← Back
CWE-862

8,736 CVEs • Abstraction: Class • Likelihood of Exploit: High

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

JSON object

Loading...

CVEs (8,736)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-4468
1Poly
3Lens
Trio 8800 FirmwareTrio C60
Jun 17, 2026
Dec 29, 2023
N/A· v4
7.6 HIGH· v3
4.6 MEDIUM· v2
A vulnerability was found in Poly Trio 8500, Trio 8800 and Trio C60. It has been classified as problematic. This affects an unknown part of the component Poly Lens Management Cloud Registration. The manipulation leads to...Show more
A vulnerability was found in Poly Trio 8500, Trio 8800 and Trio C60. It has been classified as problematic. This affects an unknown part of the component Poly Lens Management Cloud Registration. The manipulation leads to missing authorization. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-249261 was assigned to this vulnerability.Show less
CVE-2023-22676
1Andersthorborg
1Advanced Custom Fields\
Jun 17, 2026
Dec 29, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing Authorization vulnerability in Anders Thorborg.This issue affects Anders Thorborg: from n/a through 1.4.12.
CVE-2023-49230
1Peplink
1Balance Two Firmware
Jun 17, 2026
Dec 28, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configurations without prior authentication.
CVE-2023-49229
1Peplink
1Balance Two Firmware
Jun 17, 2026
Dec 28, 2023
N/A· v4
4.3 MEDIUM· v3
N/A· v2
An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged users to obtain sensitive information about the device configura...Show more
An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged users to obtain sensitive information about the device configuration.Show less
CVE-2023-49003
1Simplemobiletools
1Simple Dialer
Jun 17, 2026
Dec 27, 2023
N/A· v4
5.3 MEDIUM· v3
N/A· v2
An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simplemobiletools.dialer.activities.DialerActivity.
CVE-2023-51650
1Apache
1Hertzbeat
Jun 17, 2026
Dec 22, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosur...Show more
Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue. Show less
CVE-2023-22674
1Halgatewood
1Dashicons + Custom Post Types
Jun 17, 2026
Dec 21, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Hal Gatewood Dashicons + Custom Post Types.This issue affects Dashicons + Custom Post Types: from n/a through 1.0.2.
CVE-2023-25715
1Gamipress
1Gamipress
Jun 17, 2026
Dec 19, 2023
N/A· v4
6.5 MEDIUM· v3
N/A· v2
Missing Authorization vulnerability in GamiPress GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress.This issue affects GamiPress – The #1 gamification plugin to reward poin...Show more
Missing Authorization vulnerability in GamiPress GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress.This issue affects GamiPress – The #1 gamification plugin to reward points, achievements, badges & ranks in WordPress: from n/a through 2.5.6.Show less
CVE-2023-48751
1Xnau
1Participants Database
Jun 17, 2026
Dec 19, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.Th...Show more
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects Participants Database: from n/a through 2.5.5.Show less
CVE-2023-47754
1Cleverplugins
1Delete Duplicate Posts
Jun 17, 2026
Dec 19, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Missing Authorization vulnerability in Clever plugins Delete Duplicate Posts allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Delete Duplicate Posts: from n/a through 4.8.9.
CVE-2023-46212
1Wpvnteam
1Wp Extra
Jun 17, 2026
Dec 19, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects WP EXtra: from n/a...Show more
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in TienCOP WP EXtra allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request Forgery.This issue affects WP EXtra: from n/a through 6.2.Show less
CVE-2023-5949
1Wpmudev
1Smartcrawl
Jun 17, 2026
Dec 18, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
The SmartCrawl WordPress plugin before 3.8.3 does not prevent unauthorised users from accessing password-protected posts' content.
CVE-2023-5056
1Redhat
1Service Interconnect
Jun 17, 2026
Dec 18, 2023
N/A· v4
4.1 MEDIUM· v3
N/A· v2
A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in t...Show more
A flaw was found in the Skupper operator, which may permit a certain configuration to create a service account that would allow an authenticated attacker in the adjacent cluster to view deployments in all namespaces in the cluster. This issue permits unauthorized viewing of information outside of the user's purview.Show less
CVE-2023-50976
1Redpanda
1Redpanda
Jun 17, 2026
Dec 18, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API.
CVE-2023-5061
1Gitlab
1Gitlab
Jun 17, 2026
Dec 15, 2023
N/A· v4
4.3 MEDIUM· v3
N/A· v2
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may h...Show more
An issue has been discovered in GitLab affecting all versions starting from 9.3 before 16.4.4, all versions starting from 16.5 before 16.5.4, all versions starting from 16.6 before 16.6.2. In certain situations, it may have been possible for developers to override predefined CI variables via the REST API.Show less
CVE-2023-48375
1Csharp
1Cws Collaborative Development Platform
Jun 17, 2026
Dec 15, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
SmartStar Software CWS is a web-based integration platform, it has a vulnerability of missing authorization and users are able to access data or perform actions that they should not be allowed to perform via commands. An...Show more
SmartStar Software CWS is a web-based integration platform, it has a vulnerability of missing authorization and users are able to access data or perform actions that they should not be allowed to perform via commands. An authenticated with normal user privilege can execute administrator privilege, resulting in performing arbitrary system operations or disrupting service.Show less
CVE-2023-48676
1Acronis
1Agent
Jun 17, 2026
Dec 14, 2023
N/A· v4
7.1 HIGH· v3
N/A· v2
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36943.
CVE-2023-50779
1Jenkins
1Paaslane Estimate
Jun 17, 2026
Dec 13, 2023
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing permission checks in Jenkins PaaSLane Estimate Plugin 1.0.4 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified URL using an attacker-specified token.
CVE-2023-50769
1Jenkins
1Nexus Platform
Jun 17, 2026
Dec 13, 2023
N/A· v4
4.3 MEDIUM· v3
N/A· v2
Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtai...Show more
Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing credentials stored in Jenkins.Show less
CVE-2023-50767
1Jenkins
1Nexus Platform
Jun 17, 2026
Dec 13, 2023
N/A· v4
5.4 MEDIUM· v3
N/A· v2
Missing permission checks in Jenkins Nexus Platform Plugin 3.18.0-03 and earlier allow attackers with Overall/Read permission to send an HTTP request to an attacker-specified URL and parse the response as XML.