CWE-862
Allowed-with-ReviewMissing Authorization
Abstraction: Class · Status: Incomplete
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
19710 vulnerabilities reference this CWE, most recent first.
GHSA-59M8-J2F8-VC8X
Vulnerability from github – Published: 2026-10-12 15:32 – Updated: 2026-10-12 15:32yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /admin-api/crm/invoice/check. The CrmInvoiceController check handler lacks @PreAuthorize and approver checks are commented out, letting attackers bypass the invoice approval workflow by supplying any invoice id.
{
"affected": [],
"aliases": [
"CVE-2026-109173"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-12T13:17:29Z",
"severity": "MODERATE"
},
"details": "yshop-crm through 2.1.3 contains a missing authorization vulnerability that allows any authenticated back-office user to approve or reject invoices via POST /admin-api/crm/invoice/check. The CrmInvoiceController check handler lacks @PreAuthorize and approver checks are commented out, letting attackers bypass the invoice approval workflow by supplying any invoice id.",
"id": "GHSA-59m8-j2f8-vc8x",
"modified": "2026-10-12T15:32:14Z",
"published": "2026-10-12T15:32:14Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-109173"
},
{
"type": "WEB",
"url": "https://github.com/AnkesKasty/cve-request-poc/blob/a7b6d1423555812d8efa26c91c5d0683164b31e5/yshop-crm/poc_crm_invoice_check.py"
},
{
"type": "WEB",
"url": "https://github.com/guchengwuyue/yshop-crm/blob/a77250f7ace63d5b6b363841d9ff441e0e2a9a6b/yshop-crm/sql/yshop-crm-open-source.sql#L2597"
},
{
"type": "WEB",
"url": "https://github.com/guchengwuyue/yshop-crm/blob/a77250f7ace63d5b6b363841d9ff441e0e2a9a6b/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/controller/admin/crminvoice/CrmInvoiceController.java#L72-L78"
},
{
"type": "WEB",
"url": "https://github.com/guchengwuyue/yshop-crm/blob/a77250f7ace63d5b6b363841d9ff441e0e2a9a6b/yshop-crm/yshop-module-crm/yshop-module-crm-biz/src/main/java/co/yixiang/yshop/module/crm/service/crminvoice/CrmInvoiceServiceImpl.java#L219-L315"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/yshop-crm-through-2.1.3-missing-authorization-via-invoice-check-endpoint"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-59MM-3634-JCPW
Vulnerability from github – Published: 2024-12-09 15:31 – Updated: 2026-04-28 21:35Missing Authorization vulnerability in PayPal PayPal Brasil para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Brasil para WooCommerce: from n/a through 1.4.2.
{
"affected": [],
"aliases": [
"CVE-2023-25026"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-12-09T13:15:22Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in PayPal PayPal Brasil para WooCommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects PayPal Brasil para WooCommerce: from n/a through 1.4.2.",
"id": "GHSA-59mm-3634-jcpw",
"modified": "2026-04-28T21:35:16Z",
"published": "2024-12-09T15:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-25026"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/paypal-brasil-para-woocommerce/vulnerability/wordpress-paypal-brasil-para-woocommerce-plugin-1-4-2-broken-access-control?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-59MW-82VH-F4Q5
Vulnerability from github – Published: 2026-03-13 21:31 – Updated: 2026-03-13 21:31Missing Authorization vulnerability in raratheme Travel Agency travel-agency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Agency: from n/a through <= 1.5.5.
{
"affected": [],
"aliases": [
"CVE-2026-32346"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-03-13T19:54:46Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in raratheme Travel Agency travel-agency allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Travel Agency: from n/a through \u003c= 1.5.5.",
"id": "GHSA-59mw-82vh-f4q5",
"modified": "2026-03-13T21:31:48Z",
"published": "2026-03-13T21:31:48Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-32346"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/Wordpress/Theme/travel-agency/vulnerability/wordpress-travel-agency-theme-1-5-5-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-59Q9-P5GJ-C577
Vulnerability from github – Published: 2026-05-14 06:31 – Updated: 2026-05-14 06:31The WP Encryption – One Click Free SSL Certificate & SSL / HTTPS Redirect, Security & SSL Scan plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the 'wple_basic_get_requests' function in all versions up to, and including, 7.8.5.10. This makes it possible for authenticated attackers, with subscriber level access and above, to reset the SSL setup state, force SSL to appear complete, and modify plan selection options.
{
"affected": [],
"aliases": [
"CVE-2026-3829"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-05-14T06:16:22Z",
"severity": "MODERATE"
},
"details": "The WP Encryption \u2013 One Click Free SSL Certificate \u0026 SSL / HTTPS Redirect, Security \u0026 SSL Scan plugin for WordPress is vulnerable to unauthorized modification of data due to missing capability checks on the \u0027wple_basic_get_requests\u0027 function in all versions up to, and including, 7.8.5.10. This makes it possible for authenticated attackers, with subscriber level access and above, to reset the SSL setup state, force SSL to appear complete, and modify plan selection options.",
"id": "GHSA-59q9-p5gj-c577",
"modified": "2026-05-14T06:31:33Z",
"published": "2026-05-14T06:31:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-3829"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?old_path=wp-letsencrypt-ssl/tags/7.8.5.10/admin/le_admin.php\u0026new_path=wp-letsencrypt-ssl/tags/7.8.5.11/admin/le_admin.php"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset?old_path=wp-letsencrypt-ssl/tags/7.8.5.10/admin/le_handlers.php\u0026new_path=wp-letsencrypt-ssl/tags/7.8.5.11/admin/le_handlers.php"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/9a09ec65-32e4-4841-a365-f67c15b80bf9?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-59V7-VQQ8-7JQW
Vulnerability from github – Published: 2024-05-03 09:30 – Updated: 2026-04-28 21:35Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1.
{
"affected": [],
"aliases": [
"CVE-2024-33915"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-05-03T09:15:08Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Bowo Debug Log Manager.This issue affects Debug Log Manager: from n/a through 2.3.1.",
"id": "GHSA-59v7-vqq8-7jqw",
"modified": "2026-04-28T21:35:03Z",
"published": "2024-05-03T09:30:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33915"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/debug-log-manager/wordpress-debug-log-manager-plugin-2-3-1-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-59VF-6XRW-G8W2
Vulnerability from github – Published: 2026-10-14 15:32 – Updated: 2026-10-14 15:32Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through 3.23.
{
"affected": [],
"aliases": [
"CVE-2026-107417"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-14T13:17:23Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in Muralidharan Ramasamy Push Notification for Post and BuddyPress push-notification-for-post-and-buddypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Push Notification for Post and BuddyPress: from n/a through 3.23.",
"id": "GHSA-59vf-6xrw-g8w2",
"modified": "2026-10-14T15:32:18Z",
"published": "2026-10-14T15:32:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-107417"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/push-notification-for-post-and-buddypress/vulnerability/wordpress-push-notification-for-post-and-buddypress-plugin-3-23-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-59VJ-GRH4-HP2J
Vulnerability from github – Published: 2025-02-07 12:31 – Updated: 2026-04-01 18:33Missing Authorization vulnerability in blackandwhitedigital BookPress – For Book Authors allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects BookPress – For Book Authors: from n/a through 1.2.7.
{
"affected": [],
"aliases": [
"CVE-2025-25167"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-02-07T10:15:22Z",
"severity": "HIGH"
},
"details": "Missing Authorization vulnerability in blackandwhitedigital BookPress \u2013 For Book Authors allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects BookPress \u2013 For Book Authors: from n/a through 1.2.7.",
"id": "GHSA-59vj-grh4-hp2j",
"modified": "2026-04-01T18:33:36Z",
"published": "2025-02-07T12:31:19Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-25167"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/wordpress/plugin/book-press/vulnerability/wordpress-bookpress-for-book-authors-plugin-1-2-7-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-59WX-5MPV-JF8P
Vulnerability from github – Published: 2024-04-29 15:30 – Updated: 2026-04-28 21:35Missing Authorization vulnerability in codeSavory Knowledge Base documentation & wiki plugin – BasePress.This issue affects Knowledge Base documentation & wiki plugin – BasePress: from n/a through 2.16.1.
{
"affected": [],
"aliases": [
"CVE-2024-33588"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-04-29T13:15:31Z",
"severity": "MODERATE"
},
"details": "Missing Authorization vulnerability in codeSavory Knowledge Base documentation \u0026 wiki plugin \u2013 BasePress.This issue affects Knowledge Base documentation \u0026 wiki plugin \u2013 BasePress: from n/a through 2.16.1.",
"id": "GHSA-59wx-5mpv-jf8p",
"modified": "2026-04-28T21:35:01Z",
"published": "2024-04-29T15:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-33588"
},
{
"type": "WEB",
"url": "https://patchstack.com/database/vulnerability/basepress/wordpress-basepress-plugin-2-16-1-broken-access-control-vulnerability?_s_id=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-59WX-GR78-XR29
Vulnerability from github – Published: 2025-06-11 09:30 – Updated: 2025-06-11 09:30SunGrow's back end users system iSolarCloud https://isolarcloud.com uses an MQTT service to transport data from the user's connected devices to the user's web browser. The MQTT server however did not have sufficient restrictions in place to limit the topics that a user could subscribe to. While the data that is transmitted through the MQTT server is encrypted and the credentials for the MQTT server are obtained though an API call, the credentials could be used to subscribe to any topic and the encryption key can be used to decrypt all messages received. An attack with an account on iSolarCloud.com could extract MQTT credentials and the decryption key from the browser and then use an external program to subscribe to the topic '#' and thus recieve all messages from all connected devices.
{
"affected": [],
"aliases": [
"CVE-2025-29756"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-06-11T08:15:21Z",
"severity": "HIGH"
},
"details": "SunGrow\u0027s back end users system iSolarCloud https://isolarcloud.com \u00a0uses an MQTT service to transport data from the user\u0027s connected devices to the user\u0027s web browser.\u00a0\nThe MQTT server however did not have sufficient restrictions in place to limit the topics that a user could subscribe to.\u00a0\nWhile the data that is transmitted through the MQTT server is encrypted and the credentials for the MQTT server are obtained though an API call, the credentials could be used to subscribe to any topic and the encryption key can be used to decrypt all messages received.\nAn attack with an account on iSolarCloud.com could extract\u00a0MQTT credentials and the decryption key from the browser and then use an external program to subscribe to the topic \u0027#\u0027 and thus recieve all messages from all connected devices.",
"id": "GHSA-59wx-gr78-xr29",
"modified": "2025-06-11T09:30:32Z",
"published": "2025-06-11T09:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29756"
},
{
"type": "WEB",
"url": "https://csirt.divd.nl/CVE-2025-29756"
},
{
"type": "WEB",
"url": "https://csirt.divd.nl/DIVD-2025-00009"
},
{
"type": "WEB",
"url": "https://isolarcloud.com"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-59XH-VH54-X5HF
Vulnerability from github – Published: 2026-10-02 12:31 – Updated: 2026-10-02 12:31YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_config and api/archives to overwrite configuration and list, download, or delete backup archives.
{
"affected": [],
"aliases": [
"CVE-2026-104467"
],
"database_specific": {
"cwe_ids": [
"CWE-862"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-02T12:17:19Z",
"severity": "CRITICAL"
},
"details": "YesWiki before 4.6.7 contains an authorization bypass vulnerability in ApiService::isAuthorized() that allows unauthenticated attackers to call admin-only API routes when public API mode is enabled. Attackers can send requests to endpoints like api/ci/update_config and api/archives to overwrite configuration and list, download, or delete backup archives.",
"id": "GHSA-59xh-vh54-x5hf",
"modified": "2026-10-02T12:31:17Z",
"published": "2026-10-02T12:31:17Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/YesWiki/yeswiki/security/advisories/GHSA-v527-6r4j-j2w2"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104467"
},
{
"type": "WEB",
"url": "https://www.vulncheck.com/advisories/yeswiki-before-4.6.7-authorization-bypass-via-public-api-mode"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-665: Exploitation of Thunderbolt Protection Flaws
An adversary leverages a firmware weakness within the Thunderbolt protocol, on a computing device to manipulate Thunderbolt controller firmware in order to exploit vulnerabilities in the implementation of authorization and verification schemes within Thunderbolt protection mechanisms. Upon gaining physical access to a target device, the adversary conducts high-level firmware manipulation of the victim Thunderbolt controller SPI (Serial Peripheral Interface) flash, through the use of a SPI Programing device and an external Thunderbolt device, typically as the target device is booting up. If successful, this allows the adversary to modify memory, subvert authentication mechanisms, spoof identities and content, and extract data and memory from the target device. Currently 7 major vulnerabilities exist within Thunderbolt protocol with 9 attack vectors as noted in the Execution Flow.