CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
14558 vulnerabilities reference this CWE, most recent first.
GHSA-XGFQ-M22C-VPJJ
Vulnerability from github – Published: 2022-05-13 01:28 – Updated: 2025-04-20 03:34The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.
{
"affected": [],
"aliases": [
"CVE-2017-5930"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-20T16:59:00Z",
"severity": "LOW"
},
"details": "The AliasHandler component in PostfixAdmin before 3.0.2 allows remote authenticated domain admins to delete protected aliases via the delete parameter to delete.php, involving a missing permission check.",
"id": "GHSA-xgfq-m22c-vpjj",
"modified": "2025-04-20T03:34:29Z",
"published": "2022-05-13T01:28:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-5930"
},
{
"type": "WEB",
"url": "https://github.com/postfixadmin/postfixadmin/pull/23"
},
{
"type": "WEB",
"url": "https://github.com/postfixadmin/postfixadmin/blob/postfixadmin-3.0.2/CHANGELOG.TXT"
},
{
"type": "WEB",
"url": "https://sourceforge.net/p/postfixadmin/mailman/message/35646827"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2017-02/msg00076.html"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/02/08/1"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2017/02/09/1"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/96142"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XGGQ-F45P-384M
Vulnerability from github – Published: 2025-01-02 12:32 – Updated: 2026-04-28 21:35Missing Authorization vulnerability in Jose Mortellaro Freesoul Deactivate Plugins – Plugin manager and cleanup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Freesoul Deactivate Plugins – Plugin manager and cleanup: from n/a through 2.1.3.
{
"affected": [],
"aliases": [
"CVE-2023-46188"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-02T12:15:11Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Jose Mortellaro Freesoul Deactivate Plugins \u2013 Plugin manager and cleanup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Freesoul Deactivate Plugins \u2013 Plugin manager and cleanup: from n/a through 2.1.3.",
"id": "GHSA-xggq-f45p-384m",
"modified": "2026-04-28T21:35:29Z",
"published": "2025-01-02T12:32:13Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-46188"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/freesoul-deactivate-plugins/vulnerability/wordpress-freesoul-deactivate-plugins-plugin-2-1-3-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XGH9-482Q-M2W6
Vulnerability from github – Published: 2025-01-21 21:30 – Updated: 2025-01-21 21:30Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).
{
"affected": [],
"aliases": [
"CVE-2025-21514"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-21T21:15:16Z",
"severity": "MODERATE"
},
"details": "Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supported versions that are affected are Prior to 9.2.9.0. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise JD Edwards EnterpriseOne Tools. Successful attacks of this vulnerability can result in unauthorized read access to a subset of JD Edwards EnterpriseOne Tools accessible data. CVSS 3.1 Base Score 5.3 (Confidentiality impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N).",
"id": "GHSA-xgh9-482q-m2w6",
"modified": "2025-01-21T21:30:55Z",
"published": "2025-01-21T21:30:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-21514"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujan2025.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XGJ6-M977-PGHJ
Vulnerability from github – Published: 2026-06-24 09:30 – Updated: 2026-06-24 09:30The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This is due to a missing capability check in the nc_setOption() function, which is exposed via the nc.setOption XML-RPC method. The function authenticates the user via $wp_xmlrpc_server->login() (verifying credentials are valid) but does not perform any authorization check such as current_user_can('manage_options'). This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary WordPress options via XML-RPC requests. This can be leveraged to change the default_role option to 'administrator' and then register a new administrator account, achieving full privilege escalation and site takeover.
{
"affected": [],
"aliases": [
"CVE-2026-4297"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-06-24T07:16:27Z",
"severity": "HIGH"
},
"details": "The Welcome Software Publishing plugin for WordPress is vulnerable to Arbitrary Options Update in all versions up to and including 0.0.31. This is due to a missing capability check in the nc_setOption() function, which is exposed via the nc.setOption XML-RPC method. The function authenticates the user via $wp_xmlrpc_server-\u003elogin() (verifying credentials are valid) but does not perform any authorization check such as current_user_can(\u0027manage_options\u0027). This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary WordPress options via XML-RPC requests. This can be leveraged to change the default_role option to \u0027administrator\u0027 and then register a new administrator account, achieving full privilege escalation and site takeover.",
"id": "GHSA-xgj6-m977-pghj",
"modified": "2026-06-24T09:30:46Z",
"published": "2026-06-24T09:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-4297"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/newscred-publishing/tags/0.0.31/newscred.php#L264"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/newscred-publishing/tags/0.0.31/newscred.php#L265"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/newscred-publishing/tags/0.0.31/newscred.php#L272"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/newscred-publishing/tags/0.0.31/newscred.php#L44"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/newscred-publishing/trunk/newscred.php#L264"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/newscred-publishing/trunk/newscred.php#L265"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/newscred-publishing/trunk/newscred.php#L272"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/newscred-publishing/trunk/newscred.php#L44"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/47e53fd3-4e3f-433a-8e70-3a58c864184a?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XGMJ-J94Q-46CV
Vulnerability from github – Published: 2026-02-20 18:31 – Updated: 2026-02-27 00:31Missing Authorization vulnerability in tychesoftwares Print Invoice & Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice & Delivery Notes for WooCommerce: from n/a through <= 5.8.0.
{
"affected": [],
"aliases": [
"CVE-2026-24946"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-02-20T16:22:39Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in tychesoftwares Print Invoice \u0026 Delivery Notes for WooCommerce woocommerce-delivery-notes allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Print Invoice \u0026 Delivery Notes for WooCommerce: from n/a through \u003c= 5.8.0.",
"id": "GHSA-xgmj-j94q-46cv",
"modified": "2026-02-27T00:31:44Z",
"published": "2026-02-20T18:31:39Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-24946"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Plugin/woocommerce-delivery-notes/vulnerability/wordpress-print-invoice-delivery-notes-for-woocommerce-plugin-5-8-0-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-XGPH-64JM-FQ69
Vulnerability from github – Published: 2024-05-14 18:30 – Updated: 2024-05-14 18:30A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions < V5.5). The affected systems allow the upload of arbitrary files of any unauthenticated user. An attacker could leverage this vulnerability and achieve arbitrary code execution with system privileges.
{
"affected": [],
"aliases": [
"CVE-2024-27939"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-14T16:16:23Z",
"severity": "CRITICAL"
},
"details": "A vulnerability has been identified in RUGGEDCOM CROSSBOW (All versions \u003c V5.5). The affected systems allow the upload of arbitrary files of any unauthenticated user. An attacker could leverage this vulnerability and achieve arbitrary code execution with system privileges.",
"id": "GHSA-xgph-64jm-fq69",
"modified": "2024-05-14T18:30:59Z",
"published": "2024-05-14T18:30:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27939"
},
{
"type": "WEB",
"url": "https://cert-portal.siemens.com/productcert/html/ssa-916916.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XGQ8-JQ9W-77R5
Vulnerability from github – Published: 2022-11-15 19:00 – Updated: 2022-11-22 00:17Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories. Users with write permissions to a repository can delete arbitrary directories.
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.apache.archiva:archiva-common"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.2.9"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-40309"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": true,
"github_reviewed_at": "2022-11-22T00:17:23Z",
"nvd_published_at": "2022-11-15T13:15:00Z",
"severity": "MODERATE"
},
"details": "Apache Archiva prior to 2.2.9 allows an authenticated user to delete arbitrary directories. Users with write permissions to a repository can delete arbitrary directories.",
"id": "GHSA-xgq8-jq9w-77r5",
"modified": "2022-11-22T00:17:23Z",
"published": "2022-11-15T19:00:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-40309"
},
{
"type": "PACKAGE",
"url": "https://github.com/apache/archiva"
},
{
"type": "WEB",
"url": "https://lists.apache.org/thread/1odl4p85r96n27k577jk6ftrp19xfc27"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2022/11/15/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Apache Archiva subject to arbitrary directory deletion by users."
}
GHSA-XGR3-26HM-39GG
Vulnerability from github – Published: 2025-01-15 18:30 – Updated: 2026-04-01 18:33Missing Authorization vulnerability in bPlugins LLC Button Block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Button Block: from n/a through 1.1.5.
{
"affected": [],
"aliases": [
"CVE-2025-22787"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-01-15T16:15:41Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in bPlugins LLC Button Block allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Button Block: from n/a through 1.1.5.",
"id": "GHSA-xgr3-26hm-39gg",
"modified": "2026-04-01T18:33:09Z",
"published": "2025-01-15T18:30:57Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-22787"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/button-block/vulnerability/wordpress-button-block-plugin-1-1-5-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-XGV9-3CM6-QCCQ
Vulnerability from github – Published: 2024-07-12 12:30 – Updated: 2026-04-08 18:33The MStore API – Create Native Android & iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the 'phone' parameter of the 'firebase_sms_login' and 'firebase_sms_login_v2' functions. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email address or phone number. Additionally, if a new email address is supplied, a new user account is created with the default role, even if registration is disabled.
{
"affected": [],
"aliases": [
"CVE-2024-6328"
],
"database_specific": {
"cwe_ids": [
"CWE-288",
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-07-12T11:15:11Z",
"severity": "CRITICAL"
},
"details": "The MStore API \u2013 Create Native Android \u0026 iOS Apps On The Cloud plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 4.14.7. This is due to insufficient verification on the \u0027phone\u0027 parameter of the \u0027firebase_sms_login\u0027 and \u0027firebase_sms_login_v2\u0027 functions. This makes it possible for unauthenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the email address or phone number. Additionally, if a new email address is supplied, a new user account is created with the default role, even if registration is disabled.",
"id": "GHSA-xgv9-3cm6-qccq",
"modified": "2026-04-08T18:33:32Z",
"published": "2024-07-12T12:30:38Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-6328"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L699"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/mstore-api/trunk/controllers/flutter-user.php#L714"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3115231"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/17d8e2e9-5e3f-433b-be1a-6ea765eba547?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-XGW9-335V-H35W
Vulnerability from github – Published: 2025-08-23 06:30 – Updated: 2025-08-23 06:30The Ni WooCommerce Customer Product Report plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ni_woocpr_action() function in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin settings.
{
"affected": [],
"aliases": [
"CVE-2025-7827"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-08-23T05:15:32Z",
"severity": "MODERATE"
},
"details": "The Ni WooCommerce Customer Product Report plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the ni_woocpr_action() function in all versions up to, and including, 1.2.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update plugin settings.",
"id": "GHSA-xgw9-335v-h35w",
"modified": "2025-08-23T06:30:20Z",
"published": "2025-08-23T06:30:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-7827"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/ni-woocommerce-customer-product-report"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/35b02e79-9d31-482a-92b9-b1e8201d45f1?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.