCVSS 6.5EG 6.5
2023-05-30
Missing Authentication for Critical Function vulnerability in Honeywell OneWireless allows Authentication Bypass. This issue affects OneWireless version 322.1
CVE-2023-28761MEDIUMCVSS 6.5EG 6.5
2023-04-11
In SAP NetWeaver Enterprise Portal - version 7.50, an unauthenticated attacker can attach to an open interface and make use of an open API to access a service which will enable them to access or modify server settings and data, leading t…
CVE-2022-48291MEDIUMCVSS 6.5EG 6.5
2023-03-27
The Bluetooth module has an authentication bypass vulnerability in the pairing process. Successful exploitation of this vulnerability may affect confidentiality.
CVE-2023-27983MEDIUMCVSS 6.5EG 6.5
2023-03-21
A CWE-306: Missing Authentication for Critical Function vulnerability exists in the Data Server TCP interface that could allow deletion of reports from the IGSS project report directory, this would lead to loss of data when an attacker abu…
CVE-2021-37234MEDIUMCVSS 6.5EG 6.5
2023-02-03
Incorrect Access Control vulnerability in Modern Honey Network commit 0abf0db9cd893c6d5c727d036e1f817c02de4c7b allows remote attackers to view sensitive information via crafted PUT request to Web API.
CVE-2020-22661MEDIUMCVSS 6.5EG 6.5
2023-01-20
In Ruckus R310 10.5.1.0.199, Ruckus R500 10.5.1.0.199, Ruckus R600 10.5.1.0.199, Ruckus T300 10.5.1.0.199, Ruckus T301n 10.5.1.0.199, Ruckus T301s 10.5.1.0.199, SmartCell Gateway 200 (SCG200) before 3.6.2.0.795, SmartZone 100 (SZ-100) befo…
CVE-2022-35136MEDIUMCVSS 6.5EG 6.5
2022-10-13
Boodskap IoT Platform v4.4.9-02 allows attackers to make unauthenticated API requests.
CVE-2022-31260MEDIUMCVSS 6.5EG 6.5
2022-07-17
In Montala ResourceSpace through 9.8 before r19636, csv_export_results_metadata.php allows attackers to export collection metadata via a non-NULL k value.
CVE-2022-29877MEDIUMCVSS 6.5EG 6.5
2022-05-20
A vulnerability has been identified in SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions < V3.00), SICAM P850 (All versions …
CVE-2022-27495MEDIUMCVSS 6.5EG 6.5
2022-05-05
On all versions 1.3.x (fixed in 1.4.0) NGINX Service Mesh control plane endpoints are exposed to the cluster overlay network. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated
CVE-2022-0922MEDIUMCVSS 6.5EG 6.5
2022-04-01
The software does not perform any authentication for critical system functionality.
CVE-2021-46006MEDIUMCVSS 6.5EG 6.5
2022-03-30
In Totolink A3100R V5.9c.4577, "test.asp" contains an API-like function, which is not authenticated. Using this function, an attacker can configure multiple settings without authentication.
CVE-2021-34870MEDIUMCVSS 6.5EG 6.5
2022-01-25
This vulnerability allows network-adjacent attackers to disclose sensitive information on affected installations of NETGEAR XR1000 1.0.0.52_1.0.38 routers. Authentication is not required to exploit this vulnerability. The specific flaw exi…
CVE-2021-43333MEDIUMCVSS 6.5EG 6.5
2022-01-01
The Datalogic DXU service on (for example) DL-Axist devices does not require authentication for configuration changes or disclosure of configuration settings.
CVE-2021-20152MEDIUMCVSS 6.5EG 6.5
2021-12-30
Trendnet AC2600 TEW-827DRU version 2.08B01 lacks proper authentication to the bittorrent functionality. If enabled, anyone is able to visit and modify settings and files via the Bittorent web client by visiting: http://192.168.10.1:9091/tr…
CVE-2021-37420MEDIUMCVSS 6.5EG 6.5
2021-09-21
Zoho ManageEngine ADSelfService Plus before 6112 is vulnerable to mail spoofing.
CVE-2021-32659MEDIUMCVSS 6.5EG 6.5
2021-06-16
Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier, if a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key wh…
CVE-2021-32453MEDIUMCVSS 6.5EG 6.5
2021-05-17
SITEL CAP/PRX firmware version 5.2.01 allows an attacker with access to the local network, to access via HTTP to the internal configuration database of the device without any authentication. An attacker could exploit this vulnerability in …
CVE-2021-1246MEDIUMCVSS 6.5EG 6.5
2021-01-13
Cisco Finesse, Cisco Virtualized Voice Browser, and Cisco Unified CVP OpenSocial Gadget Editor Unauthenticated Access Vulnerability A vulnerability in the web management interface of Cisco Finesse, Cisco Virtualized Voice Browser, and C…

Map vulnerabilities like CWE-306 to your infrastructure

EchelonGraph correlates every CVE — across CWE-306 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →