← Back
CWE-862

11,727 CVEs • Abstraction: Class • Likelihood of Exploit: High

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

JSON object

Loading...

CVEs (11,727)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-32832
-
-
Oct 6, 2026
Aug 31, 2025
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Missing Authorization vulnerability in Hamid Alinia Login with phone number login-with-phone-number.This issue affects Login with phone number: from n/a through <= 1.6.93.
CVE-2024-32589
-
-
Sep 26, 2026
Aug 31, 2025
N/A· v4
7.1 HIGH· v3
N/A· v2
Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner...Show more
Missing Authorization vulnerability in Dmitry V. (CEO of "UKR Solution") Barcode Scanner with Inventory & Order Manager barcode-scanner-lite-pos-to-manage-products-inventory-and-orders.This issue affects Barcode Scanner with Inventory & Order Manager: from n/a through <= 1.5.3.Show less
CVE-2025-54943
1Sun.net
1Ehrd Ctms
Oct 18, 2026
Aug 30, 2025
9.3 CRITICAL· v4
9.8 CRITICAL· v3
N/A· v2
A missing authorization vulnerability in SUNNET Corporate Training Management System before 10.11 allows remote attackers to perform unauthorized application deployment due to the absence of proper access control checks.
CVE-2025-43773
1Liferay
2Digital Experience Platform
Liferay Portal
Oct 18, 2026
Aug 29, 2025
4.6 MEDIUM· v4
9.1 CRITICAL· v3
N/A· v2
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and...Show more
Liferay Portal 7.4.0 through 7.4.3.132, and Liferay DXP 2025.Q2.0, 2025.Q1.0 through 2025.Q1.14, 2024.Q4.0 through 2024.Q4.7, 2024.Q3.0 through 2024.Q3.13, 2024.Q2.0 through 2024.Q2.13, 2024.Q1.1 through 2024.Q1.18 and 7.4 GA through update 92 has a security vulnerability that allowing for improper access through the expandoTableLocalService.Show less
CVE-2025-58334
1Jetbrains
1Ide Services
Sep 26, 2026
Aug 28, 2025
N/A· v4
8.8 HIGH· v3
N/A· v2
In JetBrains IDE Services before 2025.5.0.1086, 2025.4.2.2164 users without appropriate permissions could assign high-privileged role for themselves
CVE-2025-54734
-
-
Sep 26, 2026
Aug 28, 2025
N/A· v4
5.8 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in bPlugins B Slider b-slider allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects B Slider: from n/a through <= 1.1.30.
CVE-2025-54733
-
-
Sep 26, 2026
Aug 28, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in all_bootstrap_blocks All Bootstrap Blocks all-bootstrap-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All Bootstrap Blocks: from...Show more
Missing Authorization vulnerability in all_bootstrap_blocks All Bootstrap Blocks all-bootstrap-blocks allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects All Bootstrap Blocks: from n/a through <= 1.3.28.Show less
CVE-2025-54714
-
-
Sep 26, 2026
Aug 28, 2025
N/A· v4
7.1 HIGH· v3
N/A· v2
Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zephyr Project Manager: from n/a...Show more
Missing Authorization vulnerability in Dylan James Zephyr Project Manager zephyr-project-manager allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Zephyr Project Manager: from n/a through <= 3.3.201.Show less
CVE-2025-54710
-
-
Sep 26, 2026
Aug 28, 2025
N/A· v4
7.1 HIGH· v3
N/A· v2
Missing Authorization vulnerability in bPlugins Tiktok Feed b-tiktok-feed allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Tiktok Feed: from n/a through <= 1.0.21.
CVE-2025-53337
-
-
Sep 26, 2026
Aug 28, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Ashan Perera LifePress lifepress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LifePress: from n/a through <= 2.1.3.
CVE-2025-53230
-
-
Oct 18, 2026
Aug 28, 2025
N/A· v4
7.6 HIGH· v3
N/A· v2
Missing Authorization vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Manager for Elementor: f...Show more
Missing Authorization vulnerability in honzat Page Manager for Elementor page-manager-for-elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Page Manager for Elementor: from n/a through <= 2.0.5.Show less
CVE-2025-48350
-
-
Oct 18, 2026
Aug 28, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Basar Ventures AutoWP autowp-ai-content-writer-rewriter allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects AutoWP: from n/a through <= 2.2.7.
CVE-2025-48327
-
-
Oct 18, 2026
Aug 28, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in inkthemes WP Mailgun SMTP wp-mailgun-smtp allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects WP Mailgun SMTP: from n/a through <= 1.0.7.
CVE-2025-7956
-
-
Jun 17, 2026
Aug 28, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including, 4.13.1. This makes it possible for unaut...Show more
The Ajax Search Lite plugin for WordPress is vulnerable to Basic Information Exposure due to missing authorization in its AJAX search handler in all versions up to, and including, 4.13.1. This makes it possible for unauthenticated attackers to issue repeated AJAX requests to leak the content of any protected post in rolling 100‑character windows.Show less
CVE-2025-0951
-
-
Oct 18, 2026
Aug 28, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in various versions. This makes it possible f...Show more
Multiple plugins and/or themes for WordPress by LiquidThemes are vulnerable to unauthorized access due to a missing capability check on the liquid_reset_wordpress_before AJAX in various versions. This makes it possible for authenticated attackers, with Subscriber-level access and above, to deactivate all of a site's plugins. While we escalated this to Envato after not being able to establish contact, it appears the developer added a nonce check, however that is not sufficient protection as the nonce is exposed to all users with access to the dashboard.Show less
CVE-2025-2246
1Gitlab
1Gitlab
Jun 17, 2026
Aug 27, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have allowed unauthenticated users to access sensitive manual CI/CD variables by qu...Show more
An issue has been discovered in GitLab CE/EE affecting all versions before 18.1.5, 18.2 before 18.2.5, and 18.3 before 18.3.1 that could have allowed unauthenticated users to access sensitive manual CI/CD variables by querying the GraphQL API.Show less
CVE-2025-58201
-
-
Jun 17, 2026
Aug 27, 2025
N/A· v4
5.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in AfterShip & Automizely AfterShip Tracking aftership-woocommerce-tracking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AfterShip Tracking: from...Show more
Missing Authorization vulnerability in AfterShip & Automizely AfterShip Tracking aftership-woocommerce-tracking allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects AfterShip Tracking: from n/a through <= 1.17.17.Show less
CVE-2025-58198
-
-
Jun 17, 2026
Aug 27, 2025
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Xpro Xpro Theme Builder xpro-theme-builder allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Xpro Theme Builder: from n/a through <= 1.2.9.
CVE-2025-58193
-
-
Jun 17, 2026
Aug 27, 2025
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through <= 6.7...Show more
Missing Authorization vulnerability in Uncanny Owl Uncanny Automator uncanny-automator allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Uncanny Automator: from n/a through <= 6.7.0.1.Show less
CVE-2025-58192
1Xylusthemes
1Wp Bulk Delete
Jun 17, 2026
Aug 27, 2025
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in Xylus Themes WP Bulk Delete wp-bulk-delete allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects WP Bulk Delete: from n/a through <= 1.3.6.