← Back
CWE-862

8,736 CVEs • Abstraction: Class • Likelihood of Exploit: High

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

JSON object

Loading...

CVEs (8,736)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2025-10749
-
-
Jun 17, 2026
Oct 24, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1. This is due to missing capability checks on the 'azure-st...Show more
The Microsoft Azure Storage for WordPress plugin for WordPress is vulnerable to Unauthorized Arbitrary Media Deletion in all versions up to, and including, 4.5.1. This is due to missing capability checks on the 'azure-storage-media-replace' AJAX action. This makes it possible for authenticated attackers with subscriber-level access and above to delete arbitrary media files from the WordPress Media Library via the replace_attachment parameter granted they can access the nonce which is exposed to all authenticated users.Show less
CVE-2025-62256
1Liferay
2Digital Experience Platform
Liferay Portal
Jun 17, 2026
Oct 23, 2025
6.9 MEDIUM· v4
5.3 MEDIUM· v3
N/A· v2
Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not properly rest...Show more
Liferay Portal 7.4.0 through 7.4.3.109, and Liferay DXP 2023.Q4.0 through 2023.Q4.5, 2023.Q3.1 through 2023.Q3.7, 7.4 GA through update 92, 7.3 GA through update 35, and older unsupported versions does not properly restrict access to OpenAPI in certain circumstances, which allows remote attackers to access the OpenAPI YAML file via a crafted URL.Show less
CVE-2025-62614
-
-
Jun 17, 2026
Oct 22, 2025
8.7 HIGH· v4
N/A· v3
N/A· v2
BookLore is a self-hosted web app for organizing and managing personal book collections. In versions 1.8.1 and prior, an authentication bypass vulnerability in the BookMediaController allows any unauthenticated user to a...Show more
BookLore is a self-hosted web app for organizing and managing personal book collections. In versions 1.8.1 and prior, an authentication bypass vulnerability in the BookMediaController allows any unauthenticated user to access and download book covers, thumbnails, and complete PDF/CBX page content without authorization. The vulnerability exists because multiple media endpoints lack proper access control annotations, and the CoverJwtFilter continues request processing even when no authentication token is provided. This enables attackers to enumerate and exfiltrate all book content from the system, bypassing the intended download permissions (canDownload) entirely. This issue has been patched via commit b226c43.Show less
CVE-2025-62247
1Liferay
2Digital Experience Platform
Liferay Portal
Jun 17, 2026
Oct 22, 2025
2.0 LOW· v4
6.5 MEDIUM· v3
N/A· v2
Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 thro...Show more
Missing Authorization in Collection Provider component in the Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0 through 2025.Q2.9, 2025.Q1.0 through 2025.Q1.16, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.1 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.19 allows instance users to read and select unauthorized Blueprints through the Collection Providers across instances.Show less
CVE-2025-22178
1Atlassian
1Jira Align
Jun 17, 2026
Oct 22, 2025
5.3 MEDIUM· v4
4.3 MEDIUM· v3
N/A· v2
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view items on the...Show more
Jira Align is vulnerable to an authorization issue. A low-privilege user can access unexpected endpoints that disclose a small amount of sensitive information. For example, a low-level user was able to view items on the "Why" page.Show less
CVE-2025-62073
-
-
Jun 17, 2026
Oct 22, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Sovlix MeetingHub meetinghub.This issue affects MeetingHub: from n/a through <= 1.23.9.
CVE-2025-62072
-
-
Jun 17, 2026
Oct 22, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through <= 3.2.33.
CVE-2025-62071
-
-
Jun 17, 2026
Oct 22, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <=...Show more
Missing Authorization vulnerability in Repuso Social proof testimonials and reviews by Repuso social-testimonials-and-reviews-widget.This issue affects Social proof testimonials and reviews by Repuso: from n/a through <= 5.29.Show less
CVE-2025-62070
-
-
Jun 17, 2026
Oct 22, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in WPXPO WowRevenue revenue.This issue affects WowRevenue: from n/a through <= 1.2.13.
CVE-2025-62052
-
-
Jun 17, 2026
Oct 22, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Horea Radu One Page Express Companion one-page-express-companion.This issue affects One Page Express Companion: from n/a through <= 1.6.43.
CVE-2025-62048
-
-
Jun 17, 2026
Oct 22, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in WPMU DEV - Your All-in-One WordPress Platform SmartCrawl smartcrawl-seo.This issue affects SmartCrawl: from n/a through <= 3.14.3.
CVE-2025-62027
-
-
Jun 17, 2026
Oct 22, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in StellarWP Event Tickets event-tickets.This issue affects Event Tickets: from n/a through <= 5.26.3.
CVE-2025-62022
-
-
Jun 17, 2026
Oct 22, 2025
N/A· v4
7.5 HIGH· v3
N/A· v2
Missing Authorization vulnerability in BuddyPress BuddyPress buddypress.This issue affects BuddyPress: from n/a through <= 14.3.4.
CVE-2025-62021
-
-
Jun 17, 2026
Oct 22, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Made Neat Acknowledgify acknowledgify.This issue affects Acknowledgify: from n/a through <= 1.1.3.
CVE-2025-62019
-
-
Jun 17, 2026
Oct 22, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through <= 3.4.8.
CVE-2025-62013
-
-
Jun 17, 2026
Oct 22, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in POSIMYTH UiChemy uichemy.This issue affects UiChemy: from n/a through <= 4.0.0.
CVE-2025-62006
-
-
Jun 17, 2026
Oct 22, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in VeronaLabs WP SMS wp-sms.This issue affects WP SMS: from n/a through <= 7.0.1.
CVE-2025-53424
-
-
Jun 17, 2026
Oct 22, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Orders...Show more
Missing Authorization vulnerability in vanquish WooCommerce Orders & Customers Exporter woocommerce-orders-ei allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WooCommerce Orders & Customers Exporter: from n/a through <= 5.4.Show less
CVE-2025-53421
-
-
Jun 17, 2026
Oct 22, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in PickPlugins Accordion accordions allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Accordion: from n/a through <= 2.3.14.
CVE-2025-53236
-
-
Jun 17, 2026
Oct 22, 2025
N/A· v4
6.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in AndonDesign UDesign Core u-design-core allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects UDesign Core: from n/a through <= 4.14.0.