CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
14695 vulnerabilities reference this CWE, most recent first.
GHSA-R57C-7J7F-H2PM
Vulnerability from github – Published: 2022-05-13 01:23 – Updated: 2022-05-13 01:23gdwfpcd.sys in G Data Total Security before 2019-02-22 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILE_DEVICE_SECURE_OPEN and therefore files and directories "inside" the \.\gdwfpcd device are not properly protected, leading to unintended impersonation or object creation.
{
"affected": [],
"aliases": [
"CVE-2019-9742"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-03-13T14:29:00Z",
"severity": "HIGH"
},
"details": "gdwfpcd.sys in G Data Total Security before 2019-02-22 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILE_DEVICE_SECURE_OPEN and therefore files and directories \"inside\" the \\\\.\\gdwfpcd device are not properly protected, leading to unintended impersonation or object creation.",
"id": "GHSA-r57c-7j7f-h2pm",
"modified": "2022-05-13T01:23:05Z",
"published": "2022-05-13T01:23:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-9742"
},
{
"type": "WEB",
"url": "https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-03-13-gdata-total-security-acl-bypass.md"
},
{
"type": "WEB",
"url": "https://nafiez.github.io/security/bypass/2019/03/12/gdata-total-security-acl-bypass.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R58J-WF5C-JR5H
Vulnerability from github – Published: 2024-09-28 03:30 – Updated: 2024-09-28 03:30The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the alg_wc_eu_vat_exempt_vat_from_admin() function in all versions up to, and including, 2.12.12. This makes it possible for unauthenticated attackers to update the VAT status for any order.
{
"affected": [],
"aliases": [
"CVE-2024-9189"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-28T02:15:10Z",
"severity": "MODERATE"
},
"details": "The EU/UK VAT Manager for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the alg_wc_eu_vat_exempt_vat_from_admin() function in all versions up to, and including, 2.12.12. This makes it possible for unauthenticated attackers to update the VAT status for any order.",
"id": "GHSA-r58j-wf5c-jr5h",
"modified": "2024-09-28T03:30:44Z",
"published": "2024-09-28T03:30:44Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-9189"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/eu-vat-for-woocommerce/tags/2.12.12/includes/class-alg-wc-eu-vat-ajax.php#L285"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3158296"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c6db680e-1fd4-420c-98f4-2b6dc5cf6781?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R593-5693-QV6X
Vulnerability from github – Published: 2025-05-19 18:30 – Updated: 2026-04-28 21:35Missing Authorization vulnerability in jegtheme JNews.This issue affects JNews: from n/a through 11.6.5.
{
"affected": [],
"aliases": [
"CVE-2025-39373"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-19T17:15:26Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in jegtheme JNews.This issue affects JNews: from n/a through 11.6.5.",
"id": "GHSA-r593-5693-qv6x",
"modified": "2026-04-28T21:35:37Z",
"published": "2025-05-19T18:30:47Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-39373"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/theme/jnews/vulnerability/wordpress-jnews-theme-11-6-5-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R597-FW99-924J
Vulnerability from github – Published: 2025-03-11 03:30 – Updated: 2025-03-11 03:30Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high impact on the integrity and availability of the application.
{
"affected": [],
"aliases": [
"CVE-2025-26661"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-03-11T01:15:35Z",
"severity": "HIGH"
},
"details": "Due to missing authorization check, SAP NetWeaver (ABAP Class Builder) allows an attacker to gain higher access levels than they should have, resulting in escalation of privileges. On successful exploitation, this could result in disclosure of highly sensitive information. It could also have a high impact on the integrity and availability of the application.",
"id": "GHSA-r597-fw99-924j",
"modified": "2025-03-11T03:30:50Z",
"published": "2025-03-11T03:30:50Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-26661"
},
{
"type": "WEB",
"url": "https://me.sap.com/notes/3563927"
},
{
"type": "WEB",
"url": "https://url.sap/sapsecuritypatchday"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-R5C3-C72Q-M3F4
Vulnerability from github – Published: 2024-06-11 15:31 – Updated: 2024-06-11 15:31Missing Authorization vulnerability in HahnCreativeGroup WP Translate.This issue affects WP Translate: from n/a through 5.3.0.
{
"affected": [],
"aliases": [
"CVE-2024-35663"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-06-11T15:16:08Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in HahnCreativeGroup WP Translate.This issue affects WP Translate: from n/a through 5.3.0.",
"id": "GHSA-r5c3-c72q-m3f4",
"modified": "2024-06-11T15:31:15Z",
"published": "2024-06-11T15:31:15Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-35663"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/wp-translate/wordpress-wp-translate-plugin-5-3-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-R5CR-XM48-97XP
Vulnerability from github – Published: 2025-04-30 16:49 – Updated: 2025-05-05 17:50Impact
Anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. It's not filtering the result depending on current user rights, a not authenticated user could exploit this even in a totally private wiki.
To reproduce:
- remove view from guest on the whole wiki
- logout
- access http://127.0.0.1:8080/xwiki/rest/wikis/xwiki/spaces/Sandbox/pages/WebHome/attachments
You get a list of attachments, while the expected result should be an empty list.
Patches
This vulnerability has been fixed in XWiki 14.10.22, 15.10.12, 16.7.0-rc-1 and 16.4.3.
Workarounds
We're not aware of any workaround except upgrading.
References
- https://jira.xwiki.org/browse/XWIKI-22424
- https://jira.xwiki.org/browse/XWIKI-22427
- https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342#diff-0
For more information
If you have any questions or comments about this advisory: * Open an issue in Jira XWiki.org * Email us at Security Mailing List
Attribution
Issue reported by Lukas Monert.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-rest-server"
},
"ranges": [
{
"events": [
{
"introduced": "1.8.1"
},
{
"fixed": "14.10.22"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-rest-server"
},
"ranges": [
{
"events": [
{
"introduced": "15.0-rc-1"
},
{
"fixed": "15.10.12"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-rest-server"
},
"ranges": [
{
"events": [
{
"introduced": "16.0.0-rc-1"
},
{
"fixed": "16.4.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.xwiki.platform:xwiki-platform-rest-server"
},
"ranges": [
{
"events": [
{
"introduced": "16.5.0-rc-1"
},
{
"fixed": "16.7.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-46554"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2025-04-30T16:49:47Z",
"nvd_published_at": "2025-04-30T19:15:55Z",
"severity": "MODERATE"
},
"details": "### Impact\n\nAnyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint. It\u0027s not filtering the result depending on current user rights, a not authenticated user could exploit this even in a totally private wiki.\n\nTo reproduce:\n\n* remove view from guest on the whole wiki\n* logout\n* access http://127.0.0.1:8080/xwiki/rest/wikis/xwiki/spaces/Sandbox/pages/WebHome/attachments\n\nYou get a list of attachments, while the expected result should be an empty list.\n\n### Patches\n\nThis vulnerability has been fixed in XWiki 14.10.22, 15.10.12, 16.7.0-rc-1 and 16.4.3.\n\n### Workarounds\n\nWe\u0027re not aware of any workaround except upgrading.\n\n### References\n* https://jira.xwiki.org/browse/XWIKI-22424\n* https://jira.xwiki.org/browse/XWIKI-22427\n* https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342#diff-0\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n* Open an issue in [Jira XWiki.org](https://jira.xwiki.org/)\n* Email us at [Security Mailing List](mailto:security@xwiki.org)\n\n### Attribution\n\nIssue reported by [Lukas Monert](https://github.com/LMonert).",
"id": "GHSA-r5cr-xm48-97xp",
"modified": "2025-05-05T17:50:17Z",
"published": "2025-04-30T16:49:47Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/security/advisories/GHSA-r5cr-xm48-97xp"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-46554"
},
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/commit/37ecea84fdd053c33733c2ae9a0778bf98eae608"
},
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/commit/a43e933ddeda17dad1772396e1757998260e9342"
},
{
"type": "WEB",
"url": "https://github.com/xwiki/xwiki-platform/commit/c02ce7843a39851865b9d7b6132e32fdd21e3856"
},
{
"type": "PACKAGE",
"url": "https://github.com/xwiki/xwiki-platform"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XWIKI-22424"
},
{
"type": "WEB",
"url": "https://jira.xwiki.org/browse/XWIKI-22427"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "XWiki missing authorization when accessing the wiki level attachments list and metadata via REST API"
}
GHSA-R5GH-84RM-9GFG
Vulnerability from github – Published: 2023-07-12 09:30 – Updated: 2024-04-04 06:03In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.
{
"affected": [],
"aliases": [
"CVE-2023-30942"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-12T09:15:11Z",
"severity": "MODERATE"
},
"details": "In telephony service, there is a missing permission check. This could lead to local information disclosure with no additional execution privileges needed.",
"id": "GHSA-r5gh-84rm-9gfg",
"modified": "2024-04-04T06:03:02Z",
"published": "2023-07-12T09:30:54Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-30942"
},
{
"type": "WEB",
"url": "https://www.unisoc.com/en_us/secy/announcementDetail/1676902764208259073"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R5PH-FC45-CWP3
Vulnerability from github – Published: 2022-05-24 22:28 – Updated: 2022-05-24 22:28Insecure direct object reference vulnerability in Zyxel’s P1302-T10 v3 with firmware version 2.00(ABBX.3) and earlier allows attackers to gain privileges and access certain admin pages.
{
"affected": [],
"aliases": [
"CVE-2020-20183"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-12-14T20:15:00Z",
"severity": "HIGH"
},
"details": "Insecure direct object reference vulnerability in Zyxel\u2019s P1302-T10 v3 with firmware version 2.00(ABBX.3) and earlier allows attackers to gain privileges and access certain admin pages.",
"id": "GHSA-r5ph-fc45-cwp3",
"modified": "2022-05-24T22:28:56Z",
"published": "2022-05-24T22:28:56Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-20183"
},
{
"type": "WEB",
"url": "https://www.zyxel.com/us/en/support/P1302-T10D-v3-modem-insecure-direct-object-reference-vulnerability.shtml"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-R5PX-69PM-Q397
Vulnerability from github – Published: 2025-12-16 06:30 – Updated: 2026-04-08 18:34The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulk_action_generate_handler function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete or generate featured images on posts they do not own.
{
"affected": [],
"aliases": [
"CVE-2025-13794"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-16T06:15:42Z",
"severity": "MODERATE"
},
"details": "The Auto Featured Image (Auto Post Thumbnail) plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the bulk_action_generate_handler function in all versions up to, and including, 4.2.1. This makes it possible for authenticated attackers, with Contributor-level access and above, to delete or generate featured images on posts they do not own.",
"id": "GHSA-r5px-69pm-q397",
"modified": "2026-04-08T18:34:01Z",
"published": "2025-12-16T06:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-13794"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/auto-post-thumbnail/tags/4.2.1/includes/class-plugin.php#L425"
},
{
"type": "WEB",
"url": "https://research.cleantalk.org/cve-2025-13794"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/29b0fd97-a669-42bb-b01e-bdc0395d697e?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-R5R4-7HP9-Q2XP
Vulnerability from github – Published: 2024-03-09 09:30 – Updated: 2026-04-08 21:32The EventPrime – Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the calendar_events_delete() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.
{
"affected": [],
"aliases": [
"CVE-2024-1125"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-03-09T07:15:08Z",
"severity": "MODERATE"
},
"details": "The EventPrime \u2013 Events Calendar, Bookings and Tickets plugin for WordPress is vulnerable to unauthorized loss of data due to a missing capability check on the calendar_events_delete() function in all versions up to, and including, 3.4.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to delete arbitrary posts.",
"id": "GHSA-r5r4-7hp9-q2xp",
"modified": "2026-04-08T21:32:19Z",
"published": "2024-03-09T09:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1125"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3043888%40eventprime-event-calendar-management\u0026new=3043888%40eventprime-event-calendar-management\u0026sfp_email=\u0026sfph_mail="
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/b5278afb-9db3-4b1d-bb2f-e6595f0ac6dc?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.