Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

CVEs (8,720)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2025-67972 - - Jun 17, 2026 Feb 20, 2026 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in Zoho Mail Zoho ZeptoMail allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Zoho ZeptoMail: from n/a through 3.2.9.
CVE-2025-67970 - - Jun 17, 2026 Feb 20, 2026 N/A· v4 5.9 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in vertim Schedula schedula-smart-appointment-booking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Schedula: from n/a through <= 1.0.
CVE-2025-67969 - - Jun 17, 2026 Feb 20, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UP...Show more Missing Authorization vulnerability in knitpay UPI QR Code Payment Gateway for WooCommerce upi-qr-code-payment-for-woocommerce allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UPI QR Code Payment Gateway for WooCommerce: from n/a through <= 1.5.1.Show less
CVE-2025-67624 - - Jun 17, 2026 Feb 20, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in Arya Dhiratara Optimize More! – Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimize More! – Images: from...Show more Missing Authorization vulnerability in Arya Dhiratara Optimize More! – Images optimize-more-images allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Optimize More! – Images: from n/a through <= 1.1.3.Show less
CVE-2025-67547 - - Jun 17, 2026 Feb 20, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in uixthemes Konte konte allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Konte: from n/a through <= 2.4.6.
CVE-2025-53217 - - Jun 17, 2026 Feb 20, 2026 N/A· v4 7.6 HIGH· v3 N/A· v2 Missing Authorization vulnerability in staviravn AIO WP Builder all-in-one-wp-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AIO WP Builder: from n/a through <= 2.0.2.
CVE-2024-54222 - - Jun 17, 2026 Feb 20, 2026 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in Seraphinite Solutions Seraphinite Accelerator seraphinite-accelerator allows Retrieve Embedded Sensitive Data.This issue affects Seraphinite Accelerator: from n/a through <= 2.22.15...Show more Missing Authorization vulnerability in Seraphinite Solutions Seraphinite Accelerator seraphinite-accelerator allows Retrieve Embedded Sensitive Data.This issue affects Seraphinite Accelerator: from n/a through <= 2.22.15.Show less
CVE-2024-43228 - - Jun 17, 2026 Feb 20, 2026 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in SecuPress SecuPress Free secupress.This issue affects SecuPress Free: from n/a through <= 2.2.5.3.
CVE-2024-34438 - - Jun 17, 2026 Feb 20, 2026 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in Anssi Laitila Shared Files shared-files.This issue affects Shared Files: from n/a through <= 1.7.19.
CVE-2026-2819 - - Jun 17, 2026 Feb 20, 2026 2.1 LOW· v4 6.3 MEDIUM· v3 6.5 MEDIUM· v2 A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3. This vulnerability affects the function SaServletFilter of the file /workflow/instance/deleteByInstanceIds of the component Workflow Module. The manip...Show more A vulnerability was identified in Dromara RuoYi-Vue-Plus up to 5.5.3. This vulnerability affects the function SaServletFilter of the file /workflow/instance/deleteByInstanceIds of the component Workflow Module. The manipulation leads to missing authorization. The attack may be initiated remotely. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way.Show less
CVE-2026-26977 1Frappe 1Learning Jun 17, 2026 Feb 20, 2026 6.9 MEDIUM· v4 5.3 MEDIUM· v3 N/A· v2 Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are able to access the details of unpublished courses via API endpoi...Show more Frappe Learning Management System (LMS) is a learning system that helps users structure their content. In versions 2.44.0 and below, unauthorized users are able to access the details of unpublished courses via API endpoints. A fix for this issue is planned for the 2.45.0 release.Show less
CVE-2025-30416 1Acronis 1Cyber Protect Jun 17, 2026 Feb 20, 2026 N/A· v4 10.0 CRITICAL· v3 N/A· v2 Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before...Show more Sensitive data disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect 16 (Linux, Windows) before build 39938, Acronis Cyber Protect 15 (Linux, Windows) before build 41800.Show less
CVE-2026-27387 - - Jun 17, 2026 Feb 19, 2026 N/A· v4 5.4 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in Designinvento DirectoryPress directorypress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DirectoryPress: from n/a through <= 3.6.26.
CVE-2026-27368 - - Jun 17, 2026 Feb 19, 2026 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects C...Show more Missing Authorization vulnerability in SeedProd Coming Soon Page, Under Construction & Maintenance Mode by SeedProd coming-soon allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Coming Soon Page, Under Construction & Maintenance Mode by SeedProd: from n/a through <= 6.19.8.Show less
CVE-2026-27328 - - Jun 17, 2026 Feb 19, 2026 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in DevsBlink EduBlink edublink allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects EduBlink: from n/a through <= 2.0.7.
CVE-2026-27327 - - Jun 17, 2026 Feb 19, 2026 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in YayCommerce YayMail yaymail allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects YayMail: from n/a through <= 4.3.2.
CVE-2025-15563 1Nestersoft 1Worktime Jun 17, 2026 Feb 19, 2026 N/A· v4 5.3 MEDIUM· v3 N/A· v2 Any unauthenticated user can reset the WorkTime on-prem database configuration by sending a specific HTTP request to the WorkTime server. No authorization check is applied here.
CVE-2026-27092 - - Jun 17, 2026 Feb 19, 2026 N/A· v4 6.5 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in Greg Winiarski WPAdverts wpadverts allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WPAdverts: from n/a through <= 2.3.0.
CVE-2026-27066 - - Jun 11, 2026 Feb 19, 2026 N/A· v4 N/A· v3 N/A· v2 Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE-2026-27056 - - Jun 17, 2026 Feb 19, 2026 N/A· v4 4.3 MEDIUM· v3 N/A· v2 Missing Authorization vulnerability in StellarWP iThemes Sync ithemes-sync allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects iThemes Sync: from n/a through <= 3.2.8.

Previous 1...848586...436 Next