CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
14839 vulnerabilities reference this CWE, most recent first.
GHSA-F4G5-4HXC-84XG
Vulnerability from github – Published: 2025-02-14 15:31 – Updated: 2026-04-01 18:33Missing Authorization vulnerability in Michael Revellin-Clerc Bulk Menu Edit allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Bulk Menu Edit: from n/a through 1.3.
{
"affected": [],
"aliases": [
"CVE-2025-24692"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-14T13:15:50Z",
"severity": "HIGH"
},
"details": "Missing Authorization vulnerability in Michael Revellin-Clerc Bulk Menu Edit allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Bulk Menu Edit: from n/a through 1.3.",
"id": "GHSA-f4g5-4hxc-84xg",
"modified": "2026-04-01T18:33:40Z",
"published": "2025-02-14T15:31:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-24692"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/bulk-menu-edit/vulnerability/wordpress-bulk-menu-edit-plugin-1-3-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F4JP-MV74-FHX2
Vulnerability from github – Published: 2026-07-16 18:31 – Updated: 2026-07-16 18:31Perfect Support Ticketing & Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agent-level privileges to manipulate the Support Agent assignment field of tickets by bypassing intended authorization checks. Attackers can add or remove any user, including Superadmin accounts, from the Support Agent field of any ticket to which they are assigned, circumventing role-based access controls.
{
"affected": [],
"aliases": [
"CVE-2026-63082"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-16T16:19:16Z",
"severity": "MODERATE"
},
"details": "Perfect Support Ticketing \u0026 Document Management System through 1.7 contains a broken access control vulnerability that allows authenticated attackers with Agent-level privileges to manipulate the Support Agent assignment field of tickets by bypassing intended authorization checks. Attackers can add or remove any user, including Superadmin accounts, from the Support Agent field of any ticket to which they are assigned, circumventing role-based access controls.",
"id": "GHSA-f4jp-mv74-fhx2",
"modified": "2026-07-16T18:31:32Z",
"published": "2026-07-16T18:31:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-63082"
},
{
"type": "WEB",
"url": "https://github.com/aaronamran/CVE-Disclosures/blob/main/CVE-2026/CVE-2026-63082"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/perfect-support-ticketing-system-broken-access-control-via-agent-assignment"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-F4M2-6G8H-79GQ
Vulnerability from github – Published: 2025-07-08 03:31 – Updated: 2025-07-08 03:31SAP Business Warehouse and SAP BW/4HANA BEx Tools allow an authenticated attacker to gain higher access levels than intended by exploiting improper authorization checks. This could potentially impact data integrity by allowing deletion of user table entries.�It has no impact on the confidentiality and availability of the application.
{
"affected": [],
"aliases": [
"CVE-2025-42960"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-07-08T01:15:22Z",
"severity": "MODERATE"
},
"details": "SAP Business Warehouse and SAP BW/4HANA BEx Tools allow an authenticated attacker to gain higher access levels than intended by exploiting improper authorization checks. This could potentially impact data integrity by allowing deletion of user table entries.\ufffdIt has no impact on the confidentiality and availability of the application.",
"id": "GHSA-f4m2-6g8h-79gq",
"modified": "2025-07-08T03:31:00Z",
"published": "2025-07-08T03:31:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-42960"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3608991"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F4MC-742P-4VF2
Vulnerability from github – Published: 2025-01-16 21:31 – Updated: 2026-04-01 18:33Missing Authorization vulnerability in Sven Hofmann & Michael Schoenrock Mark Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mark Posts: from n/a through 2.2.3.
{
"affected": [],
"aliases": [
"CVE-2025-23963"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-16T21:15:37Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Sven Hofmann \u0026 Michael Schoenrock Mark Posts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Mark Posts: from n/a through 2.2.3.",
"id": "GHSA-f4mc-742p-4vf2",
"modified": "2026-04-01T18:33:17Z",
"published": "2025-01-16T21:31:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-23963"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/mark-posts/vulnerability/wordpress-mark-posts-plugin-2-2-3-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-F4VC-CXJ3-J8VH
Vulnerability from github – Published: 2026-02-03 15:30 – Updated: 2026-02-03 18:30Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through <= 3.5.7.2.
{
"affected": [],
"aliases": [
"CVE-2026-24994"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-03T15:16:18Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Sunshine Photo Cart: from n/a through \u003c= 3.5.7.2.",
"id": "GHSA-f4vc-cxj3-j8vh",
"modified": "2026-02-03T18:30:43Z",
"published": "2026-02-03T15:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24994"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/sunshine-photo-cart/vulnerability/wordpress-sunshine-photo-cart-plugin-3-5-7-2-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F4VX-R87Q-VG6C
Vulnerability from github – Published: 2026-02-19 18:31 – Updated: 2026-04-08 21:33The Dealia – Request a quote plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple AJAX handlers in all versions up to, and including, 1.0.6. The admin nonce (DEALIA_ADMIN_NONCE) is exposed to all users with edit_posts capability (Contributor+) via wp_localize_script() in PostsController.php, while the AJAX handlers in AdminSettingsController.php only verify the nonce without checking current_user_can('manage_options'). This makes it possible for authenticated attackers, with Contributor-level access and above, to reset the plugin configuration.
{
"affected": [],
"aliases": [
"CVE-2026-2504"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-19T07:17:46Z",
"severity": "MODERATE"
},
"details": "The Dealia \u2013 Request a quote plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on multiple AJAX handlers in all versions up to, and including, 1.0.6. The admin nonce (DEALIA_ADMIN_NONCE) is exposed to all users with edit_posts capability (Contributor+) via wp_localize_script() in PostsController.php, while the AJAX handlers in AdminSettingsController.php only verify the nonce without checking current_user_can(\u0027manage_options\u0027). This makes it possible for authenticated attackers, with Contributor-level access and above, to reset the plugin configuration.",
"id": "GHSA-f4vx-r87q-vg6c",
"modified": "2026-04-08T21:33:10Z",
"published": "2026-02-19T18:31:51Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-2504"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/AdminSettingsController.php#L243"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/AdminSettingsController.php#L309"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/AdminSettingsController.php#L416"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/tags/1.0.6/src/Controllers/PostsController.php#L49"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/src/Controllers/AdminSettingsController.php#L243"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/dealia-request-a-quote/trunk/src/Controllers/PostsController.php#L49"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c8f506ef-972c-403d-9167-ffdd93be8ea6?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F4W3-762F-PWX9
Vulnerability from github – Published: 2022-05-24 19:01 – Updated: 2022-05-24 19:01On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization checks for file uploads to a specific directory within the REST API which might allow Authenticated users with guest privileges to upload files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
{
"affected": [],
"aliases": [
"CVE-2021-23014"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-10T15:15:00Z",
"severity": "HIGH"
},
"details": "On versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.3, and 14.1.x before 14.1.4, BIG-IP Advanced WAF and ASM are missing authorization checks for file uploads to a specific directory within the REST API which might allow Authenticated users with guest privileges to upload files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.",
"id": "GHSA-f4w3-762f-pwx9",
"modified": "2022-05-24T19:01:54Z",
"published": "2022-05-24T19:01:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-23014"
},
{
"type": "WEB",
"url": "https://support.f5.com/csp/article/K23203045"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-F4W8-MP9R-6M54
Vulnerability from github – Published: 2025-10-22 15:31 – Updated: 2026-01-20 15:31Missing Authorization vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoSchedule: from n/a through <= 3.4.0.
{
"affected": [],
"aliases": [
"CVE-2025-49913"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-10-22T15:15:37Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in CoSchedule CoSchedule coschedule-by-todaymade allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects CoSchedule: from n/a through \u003c= 3.4.0.",
"id": "GHSA-f4w8-mp9r-6m54",
"modified": "2026-01-20T15:31:23Z",
"published": "2025-10-22T15:31:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49913"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/coschedule-by-todaymade/vulnerability/wordpress-coschedule-plugin-3-4-0-broken-access-control-vulnerability?_s_id=cve"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/coschedule-by-todaymade/vulnerability/wordpress-coschedule-plugin-3-4-0-broken-access-control-vulnerability"
},
{
"type": "WEB",
"url": "https://vdp.patchstack.com/database/Wordpress/Plugin/coschedule-by-todaymade/vulnerability/wordpress-coschedule-plugin-3-4-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-F4WJ-3824-VJ6G
Vulnerability from github – Published: 2022-05-13 01:46 – Updated: 2025-04-20 03:32An issue was discovered on SendQuick Entera and Avera devices before 2HF16. The application failed to check the access control of the request which could result in an attacker being able to shutdown the system.
{
"affected": [],
"aliases": [
"CVE-2017-5136"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-02-05T18:59:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered on SendQuick Entera and Avera devices before 2HF16. The application failed to check the access control of the request which could result in an attacker being able to shutdown the system.",
"id": "GHSA-f4wj-3824-vj6g",
"modified": "2025-04-20T03:32:22Z",
"published": "2022-05-13T01:46:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5136"
},
{
"type": "WEB",
"url": "https://niantech.io/blog/2017/02/05/vulns-multiple-vulns-in-sendquick-entera-avera-sms-gateway-appliances"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96031"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-F4WR-G7FQ-R234
Vulnerability from github – Published: 2025-02-01 09:30 – Updated: 2025-02-01 09:30The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin's AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those actions in order to delete or view logs, modify forms or modify plugin settings.
{
"affected": [],
"aliases": [
"CVE-2025-0939"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-01T07:15:08Z",
"severity": "MODERATE"
},
"details": "The MagicForm plugin for WordPress is vulnerable to access and modification of data due to a missing capability check on the plugin\u0027s AJAX actions in all versions up to, and including, 1.6.2. This makes it possible for authenticated attackers, with Subscriber-level access and above, to invoke those actions in order to delete or view logs, modify forms or modify plugin settings.",
"id": "GHSA-f4wr-g7fq-r234",
"modified": "2025-02-01T09:30:28Z",
"published": "2025-02-01T09:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-0939"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/magicform/trunk/admin/admin-menu.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/aa3497ae-7f3a-4e67-ad7a-77b50dccaf3b?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.