CWE-862— Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.— MITRE CWE catalog

8,624 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-862page 143 of 173

CVE-2026-16081MEDIUMCVSS 4.3EG 4.3
2026-07-18
A vulnerability was determined in Sipeed PicoClaw up to 0.2.9. The affected element is an unknown function of the file web/backend/api/auth.go. Executing a manipulation can lead to cross-site request forgery. The attack can be launched rem…
CVE-2026-16106MEDIUMCVSS 4.9EG 4.9
2026-07-17
A flaw was found in the admin REST API of Keycloak, a solution for identity and access management. The issue occurs when a delegated administrator attempts to remove a child role from a composite role. Due to missing authorization checks, …
CVE-2026-16123MEDIUMCVSS 6.3EG 6.3
2026-07-18
A weakness has been identified in nextlevelbuilder GoClaw up to 3.13.2. Affected by this issue is the function ToolsInvokeHandler.ServeHTTP of the file internal/http/tools_invoke.go of the component Invoke Endpoint. This manipulation cause…
CVE-2026-16197MEDIUMCVSS 6.3EG 6.3
2026-07-18
A security vulnerability has been detected in Sipeed PicoClaw up to 0.2.9. The affected element is the function handleMessageReceive of the file pkg/channels/feishu/feishu_64.go of the component Group Message Handler. Such manipulation lea…
CVE-2026-16215MEDIUMCVSS 6.5EG 6.5
2026-07-19
A security flaw has been discovered in geex-arts django-jet up to 1.0.8. This impacts an unknown function of the component OAuth Credential Revoke Handler. Performing a manipulation results in missing authorization. The attack is possible …
CVE-2026-16216MEDIUMCVSS 4.3EG 4.3
2026-07-19
A weakness has been identified in geex-arts django-jet up to 1.0.8. Affected is an unknown function of the component OAuth Handler. Executing a manipulation can lead to cross-site request forgery. The attack may be performed from remote. T…
CVE-2026-1631MEDIUMCVSS 5.4EG 5.4
2026-05-18
The Feeds for YouTube (YouTube video, channel, and gallery plugin) WordPress plugin before 2.6.4 is vulnerable to unauthorized modification of the Feeds for YouTube (YouTube video, channel, and gallery plugin) WordPress plugin before 2.6.4…
CVE-2026-1640MEDIUMCVSS 4.3EG 4.3
2026-02-18
The Taskbuilder – WordPress Project Management & Task Management plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 5.0.2. This is due to missing authorization checks on the project and task …
CVE-2026-16454MEDIUMCVSS 4.3EG 4.3
2026-07-21
In Eclipse hawkBit versions 1.0.3 and prior, a privilege escalation vulnerability (CWE-284 / CWE-862) has been identified in the Direct Device Integration (DDI) Controller. This vulnerability allows an authenticated device to escalate…
CVE-2026-1650MEDIUMCVSS 5.3EG 5.3
2026-03-07
The MDJM Event Management plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'custom_fields_controller' function in all versions up to, and including, 1.7.8.1. This makes it possib…
CVE-2026-1655MEDIUMCVSS 4.3EG 4.3
2026-02-18
The EventPrime plugin for WordPress is vulnerable to unauthorized post modification due to missing authorization checks in all versions up to, and including, 4.2.8.4. This is due to the save_frontend_event_submission function accepting a u…
CVE-2026-1656MEDIUMCVSS 5.3EG 5.3
2026-02-18
The Business Directory Plugin for WordPress is vulnerable to authorization bypass due to a missing authorization check in all versions up to, and including, 6.4.20. This makes it possible for unauthenticated attackers to modify arbitrary l…
CVE-2026-1657MEDIUMCVSS 5.3EG 5.3
2026-02-17
The EventPrime plugin for WordPress is vulnerable to unauthorized image file upload in all versions up to, and including, 4.2.8.4. This is due to the plugin registering the upload_file_media AJAX action as publicly accessible (nopriv-enabl…
CVE-2026-1667HIGHCVSS 7.2EG 7.2
2026-07-10
The SEO Plugin by Squirrly SEO plugin for WordPress is vulnerable to Arbitrary Post Creation and Stored Cross-Site Scripting in all versions up to, and including, 14.0.0 due to a leak of an API token and insufficient input sanitization and…
CVE-2026-1671MEDIUMCVSS 6.5EG 6.5
2026-02-12
The Activity Log for WordPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the winter_activity_log_action() function in all versions up to, and including, 1.2.8. This makes it poss…
CVE-2026-1674MEDIUMCVSS 6.5EG 6.5
2026-03-04
The Gutena Forms – Contact Form, Survey Form, Feedback Form, Booking Form, and Custom Form Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missing authorization within the save_gutena_forms_schema()…
CVE-2026-1720HIGHCVSS 8.8EG 8.8
2026-03-05
The WowOptin: Next-Gen Popup Maker – Create Stunning Popups and Optins for Lead Generation plugin for WordPress is vulnerable to unauthorized arbitrary plugin installation due to a missing capability check on the 'install_and_active_plug…
CVE-2026-1722MEDIUMCVSS 5.3EG 5.3
2026-02-10
The WCFM Marketplace – Multivendor Marketplace for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 3.7.0. This is due to the plugin not implementing authorization c…
CVE-2026-1734MEDIUMCVSS 5.3EG 5.3
2026-02-02
A security flaw has been discovered in Zhong Bang CRMEB up to 5.6.3. This vulnerability affects unknown code of the file crmeb/app/api/controller/v1/CrontabController.php of the component crontab Endpoint. The manipulation results in missi…
CVE-2026-1745MEDIUMCVSS 4.3EG 4.3
2026-02-02
A vulnerability was determined in SourceCodester Medical Certificate Generator App 1.0. This affects an unknown part. This manipulation causes cross-site request forgery. Remote exploitation of the attack is possible. The exploit has been …
CVE-2026-1748MEDIUMCVSS 4.3EG 4.3
2026-02-11
The Invoct – PDF Invoices & Billing for WooCommerce plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on multiple functions in all versions up to, and including, 1.6. This makes it possib…
CVE-2026-1751LOWCVSS 3.1EG 3.1
2026-02-02
A vulnerability has been discovered in GitLab CE/EE affecting all versions starting with 16.8 before 18.5.0 that could have allowed unauthorized edits to merge request approval rules under certain conditions.
CVE-2026-1781MEDIUMCVSS 6.5EG 6.5
2026-03-11
The MC4WP: Mailchimp for WordPress plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 4.11.1. This is due to the plugin trusting the `_mc4wp_action` POST parameter without validation, allowing…
CVE-2026-1786MEDIUMCVSS 6.5EG 6.5
2026-02-11
The Twitter posts to Blog plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'dg_tw_options' function in all versions up to, and including, 1.11.25. This makes it possible for u…
CVE-2026-1787MEDIUMCVSS 4.8EG 4.8
2026-02-21
The LearnPress Export Import – WordPress extension for LearnPress plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the 'delete_migrated_data' function in all versions up to, and includi…
CVE-2026-1797MEDIUMCVSS 5.3EG 5.3
2026-03-31
The Appointment Booking and Scheduler Plugin – Truebooker plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.1.4 through views php files. This makes it possible for unauthenticate…
CVE-2026-1830CRITICALCVSS 9.8EG 9.8
2026-04-09
The Quick Playground plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1.3.1. This is due to insufficient authorization checks on REST API endpoints that expose a sync code and allow arbitrar…
CVE-2026-1831LOWCVSS 2.7EG 2.7
2026-02-18
The YayMail - WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized plugin installation and activation due to missing capability checks on the 'yaymail_install_yaysmtp' AJAX action and `/yaymail/v1/addons/activate…
CVE-2026-1832MEDIUMCVSS 4.3EG 4.3
2026-07-11
The ThriveDesk – Live Chat, AI Chatbot, Helpdesk & Knowledge Base plugin for WordPress is vulnerable to unauthorized cache deletion due to a missing capability check on the 'thrivedesk_clear_cache' AJAX action in all versions up to, and …
CVE-2026-1833MEDIUMCVSS 5.3EG 5.3
2026-02-11
The WaMate Confirm – Order Confirmation plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an actio…
CVE-2026-1835MEDIUMCVSS 4.3EG 4.3
2026-02-04
A vulnerability was identified in lcg0124 BootDo up to e93dd428ef6f5c881aa74d49a2099ab0cf1e0fcb. This affects an unknown part. The manipulation leads to cross-site request forgery. The attack is possible to be carried out remotely. The exp…
CVE-2026-1860MEDIUMCVSS 4.3EG 4.3
2026-02-18
The Kali Forms plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 2.4.8. This is due to the `get_items_permissions_check()` permission callback on the `/kaliforms/v1/forms/{id}` RES…
CVE-2026-1869MEDIUMCVSS 6.5EG 6.5
2026-06-26
The User Registration & Membership – Free & Paid Memberships, Subscriptions, Content Restriction, User Profile, Custom User Registration & Login Builder plugin for WordPress is vulnerable to unauthorized modification of data due to missi…
CVE-2026-1870MEDIUMCVSS 5.3EG 5.3
2026-03-16
The Thim Kit for Elementor – Pre-built Templates & Widgets for Elementor plugin for WordPress is vulnerable to unauthorized access of data due to a missing validation checks on the 'thim-ekit/archive-course/get-courses' REST endpoint cal…
CVE-2026-1897MEDIUMCVSS 4.3EG 4.3
2026-02-05
A vulnerability was found in WeKan up to 8.20. Affected by this issue is some unknown functionality of the file server/methods/positionHistory.js of the component Position-History Tracking. The manipulation results in missing authorization…
CVE-2026-1906MEDIUMCVSS 4.3EG 4.3
2026-02-18
The PDF Invoices & Packing Slips for WooCommerce plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.0 via the `wpo_ips_edi_save_order_customer_peppol_identifiers` AJAX action du…
CVE-2026-1916HIGHCVSS 7.5EG 7.5
2026-02-25
The WPGSI: Spreadsheet Integration plugin for WordPress is vulnerable to unauthorized modification and loss of data due to missing capability checks and an insecure authentication mechanism on the `wpgsi_callBackFuncAccept` and `wpgsi_call…
CVE-2026-1925MEDIUMCVSS 4.3EG 4.3
2026-02-18
The EmailKit – Email Customizer for WooCommerce & WP plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the 'update_template_data' function in all versions up to, and including, 1.6.…
CVE-2026-1926MEDIUMCVSS 5.3EG 5.3
2026-03-18
The Subscriptions for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the `wps_sfw_admin_cancel_susbcription()` function in all versions up to, and including, 1.9.2. …
CVE-2026-1927MEDIUMCVSS 5.4EG 4.3
2026-02-05
The Greenshift – animation and page builder blocks plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the greenshift_app_pass_validation() function in all versions up to, and including,…
CVE-2026-1930MEDIUMCVSS 4.3EG 4.3
2026-04-22
The Emailchef plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the page_options_ajax_disconnect() function in all versions up to, and including, 3.5.1. This makes it possible for …
CVE-2026-1932MEDIUMCVSS 5.3EG 5.3
2026-02-14
The Appointment Booking Calendar Plugin – Bookr plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the update-appointment REST API endpoint in all versions up to, and including, 1…
CVE-2026-1934MEDIUMCVSS 4.3EG 4.3
2026-05-12
The Motors – Car Dealership & Classified Listings plugin for WordPress is vulnerable to Payment Bypass via insecure user meta update in all versions up to, and including, 1.4.103 This is due to the stm_save_user_extra_fields() function u…
CVE-2026-1935MEDIUMCVSS 4.3EG 4.3
2026-03-21
The Company Posts for LinkedIn plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.0.0. This is due to a missing capability check on the `linkedin_company_post_reset_handler()` function hooke…
CVE-2026-1937HIGHCVSS 7.2EG 9.8
2026-02-18
The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the `yaymail_import_state` AJAX action in all v…
CVE-2026-1938MEDIUMCVSS 5.3EG 5.3
2026-02-18
The YayMail – WooCommerce Email Customizer plugin for WordPress is vulnerable to unauthorized license key deletion due to a missing authorization check on the `/yaymail-license/v1/license/delete` REST endpoint in versions up to, and incl…
CVE-2026-1942MEDIUMCVSS 6.5EG 6.5
2026-02-18
The Blog2Social: Social Media Auto Post & Scheduler plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the b2s_curation_draft AJAX action in all versions up to, and including, 8.7.4…
CVE-2026-1944MEDIUMCVSS 5.3EG 5.3
2026-02-14
The CallbackKiller service widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the cbk_save() function in all versions up to, and including, 1.2. This makes it possible for un…
CVE-2026-1946MEDIUMCVSS 4.3EG 4.3
2026-07-10
The GW AI Website Builder plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the gwaiwebu_gravitywrite_disconnect_handler() function in all versions up to, and including, 1.0.1. Thi…
CVE-2026-1948MEDIUMCVSS 4.3EG 4.3
2026-03-16
The NEX-Forms – Ultimate Forms Plugin for WordPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the deactivate_license() function in all versions up to, and including, 9.1.…

Map vulnerabilities like CWE-862 to your infrastructure

EchelonGraph correlates every CVE — across CWE-862 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →