Missing Authorization
CWE-862
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
We track 2,825 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 13 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- Architecture and Design: Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using authorization frameworks such as the JAAS Authorization Framework and the OWASP ESAPI Access Control feature.
- Architecture and Design: For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page. One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
- System Configuration Installation: Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a default deny policy when defining these ACLs.
Latest Missing Authorization vulnerabilities
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T61…: Missing Authorization
In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T61…: Missing Authorization
In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T61…: Missing Authorization
In wifi service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T61…: Missing Authorization
In ion service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
- 8.8 High severity
wpForo Forum: Cross-Site Request Forgery
Cross-Site Request Forgery (CSRF), Missing Authorization vulnerability in gVectors Team wpForo Forum wpforo allows Cross Site Request Forgery, Accessing Functionality Not Properly Constrained by ACLs leading to forced all users log out.This issue affects wpFor
- 9.8 Critical severity
Jenkins MATLAB Plugin: Missing Authorization
Missing permission checks in Jenkins MATLAB Plugin 2.11.0 and earlier allow attackers to have Jenkins parse an XML file from the Jenkins controller file system.
- 7.5 High severity
Node: Missing Authorization
The use of __proto__ in process.mainModule.__proto__.require() can bypass the policy mechanism and require modules outside of the policy.json definition. This vulnerability affects all users using the experimental policy mechanism in all active release lines:
- 8.8 High severity
AWeber – Free Sign Up Form and Landing Page…: Cross-Site Request Forgery
Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in AWeber AWeber – Free Sign Up Form and Landing Page Builder Plugin for Lead Generation and Email Newsletter Growth allows Accessing Functionality Not Properly Constrained by ACLs, Cross-S
- 8.8 High severity
CLUSTERPRO X(EXPRESSCLUSTER X): Missing Authorization
CLUSTERPRO X Ver5.1 and earlier and EXPRESSCLUSTER X 5.1 and earlier, CLUSTERPRO X SingleServerSafe 5.1 and earlier, EXPRESSCLUSTER X SingleServerSafe 5.1 and earlier allows a attacker to log in to the product may execute an arbitrary command.
- 7.5 High severity
h2oai/h2o-3: Missing Authorization
A Local File Inclusion (LFI) vulnerability exists in the h2o-3 REST API, allowing unauthenticated remote attackers to read arbitrary files on the server with the permissions of the user running the h2o-3 instance. This issue affects the default installation an
- 8.1 High severity
Rx9 Pro Firmware: Missing Authorization
Missing error handling in the HTTP server component of Tenda RX9 Pro Firmware V22.03.02.20 allows authenticated attackers to arbitrarily lock the device.
- 7.5 High severity
Templately: Missing Authorization
The Templately WordPress plugin before 2.2.6 does not properly authorize the `saved-templates/delete` REST API call, allowing unauthenticated users to delete arbitrary posts.
- 9.1 Critical severity
Boomerang: Missing Authorization
An issue was discovered in the Boomerang Parental Control application through 13.83 for Android. The child can use Safe Mode to remove all restrictions temporarily or uninstall the application without the parents noticing.
- 7.5 High severity
Facebookconversiontrackingplus: Missing Authorization
In the module "Pixel Plus: Events + CAPI + Pixel Catalog for Facebook Module" (facebookconversiontrackingplus) up to version 2.4.9 from Smart Modules for PrestaShop, a guest can download personal information without restriction. Due to a lack of permissions co
- 8.1 High severity
Syska SW100 Smartwatch: Missing Authorization
The vulnerability exists in Syska SW100 Smartwatch due to an improper implementation and/or configuration of Nordic Device Firmware Update (DFU) which is used for performing Over-The-Air (OTA) firmware updates on the Bluetooth Low Energy (BLE) devices. An unau
- 7.8 High severity
Android: Missing Authorization
In Settings, there is a possible way for the user to change SIM due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.8 High severity
Android: Missing Authorization
In Settings, there is a possible bypass of profile owner restrictions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.8 High severity
Android: Missing Authorization
In Settings, there is a possible restriction bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.8 High severity
Android: Missing Authorization
In Telecomm, there is a possible way to silence the ring for calls of secondary users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploit
- 7.8 High severity
Android: Missing Authorization
In Telephony, there is a possible way for a guest user to change the preferred SIM due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitati
- 7.8 High severity
Android: Missing Authorization
In Permission Manager, there is a possible way to bypass required permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.8 High severity
Android: Missing Authorization
In Package Installer, there is a possible way to determine whether an app is installed, without query permissions, due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interact
- 7.8 High severity
Android: Missing Authorization
In Core, there is a possible way to forward calls without user knowledge due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.
- 7.5 High severity
Post Meta Data Manager: Missing Authorization
The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_delete_user_meta, pmdm_wp_delete_term_meta, and pmdm_wp_ajax_delete_meta functions in versions up to, and includ
- 8.8 High severity
Post Meta Data Manager: Missing Authorization
The Post Meta Data Manager plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the pmdm_wp_change_user_meta and pmdm_wp_change_post_meta functions in versions up to, and including, 1.2.0. This makes it p
- 8.8 High severity
WP EXtra – One Click Optimize: Missing Authorization
The WP EXtra plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the register() function in versions up to, and including, 6.2. This makes it possible for authenticated attackers, with subscriber-level p
- 8.1 High severity
Lenovo XClarity Controller (XCC): Missing Authorization
An authenticated XCC user with Read-Only permission can change a different user’s password through a crafted API command. This affects ThinkSystem v2 and v3 servers with XCC; ThinkSystem v1 servers are not affected.
- 7.8 High severity
ctrlX HMI Web Panel - WR21 (WR2107): Missing Authorization
The vulnerability allows a low privileged (untrusted) application to modify a critical system property that should be denied, in order to enable the ADB (Android Debug Bridge) protocol to be exposed on the network, exploiting it to gain a privileged shell on t
- 8.1 High severity
xwiki-platform: Missing Authorization
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Starting with the introduction of attachment move support in version 14.0-rc-1 and prior to versions 14.4.8, 14.10.4, and 15.0-rc-1, an attacker with edit
- 7.5 High severity
Soisy Pagamento Rateale: Missing Authorization
The Soisy Pagamento Rateale plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the parseRemoteRequest function in versions up to, and including, 6.0.1. This makes it possible for unauthenticated attackers wit
- 9.8 Critical severity
WPBot – AI ChatBot for Live Support, Lead…: Missing Authorization
The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding functions in versions up to, and including, 4.8.9 as well as 4.9.2. This makes it possible for unauthenticated attackers
- 7.5 High severity
Ad Inserter – Ad Manager & AdSense Ads: Missing Authorization
The Ad Inserter for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.7.30 via the ai-debug-processing-fe URL parameter. This can allow unauthenticated attackers to extract sensitive data including installed plugins
- 7.1 High severity
Acronis Cyber Protect Cloud Agent: Missing Authorization
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 36497, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 391
- 7.5 High severity
APU0200: Missing Authorization
Missing Authorization in RDT400 in SICK APU allows an unprivileged remote attacker to modify data via HTTP requests that no not require authentication.
- 7.8 High severity
SC9863A/T606/T612/T616/T610/T618/T760/T770/T820…: Missing Authorization
In linkturbo, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T310/T606/T612/T616/T61…: Missing Authorization
In phasechecksercer, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
- 7.1 High severity
Acronis Cyber Protect Cloud Agent: Missing Authorization
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 36343, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 391
- 7.1 High severity
Acronis Cyber Protect Cloud Agent: Missing Authorization
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 35895, Acronis Cyber Protect 16 (Linux, macOS, Windows) before build 373
- 7.1 High severity
Acronis Agent: Missing Authorization
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Agent (Linux, macOS, Windows) before build 31477.
- 7.1 High severity
Acronis Cyber Protect Cloud Agent: Missing Authorization
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Cloud Agent (Linux, macOS, Windows) before build 31637, Acronis Cyber Protect 16 (Linux, Windows) before build 37391.