CWE-862: Missing Authorization
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Yearly Trend
Top Affected Vendors
All Missing Authorization CVEs (3,034)
This CVE describes a Missing Authorization vulnerability in Slider Revolution WordPress plugin that allows unauthenticated attackers to perform unauth...
Jun 19, 2024This CVE describes a missing authorization vulnerability in the WordPress Convert Pro plugin that allows unauthorized users to access administrative f...
Jun 19, 2024This CVE describes a Missing Authorization vulnerability in MultiVendorX WC Marketplace WordPress plugin. It allows unauthorized users to perform acti...
Jun 9, 2024This CVE describes a Missing Authorization vulnerability in the ARForms WordPress plugin that allows authenticated subscribers to arbitrarily activate...
Jun 9, 2024This CVE describes a missing authorization vulnerability in the Academy LMS WordPress plugin that allows unauthorized access to paid courses. Attacker...
May 6, 2024This vulnerability allows unauthorized access to sensitive information and potential manipulation due to missing authorization checks in Acronis Cyber...
Apr 29, 2024This CVE describes a Missing Authorization vulnerability in the WordPress Prime Slider plugin for Elementor. It allows attackers to perform unauthoriz...
Apr 22, 2024The WP-Stateless plugin for WordPress has a missing capability check that allows authenticated users with subscriber-level access or higher to update ...
Apr 6, 2024The Woostify Sites Library WordPress plugin before version 1.4.8 lacks proper authorization checks in an AJAX endpoint, allowing any authenticated use...
Jan 29, 2024This vulnerability allows unauthorized users to access and manipulate sensitive information in Acronis Cyber Protect Cloud Agent for Windows due to mi...
Dec 14, 2023This vulnerability allows unauthorized access to sensitive information and potential manipulation due to missing authorization checks in Acronis Cyber...
Oct 6, 2023This vulnerability allows unauthorized access to sensitive information and potential manipulation due to missing authorization checks in Acronis Cyber...
Oct 6, 2023This vulnerability allows unauthorized users to access and manipulate sensitive information in Acronis Cyber Protect products due to missing authoriza...
Oct 5, 2023CVE-2023-2268 is an information disclosure vulnerability in Plane version 0.7.1 that allows unauthenticated attackers to access all user files stored ...
Jul 15, 2023This vulnerability in Jenkins Orka by MacStadium Plugin allows attackers with Overall/Read permission to connect to attacker-controlled URLs using sto...
Jul 12, 2023The Kali Forms WordPress plugin up to version 2.1.1 contains an authenticated options change vulnerability due to missing authentication checks in the...
Jun 7, 2023CloudExplorer Lite prior to version 1.1.0 has a missing authorization vulnerability that allows authenticated users to add themselves to any organizat...
May 26, 2023CloudExplorer Lite has a missing permission check vulnerability that allows users to add themselves to any organization without authorization. This af...
May 26, 2023This vulnerability allows users without view permissions to access Office attachment content via the view file macro in XWiki Remote Macros. It affect...
Nov 19, 2025OpenProject versions before 17.0.2 contain a missing authorization vulnerability where users with 'Manage Users' permission can lock application admin...
Feb 9, 2026This vulnerability in IBM DS8000 storage systems allows local users with authorized CCW update permissions to delete or corrupt backups due to missing...
Dec 26, 2025This Android vulnerability allows background applications to retain foreground permissions indefinitely due to a permissions bypass in the RemotePrint...
Dec 8, 2025The Gutena Forms WordPress plugin has an authorization vulnerability that allows authenticated users with Contributor-level access or higher to modify...
Mar 4, 2026This vulnerability in wpForo Forum allows authenticated users to reassign all forum user groups to arbitrary WordPress roles, enabling privilege escal...
Feb 28, 2026OpenEMR versions before 8.0.0 contain an access control vulnerability that allows low-privileged users (like receptionists) to export the entire messa...
Feb 25, 2026The weMail WordPress plugin up to version 2.0.7 allows unauthenticated attackers to permanently delete all email marketing forms. This occurs because ...
Feb 21, 2026This CVE describes a missing authorization vulnerability in the Print Invoice & Delivery Notes for WooCommerce plugin that allows attackers to bypass ...
Feb 20, 2026This CVE describes a Missing Authorization vulnerability in the WP FullCalendar WordPress plugin that allows attackers to exploit incorrectly configur...
Feb 20, 2026This CVE describes a Missing Authorization vulnerability in the Cartify WordPress theme that allows unauthorized users to delete arbitrary content. Th...
Feb 20, 2026This CVE describes a missing authorization vulnerability in the Sendy WordPress plugin that allows attackers to bypass access controls. It affects Sen...
Feb 20, 2026This CVE describes a missing authorization vulnerability in the ELEX WordPress HelpDesk & Customer Ticketing System plugin that allows attackers to by...
Feb 20, 2026This CVE describes a Missing Authorization vulnerability in the Advanced WC Analytics WordPress plugin that allows unauthorized users to change plugin...
Feb 20, 2026This CVE describes a missing authorization vulnerability in the Travelpayouts WordPress plugin that allows attackers to bypass access controls. It aff...
Feb 20, 2026This CVE describes a Missing Authorization vulnerability in the ConveyThis WordPress translation plugin that allows attackers to bypass access control...
Feb 20, 2026This CVE describes a Missing Authorization vulnerability in the Addonify Compare Products for WooCommerce WordPress plugin. It allows attackers to cha...
Feb 20, 2026This CVE describes a Missing Authorization vulnerability in the Addonify Floating Cart for WooCommerce WordPress plugin. It allows attackers to exploi...
Feb 20, 2026This CVE describes a missing authorization vulnerability in the GA4WP: Google Analytics for WordPress plugin that allows attackers to exploit incorrec...
Feb 20, 2026This CVE describes a Missing Authorization vulnerability in the knitpay UPI QR Code Payment Gateway for WooCommerce plugin. It allows attackers to byp...
Feb 20, 2026This CVE describes a missing authorization vulnerability in the Sunshine Photo Cart WordPress plugin that allows attackers to bypass access controls. ...
Feb 20, 2026This CVE describes a Missing Authorization vulnerability in the aDirectory WordPress plugin that allows attackers to bypass access controls. It affect...
Feb 20, 2026This CVE describes a missing authorization vulnerability in the Konte WordPress theme that allows attackers to bypass access controls. It affects all ...
Feb 20, 2026This CVE describes a Missing Authorization vulnerability in the Academy LMS WordPress plugin that allows attackers to bypass access controls. Users ru...
Feb 19, 2026This CVE describes a Missing Authorization vulnerability in the Calculated Fields Form WordPress plugin that allows attackers to bypass access control...
Feb 19, 2026A Missing Authorization vulnerability in GitHub Enterprise Server allows authenticated attackers to upload unauthorized content to other users' reposi...
Feb 18, 2026This CVE describes a Missing Authorization vulnerability in the Smartypants SP Project & Document Manager WordPress plugin that allows attackers to by...
Feb 17, 2026CVE-2026-25768 is an authorization bypass vulnerability in LavinMQ message queue server where authenticated users can access broker metadata they shou...
Feb 12, 2026The Twitter posts to Blog WordPress plugin has a missing capability check vulnerability that allows unauthenticated attackers to modify plugin setting...
Feb 11, 2026This CVE describes a missing authorization vulnerability in PlaciPy placement management system. Authenticated users can access, modify, or delete any...
Feb 9, 2026This vulnerability in Gogs allows authenticated users to cause a denial-of-service (DoS) attack by deleting repository files before synchronization, w...
Feb 6, 2026This vulnerability allows attackers with read-only access tokens to modify repository contents in Gogs self-hosted Git service. It affects all Gogs in...
Feb 6, 2026About Missing Authorization (CWE-862)
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Our database tracks 3,034 CVEs classified as CWE-862, with 225 rated critical and 843 rated high severity. The average CVSS score for Missing Authorization vulnerabilities is 6.3.
External reference: View CWE-862 on MITRE CWE →
Monitor Missing Authorization Vulnerabilities
Get alerted when new Missing Authorization CVEs affect your infrastructure.
Start Monitoring Free