← Back
CWE-862

10,069 CVEs • Abstraction: Class • Likelihood of Exploit: High

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

JSON object

Loading...

CVEs (10,069)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2022-36352
1Metagauss
1Profilegrid
Jun 17, 2026
Jan 8, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profiles, Memberships, Groups and Communities: from n/a through 5....Show more
Missing Authorization vulnerability in Profilegrid ProfileGrid – User Profiles, Memberships, Groups and Communities.This issue affects ProfileGrid – User Profiles, Memberships, Groups and Communities: from n/a through 5.0.3.Show less
CVE-2022-34344
1Rymera
1Wholesale Suite
Jun 17, 2026
Jan 8, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More.This issue affects Wholesale Suite – WooCom...Show more
Missing Authorization vulnerability in Rymera Web Co Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More.This issue affects Wholesale Suite – WooCommerce Wholesale Prices, B2B, Catalog Mode, Order Form, Wholesale User Roles, Dynamic Pricing & More: from n/a through 2.1.5.Show less
CVE-2023-6383
1Bowo
1Debug Log Manager
Jun 17, 2026
Jan 8, 2024
N/A· v4
7.5 HIGH· v3
N/A· v2
The Debug Log Manager WordPress plugin before 2.3.0 contains a Directory listing vulnerability was discovered, which allows you to download the debug log without authorization and gain access to sensitive data
CVE-2023-6798
1Themeisle
1Rss Aggregator By Feedzy
Jun 17, 2026
Jan 6, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check when updating settings...Show more
The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to unauthorized settings update due to a missing capability check when updating settings in all versions up to, and including, 4.3.2. This makes it possible for authenticated attackers, with author-level access or above to change the plugin's settings including proxy settings, which are also exposed to authors.Show less
CVE-2023-6733
1Butlerblog
1Wp Members
Jun 17, 2026
Jan 4, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem_field shortcode. This makes it possible for authenticated at...Show more
The WP-Members Membership Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.4.8 via the wpmem_field shortcode. This makes it possible for authenticated attackers, with contributor access and above, to extract sensitive data including user emails, password hashes, usernames, and more.Show less
CVE-2024-0201
1Webcodingplace
1Product Expiry For Woocommerce
Jun 17, 2026
Jan 3, 2024
N/A· v4
4.3 MEDIUM· v3
N/A· v2
The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_settings' function in versions up to, and including, 2.5. This mak...Show more
The Product Expiry for WooCommerce plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'save_settings' function in versions up to, and including, 2.5. This makes it possible for authenticated attackers, with subscriber-level permissions or above to update plugin settings. CVE-2023-52179 appears to be a duplicate of this issue.Show less
CVE-2023-7068
1Webtoffee
1Woocommerce Pdf Invoices, Packing Slips, Delivery Notes And Shipping Labels
Jun 17, 2026
Jan 3, 2024
N/A· v4
6.5 MEDIUM· v3
N/A· v2
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on theprint_packinglist action in all ve...Show more
The WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on theprint_packinglist action in all versions up to, and including, 4.3.0. This makes it possible for authenticated attackers, with subscriber-level access and above, to export orders which can contain sensitive information.Show less
CVE-2023-6600
1Daan
1Omgf
Jun 17, 2026
Jan 3, 2024
N/A· v4
5.4 MEDIUM· v3
N/A· v2
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the update_settings...Show more
The OMGF | GDPR/DSGVO Compliant, Faster Google Fonts. Easy. plugin for WordPress is vulnerable to unauthorized modification of data and Stored Cross-Site Scripting due to a missing capability check on the update_settings() function hooked via admin_init in all versions up to, and including, 5.7.9. This makes it possible for unauthenticated attackers to update the plugin's settings which can be used to inject Cross-Site Scripting payloads and delete entire directories. PLease note there were several attempted patched, and we consider 5.7.10 to be the most sufficiently patched.Show less
CVE-2023-42358
1O Ran Sc
1Ric Plt E2mgr
Jun 17, 2026
Jan 3, 2024
N/A· v4
7.7 HIGH· v3
N/A· v2
An issue was discovered in O-RAN Software Community ric-plt-e2mgr in the G-Release environment, allows remote attackers to cause a denial of service (DoS) via a crafted request to the E2Manager API component.
CVE-2023-4164
1Google
1Android
Jun 17, 2026
Jan 2, 2024
N/A· v4
5.5 MEDIUM· v3
N/A· v2
There is a possible information disclosure due to a missing permission check. This could lead to local information disclosure of health data with no additional execution privileges needed.
CVE-2023-47458
1Bladex
1Springblade
Jul 9, 2026
Jan 2, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
An issue in SpringBlade v.3.7.0 and before allows a remote attacker to escalate privileges via the lack of permissions control framework.
CVE-2023-5877
1Servit
1Affiliate Toolkit
Jun 17, 2026
Jan 1, 2024
N/A· v4
9.8 CRITICAL· v3
N/A· v2
The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make r...Show more
The affiliate-toolkit WordPress plugin before 3.4.3 lacks authorization and authentication for requests to it's affiliate-toolkit-starter/tools/atkp_imagereceiver.php endpoint, allowing unauthenticated visitors to make requests to arbitrary URL's, including RFC1918 private addresses, leading to a Server Side Request Forgery (SSRF) issue.Show less
CVE-2023-52275
1Tecno Mobile
1Camon X Firmware
Jun 17, 2026
Dec 31, 2023
N/A· v4
2.1 LOW· v3
N/A· v2
Gallery3d on Tecno Camon X CA7 devices allows attackers to view hidden images by navigating to data/com.android.gallery3d/.privatealbum/.encryptfiles and guessing the correct image file extension.
CVE-2023-4468
1Poly
3Lens
Trio 8800 FirmwareTrio C60
Jun 17, 2026
Dec 29, 2023
N/A· v4
7.6 HIGH· v3
4.6 MEDIUM· v2
A vulnerability was found in Poly Trio 8500, Trio 8800 and Trio C60. It has been classified as problematic. This affects an unknown part of the component Poly Lens Management Cloud Registration. The manipulation leads to...Show more
A vulnerability was found in Poly Trio 8500, Trio 8800 and Trio C60. It has been classified as problematic. This affects an unknown part of the component Poly Lens Management Cloud Registration. The manipulation leads to missing authorization. It is possible to launch the attack on the physical device. The exploit has been disclosed to the public and may be used. The identifier VDB-249261 was assigned to this vulnerability.Show less
CVE-2023-22676
1Andersthorborg
1Advanced Custom Fields\
Jun 17, 2026
Dec 29, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing Authorization vulnerability in Anders Thorborg.This issue affects Anders Thorborg: from n/a through 1.4.12.
CVE-2023-49230
1Peplink
1Balance Two Firmware
Jun 17, 2026
Dec 28, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in captive portals allows attackers to modify the portals' configurations without prior authentication.
CVE-2023-49229
1Peplink
1Balance Two Firmware
Jun 17, 2026
Dec 28, 2023
N/A· v4
4.3 MEDIUM· v3
N/A· v2
An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged users to obtain sensitive information about the device configura...Show more
An issue was discovered in Peplink Balance Two before 8.4.0. A missing authorization check in the administration web service allows read-only, unprivileged users to obtain sensitive information about the device configuration.Show less
CVE-2023-49003
1Simplemobiletools
1Simple Dialer
Jun 17, 2026
Dec 27, 2023
N/A· v4
5.3 MEDIUM· v3
N/A· v2
An issue in simplemobiletools Simple Dialer 5.18.1 allows an attacker to bypass intended access restrictions via interaction with com.simplemobiletools.dialer.activities.DialerActivity.
CVE-2023-51650
1Apache
1Hertzbeat
Jun 17, 2026
Dec 22, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosur...Show more
Hertzbeat is an open source, real-time monitoring system. Prior to version 1.4.1, Spring Boot permission configuration issues caused unauthorized access vulnerabilities to three interfaces. This could result in disclosure of sensitive server information. Version 1.4.1 fixes this issue. Show less
CVE-2023-22674
1Halgatewood
1Dashicons + Custom Post Types
Jun 17, 2026
Dec 21, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Hal Gatewood Dashicons + Custom Post Types.This issue affects Dashicons + Custom Post Types: from n/a through 1.0.2.