CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
18003 vulnerabilities reference this CWE, most recent first.
GHSA-P42X-3R46-8H27
Vulnerability from github – Published: 2026-09-02 12:31 – Updated: 2026-09-02 12:31Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users' folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.
{
"affected": [],
"aliases": [
"CVE-2026-84794"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-02T12:17:15Z",
"severity": "HIGH"
},
"details": "Craft CMS versions before 5.10.11 lack authorization checks in the assets/move-asset endpoint when force=1 is supplied. Authenticated users without peer asset permissions can move their own assets into other users\u0027 folders and force deletion of conflicting files, allowing unauthorized asset deletion and replacement.",
"id": "GHSA-p42x-3r46-8h27",
"modified": "2026-09-02T12:31:31Z",
"published": "2026-09-02T12:31:30Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/craftcms/cms/security/advisories/GHSA-9xvf-7w97-83mv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-84794"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/craft-cms-5.0.0-through-5.10.10-authorization-bypass-via-assets-move-asset"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-P43F-9XV7-J43V
Vulnerability from github – Published: 2023-05-09 03:30 – Updated: 2024-04-04 03:54In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.
{
"affected": [],
"aliases": [
"CVE-2022-48370"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-05-09T02:15:11Z",
"severity": "MODERATE"
},
"details": "In dialer service, there is a possible missing permission check. This could lead to local information disclosure with no additional execution privileges.",
"id": "GHSA-p43f-9xv7-j43v",
"modified": "2024-04-04T03:54:28Z",
"published": "2023-05-09T03:30:40Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48370"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1654776866982133761"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P448-CMRG-C3WH
Vulnerability from github – Published: 2026-09-17 15:32 – Updated: 2026-09-17 15:32Unauthenticated Broken Access Control in Booking Calendar <= 11.7 versions.
{
"affected": [],
"aliases": [
"CVE-2026-74002"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-09-17T14:17:23Z",
"severity": "MODERATE"
},
"details": "Unauthenticated Broken Access Control in Booking Calendar \u003c= 11.7 versions.",
"id": "GHSA-p448-cmrg-c3wh",
"modified": "2026-09-17T15:32:13Z",
"published": "2026-09-17T15:32:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-74002"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/booking/vulnerability/wordpress-booking-calendar-plugin-11-7-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P44Q-FMWR-JQR7
Vulnerability from github – Published: 2026-06-24 15:31 – Updated: 2026-09-25 18:58Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier does not perform a permission check in an HTTP endpoint that tests the connection to a Contrast TeamServer.
This allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key.
Additionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.
Contrast Continuous Application Security Plugin 3.12 requires Overall/Administer permission and POST requests to test the connection to a Contrast TeamServer.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.jenkins-ci.plugins:contrast-continuous-application-security"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.12"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-57297"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2026-09-25T18:58:50Z",
"nvd_published_at": "2026-06-24T14:17:35Z",
"severity": "MODERATE"
},
"details": "Jenkins Contrast Continuous Application Security Plugin 3.11 and earlier does not perform a permission check in an HTTP endpoint that tests the connection to a Contrast TeamServer.\n\nThis allows attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified username, API key, and service key.\n\nAdditionally, this HTTP endpoint does not require POST requests, resulting in a cross-site request forgery (CSRF) vulnerability.\n\nContrast Continuous Application Security Plugin 3.12 requires Overall/Administer permission and POST requests to test the connection to a Contrast TeamServer.",
"id": "GHSA-p44q-fmwr-jqr7",
"modified": "2026-09-25T18:58:50Z",
"published": "2026-06-24T15:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57297"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/contrast-continuous-application-security-plugin/commit/ddea0a815aec52c0695d8c0c7f09f9cfce4989e5"
},
{
"type": "PACKAGE",
"url": "https://github.com/jenkinsci/contrast-continuous-application-security-plugin"
},
{
"type": "WEB",
"url": "https://github.com/jenkinsci/contrast-continuous-application-security-plugin/releases/tag/contrast-continuous-application-security-3.12"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3697%20(1)"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Jenkins Contrast Continuous Application Security Plugin has a missing permission check"
}
GHSA-P474-HCMV-9RV9
Vulnerability from github – Published: 2026-10-11 00:30 – Updated: 2026-10-11 00:30JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obtain row ids from the unguarded list endpoint and submit them in the ids parameter to remove menus and buttons departments can grant to their roles.
{
"affected": [],
"aliases": [
"CVE-2026-108634"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-10T22:16:38Z",
"severity": "MODERATE"
},
"details": "JeecgBoot through 3.9.5 contains a missing authorization vulnerability that allows low-privileged authenticated users to delete department permission bindings via the DELETE /sys/sysDepartPermission/deleteBatch endpoint. Attackers can obtain row ids from the unguarded list endpoint and submit them in the ids parameter to remove menus and buttons departments can grant to their roles.",
"id": "GHSA-p474-hcmv-9rv9",
"modified": "2026-10-11T00:30:54Z",
"published": "2026-10-11T00:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-108634"
},
{
"type": "WEB",
"url": "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/JeecgBoot/poc_depart_permission_delete_batch.py"
},
{
"type": "WEB",
"url": "https://github.com/jeecgboot/JeecgBoot/blob/e3b9dc0aefe1943d9772b026f64ed671a7c82802/jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/system/controller/SysDepartPermissionController.java#L131-L136"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/jeecgboot-through-3.9.5-missing-authorization-via-sysdepartpermission-deletebatch-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-P49C-7HR8-WR97
Vulnerability from github – Published: 2025-12-09 18:30 – Updated: 2026-01-20 15:32Missing Authorization vulnerability in ergonet Ergonet Cache ergonet-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ergonet Cache: from n/a through <= 1.0.11.
{
"affected": [],
"aliases": [
"CVE-2025-62867"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-09T16:18:03Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in ergonet Ergonet Cache ergonet-varnish-cache allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Ergonet Cache: from n/a through \u003c= 1.0.11.",
"id": "GHSA-p49c-7hr8-wr97",
"modified": "2026-01-20T15:32:02Z",
"published": "2025-12-09T18:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62867"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/ergonet-varnish-cache/vulnerability/wordpress-ergonet-cache-plugin-1-0-11-broken-access-control-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/ergonet-varnish-cache/vulnerability/wordpress-ergonet-cache-plugin-1-0-11-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P49M-W88C-9W8J
Vulnerability from github – Published: 2024-06-09 15:31 – Updated: 2024-06-09 15:31Missing Authorization vulnerability in Copy Content Protection Team Secure Copy Content Protection and Content Locking.This issue affects Secure Copy Content Protection and Content Locking: from n/a through 3.7.1.
{
"affected": [],
"aliases": [
"CVE-2024-32787"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-09T13:15:51Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Copy Content Protection Team Secure Copy Content Protection and Content Locking.This issue affects Secure Copy Content Protection and Content Locking: from n/a through 3.7.1.",
"id": "GHSA-p49m-w88c-9w8j",
"modified": "2024-06-09T15:31:10Z",
"published": "2024-06-09T15:31:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-32787"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/secure-copy-content-protection/wordpress-secure-copy-content-protection-and-content-locking-plugin-3-7-1-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-P49R-834H-PJWQ
Vulnerability from github – Published: 2023-12-04 03:30 – Updated: 2023-12-07 18:30In telecom service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
{
"affected": [],
"aliases": [
"CVE-2023-42736"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-12-04T01:15:11Z",
"severity": "HIGH"
},
"details": "In telecom service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed",
"id": "GHSA-p49r-834h-pjwq",
"modified": "2023-12-07T18:30:27Z",
"published": "2023-12-04T03:30:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-42736"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/https://www.unisoc.com/en_us/secy/announcementDetail/1731138365803266049"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-P49R-XXPC-J8FJ
Vulnerability from github – Published: 2024-12-16 15:31 – Updated: 2026-04-01 18:32Missing Authorization vulnerability in 搜狐畅言 畅言评论系统 allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects 畅言评论系统: from n/a through 2.0.5.
{
"affected": [],
"aliases": [
"CVE-2024-55994"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-16T15:15:26Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in \u641c\u72d0\u7545\u8a00 \u7545\u8a00\u8bc4\u8bba\u7cfb\u7edf allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects \u7545\u8a00\u8bc4\u8bba\u7cfb\u7edf: from n/a through 2.0.5.",
"id": "GHSA-p49r-xxpc-j8fj",
"modified": "2026-04-01T18:32:51Z",
"published": "2024-12-16T15:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-55994"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/changyan/vulnerability/wordpress-plugin-2-0-5-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-P49X-Q2CV-FCX5
Vulnerability from github – Published: 2026-02-19 18:31 – Updated: 2026-02-26 21:31Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through <= 6.5.5.
{
"affected": [],
"aliases": [
"CVE-2026-23543"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-19T09:16:12Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in WPDeveloper Essential Addons for Elementor essential-addons-for-elementor-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Essential Addons for Elementor: from n/a through \u003c= 6.5.5.",
"id": "GHSA-p49x-q2cv-fcx5",
"modified": "2026-02-26T21:31:27Z",
"published": "2026-02-19T18:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-23543"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/essential-addons-for-elementor-lite/vulnerability/wordpress-essential-addons-for-elementor-plugin-6-5-5-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.