CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
15269 vulnerabilities reference this CWE, most recent first.
GHSA-9V2V-8MQ8-P8FF
Vulnerability from github – Published: 2026-05-12 09:31 – Updated: 2026-05-12 09:31The iPOSpays Gateways WC plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.3.7. This is due to the plugin exposing a REST API endpoint /wp-json/ipospays/v1/save_settings with 'permission_callback' set to '__return_true', which allows unauthenticated access without any capability checks or nonce verification. This makes it possible for unauthenticated attackers to update plugin settings, specifically allowing them to overwrite critical payment gateway settings including live API keys, secret keys, and payment tokens stored in the 'woocommerce_ipospays_settings' option.
{
"affected": [],
"aliases": [
"CVE-2026-4663"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-12T09:16:41Z",
"severity": "MODERATE"
},
"details": "The iPOSpays Gateways WC plugin for WordPress is vulnerable to Missing Authorization in versions up to and including 1.3.7. This is due to the plugin exposing a REST API endpoint /wp-json/ipospays/v1/save_settings with \u0027permission_callback\u0027 set to \u0027__return_true\u0027, which allows unauthenticated access without any capability checks or nonce verification. This makes it possible for unauthenticated attackers to update plugin settings, specifically allowing them to overwrite critical payment gateway settings including live API keys, secret keys, and payment tokens stored in the \u0027woocommerce_ipospays_settings\u0027 option.",
"id": "GHSA-9v2v-8mq8-p8ff",
"modified": "2026-05-12T09:31:31Z",
"published": "2026-05-12T09:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4663"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/tags/1.3.7/includes/payment-methods/class-ftd-redirect-gateway.php#L253"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/tags/1.3.7/includes/payment-methods/class-ftd-redirect-gateway.php#L336"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/tags/1.3.7/includes/payment-methods/class-ftd-redirect-gateway.php#L381"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/trunk/includes/payment-methods/class-ftd-redirect-gateway.php#L253"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/trunk/includes/payment-methods/class-ftd-redirect-gateway.php#L336"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/ipospays-gateways-wc/trunk/includes/payment-methods/class-ftd-redirect-gateway.php#L381"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/a1a30930-31c1-4254-867c-073932672a39?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9V3J-XFW8-FGH8
Vulnerability from github – Published: 2025-03-18 15:30 – Updated: 2025-03-25 00:30On IROAD V9 devices, Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. A vulnerability in the dashcam's configuration management allows unauthorized users to modify settings, disable critical functions, and turn off battery protection, potentially causing physical damage to the vehicle.
{
"affected": [],
"aliases": [
"CVE-2025-30107"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-18T15:16:01Z",
"severity": "HIGH"
},
"details": "On IROAD V9 devices, Managing Settings and Obtaining Sensitive Data and Sabotaging the Car Battery can be performed by unauthorized parties. A vulnerability in the dashcam\u0027s configuration management allows unauthorized users to modify settings, disable critical functions, and turn off battery protection, potentially causing physical damage to the vehicle.",
"id": "GHSA-9v3j-xfw8-fgh8",
"modified": "2025-03-25T00:30:26Z",
"published": "2025-03-18T15:30:49Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-30107"
},
{
"type": "WEB",
"url": "https://github.com/geo-chen/IROAD-V"
},
{
"type": "WEB",
"url": "https://iroad-dashcam.nl/iroad/iroad-x5/%27"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9V48-95F3-HQXH
Vulnerability from github – Published: 2026-03-21 00:31 – Updated: 2026-03-21 00:31The RepairBuddy – Repair Shop CRM & Booking Plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1132. The plugin exposes two AJAX handlers that, when combined, allow any authenticated user to modify admin-level plugin settings. First, the wc_rb_get_fresh_nonce() function (registered via wp_ajax and wp_ajax_nopriv hooks) allows any user to generate a valid WordPress nonce for any arbitrary action name by simply providing the nonce_name parameter, with no capability checks. Second, the wc_rep_shop_settings_submission() function only verifies the nonce (wcrb_main_setting_nonce) but performs no current_user_can() capability check before updating 15+ plugin options via update_option(). This makes it possible for authenticated attackers, with subscriber-level access and above, to modify all plugin configuration settings including business name, email, logo, menu label, GDPR settings, and more by first minting a valid nonce via the wc_rb_get_fresh_nonce endpoint and then calling the settings submission handler.
{
"affected": [],
"aliases": [
"CVE-2026-3567"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-21T00:16:28Z",
"severity": "MODERATE"
},
"details": "The RepairBuddy \u2013 Repair Shop CRM \u0026 Booking Plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 4.1132. The plugin exposes two AJAX handlers that, when combined, allow any authenticated user to modify admin-level plugin settings. First, the wc_rb_get_fresh_nonce() function (registered via wp_ajax and wp_ajax_nopriv hooks) allows any user to generate a valid WordPress nonce for any arbitrary action name by simply providing the nonce_name parameter, with no capability checks. Second, the wc_rep_shop_settings_submission() function only verifies the nonce (wcrb_main_setting_nonce) but performs no current_user_can() capability check before updating 15+ plugin options via update_option(). This makes it possible for authenticated attackers, with subscriber-level access and above, to modify all plugin configuration settings including business name, email, logo, menu label, GDPR settings, and more by first minting a valid nonce via the wc_rb_get_fresh_nonce endpoint and then calling the settings submission handler.",
"id": "GHSA-9v48-95f3-hqxh",
"modified": "2026-03-21T00:31:44Z",
"published": "2026-03-21T00:31:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3567"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/computer-repair-shop/tags/4.1121/lib/includes/main_page.php#L1080"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/computer-repair-shop/tags/4.1121/lib/shortcodes/book_my_service.php#L1142"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/computer-repair-shop/trunk/lib/includes/main_page.php#L1080"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/computer-repair-shop/trunk/lib/shortcodes/book_my_service.php#L1142"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3477889%40computer-repair-shop\u0026new=3477889%40computer-repair-shop\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/bb4b3778-7211-4a56-a2e5-1f455f356dd5?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9V48-G4GH-2566
Vulnerability from github – Published: 2024-06-11 12:31 – Updated: 2024-06-11 12:31Missing Authorization vulnerability in weDevs WooCommerce Conversion Tracking.This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.11.
{
"affected": [],
"aliases": [
"CVE-2023-52217"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-11T10:15:11Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in weDevs WooCommerce Conversion Tracking.This issue affects WooCommerce Conversion Tracking: from n/a through 2.0.11.",
"id": "GHSA-9v48-g4gh-2566",
"modified": "2024-06-11T12:31:01Z",
"published": "2024-06-11T12:31:01Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-52217"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/woocommerce-conversion-tracking/wordpress-woocommerce-conversion-tracking-plugin-2-0-11-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9V4F-6R6Q-2957
Vulnerability from github – Published: 2024-01-17 18:31 – Updated: 2026-04-28 21:33Missing Authorization vulnerability in SedLex Image Zoom.This issue affects Image Zoom: from n/a through 1.8.8.
{
"affected": [],
"aliases": [
"CVE-2022-41619"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-01-17T17:15:09Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in SedLex Image Zoom.This issue affects Image Zoom: from n/a through 1.8.8.",
"id": "GHSA-9v4f-6r6q-2957",
"modified": "2026-04-28T21:33:49Z",
"published": "2024-01-17T18:31:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-41619"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/image-zoom/wordpress-image-zoom-plugin-1-8-8-multiple-broken-access-control-vulnerabilities?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-9V5Q-R3G6-CJVX
Vulnerability from github – Published: 2024-06-04 00:30 – Updated: 2024-06-04 00:30Missing Authorization vulnerability in CodePeople, paypaldev CP Contact Form with Paypal allows Functionality Misuse.This issue affects CP Contact Form with Paypal: from n/a through 1.3.34.
{
"affected": [],
"aliases": [
"CVE-2023-27460"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-03T22:15:10Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in CodePeople, paypaldev CP Contact Form with Paypal allows Functionality Misuse.This issue affects CP Contact Form with Paypal: from n/a through 1.3.34.",
"id": "GHSA-9v5q-r3g6-cjvx",
"modified": "2024-06-04T00:30:47Z",
"published": "2024-06-04T00:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-27460"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/cp-contact-form-with-paypal/wordpress-cp-contact-form-with-paypal-plugin-1-3-34-missing-authorization-leading-to-feedback-submission-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9V63-FR34-QPMH
Vulnerability from github – Published: 2022-05-24 16:50 – Updated: 2024-04-04 01:20zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php.
{
"affected": [],
"aliases": [
"CVE-2019-1010150"
],
"database_specific": {
"cwe_ids": [
"CWE-20",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-07-23T14:15:00Z",
"severity": "CRITICAL"
},
"details": "zzcms 8.3 and earlier is affected by: File Delete to Code Execution. The impact is: getshell. The component is: /user/zssave.php.",
"id": "GHSA-9v63-fr34-qpmh",
"modified": "2024-04-04T01:20:18Z",
"published": "2022-05-24T16:50:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-1010150"
},
{
"type": "WEB",
"url": "https://gist.github.com/Lz1y/7ab529230c43dfc5441ac32dd13e3e5b"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-9V77-J4XV-34GQ
Vulnerability from github – Published: 2026-06-24 15:31 – Updated: 2026-06-24 18:32A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.
{
"affected": [],
"aliases": [
"CVE-2026-57294"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T14:17:35Z",
"severity": "MODERATE"
},
"details": "A missing permission check in Jenkins EC2 Fleet Plugin 4.2.3.539.v8fedff2a_81c3 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing AWS credentials stored in Jenkins.",
"id": "GHSA-9v77-j4xv-34gq",
"modified": "2026-06-24T18:32:39Z",
"published": "2026-06-24T15:31:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-57294"
},
{
"type": "WEB",
"url": "https://www.jenkins.io/security/advisory/2026-06-24/#SECURITY-3774"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-9V7W-MQ26-J739
Vulnerability from github – Published: 2025-04-16 15:34 – Updated: 2026-04-01 18:34Missing Authorization vulnerability in miniOrange WordPress REST API Authentication allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WordPress REST API Authentication: from n/a through 3.6.3.
{
"affected": [],
"aliases": [
"CVE-2025-39545"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-04-16T13:15:47Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in miniOrange WordPress REST API Authentication allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WordPress REST API Authentication: from n/a through 3.6.3.",
"id": "GHSA-9v7w-mq26-j739",
"modified": "2026-04-01T18:34:44Z",
"published": "2025-04-16T15:34:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39545"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/wp-rest-api-authentication/vulnerability/wordpress-wordpress-rest-api-authentication-3-6-3-settings-change-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-9VF6-R8JP-W3M7
Vulnerability from github – Published: 2022-03-29 00:01 – Updated: 2022-04-05 00:00The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the "refresh-backup" action, and simultaneously keep requesting a publicly accessible temporary file generated by the plugin in order to disclose the final backup filename, which can then be fetched by the attacker to download the backup of the plugin's DB data
{
"affected": [],
"aliases": [
"CVE-2022-0833"
],
"database_specific": {
"cwe_ids": [
"CWE-352",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-03-28T18:15:00Z",
"severity": "MODERATE"
},
"details": "The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the \"refresh-backup\" action, and simultaneously keep requesting a publicly accessible temporary file generated by the plugin in order to disclose the final backup filename, which can then be fetched by the attacker to download the backup of the plugin\u0027s DB data",
"id": "GHSA-9vf6-r8jp-w3m7",
"modified": "2022-04-05T00:00:50Z",
"published": "2022-03-29T00:01:10Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0833"
},
{
"type": "WEB",
"url": "https://wpscan.com/vulnerability/b2c7c1e8-d72c-4b1e-b5cb-dc2a6538965d"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.