Missing Authorization
CWE-862
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
We track 2,825 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 13 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- Architecture and Design: Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using authorization frameworks such as the JAAS Authorization Framework and the OWASP ESAPI Access Control feature.
- Architecture and Design: For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page. One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
- System Configuration Installation: Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a default deny policy when defining these ACLs.
Latest Missing Authorization vulnerabilities
- 9.1 Critical severity
Acronis Cyber Protect Home Office: Missing Authorization
Sensitive information disclosure and manipulation due to missing authorization. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40713, Acronis True Image OEM (Windows) before build 42575.
- 9.1 Critical severity
jumpserver: Missing Authorization
JumpServer is an open source bastion host. As an unauthenticated user, it is possible to authenticate to the core API with a username and an SSH public key without needing a password or the corresponding SSH private key. An SSH public key should be considered
- 9.8 Critical severity
Cisco SD-WAN vManage: Improper Authentication
A vulnerability in the Security Assertion Markup Language (SAML) APIs of Cisco Catalyst SD-WAN Manager Software could allow an unauthenticated, remote attacker to gain unauthorized access to the application as an arbitrary user. This vulnerability is due to im
- 7.5 High severity
apicast: Missing Authorization
A flaw was found in APICast, when 3Scale's OIDC module does not properly evaluate the response to a mismatched token from a separate realm. This could allow a separate realm to be accessible to an attacker, permitting access to unauthorized information.
- 8.8 High severity
Docker Desktop: Missing Authorization
Docker Desktop before 4.23.0 allows an unprivileged user to bypass Enhanced Container Isolation (ECI) restrictions via the debug shell which remains accessible for a short time window after launching Docker Desktop. The affected functionality is available for
- 9.8 Critical severity
er5120g: Missing Authorization
There is an unauthorized access vulnerability in TP-LINK ER5120G 4.0 2.0.0 Build 210817 Rel.80868n, which allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to the device backend man
- 9.8 Critical severity
360rac1200: Missing Authorization
There is an unauthorized access vulnerability in Netis 360RAC1200 v1.3.4517, which allows attackers to obtain sensitive information of the device without authentication, obtain user tokens, and ultimately log in to the device backend management.
- 9.8 Critical severity
RHODS-1.22-RHEL-8: Missing Authorization
A flaw was found in the Kubernetes service for notebooks in RHODS, where it does not prevent pods from other namespaces and applications from making requests to the Jupyter API. This flaw can lead to file content exposure and other issues.
- 7.8 High severity
Android: Missing Authorization
In multiple files, there is a possible way to import a contact from another user due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation
- 8.8 High severity
Jenkins Assembla Auth Plugin: Missing Authorization
Jenkins Assembla Auth Plugin 1.14 and earlier does not verify that the permissions it grants are enabled, resulting in users with EDIT permissions to be granted Overall/Manage and Overall/SystemRead permissions, even if those permissions are disabled and shoul
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.8 High severity
SC7731E/SC9832E/SC9863A/T606/T612/T616/T610/T618: Missing Authorization
In vowifiservice, there is a possible missing permission check.This could lead to local escalation of privilege with no additional execution privileges
- 7.5 High severity
T760/T770/T820/S8000: Missing Authorization
In LTE protocol stack, there is a possible missing permission check. This could lead to remote information disclosure no additional execution privileges needed
- 8.1 High severity
CLA Assistant: Missing Authorization
A missing authorization check allows an arbitrary authenticated user to perform certain operations through the API of CLA-assistant by executing specific additional steps. This allows an arbitrary authenticated user to read CLA information including informatio
- 9.8 Critical severity
1Panel: Missing Authorization
1Panel is an open source Linux server operation and maintenance management panel. In version 1.4.3, an arbitrary file write vulnerability could lead to direct control of the server. In the `api/v1/file.go` file, there is a function called `SaveContentthat,It `
- 8.2 High severity
WP 6070-WVPS: Missing Authorization
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 an unauthenticated remote attacker can access upload-functions of the HTTP API. This might cause certificate errors for SSL-connections and might result in a partial denial-of-service.
- 7.5 High severity
WP 6070-WVPS: Missing Authorization
In PHOENIX CONTACTs WP 6xxx series web panels in versions prior to 4.0.10 a remote unauthenticated attacker can obtain the r/w community string of the SNMPv2 daemon.
- 7.5 High severity
metersphere: Missing Authorization
MeterSphere is an open-source continuous testing platform. Prior to version 2.10.4 LTS, some interfaces of the Cloud version of MeterSphere do not have configuration permissions, and are sensitively leaked by attackers. Version 2.10.4 LTS contains a patch for
- 8.1 High severity
tolgee-platform: Missing Authorization
Tolgee is an open-source localization platform. Starting in version 3.14.0 and prior to version 3.23.1, when a request is made using an API key, the backend fails to verify the permission scopes associated with the key, effectively bypassing permission checks
- 9.8 Critical severity
InstaWP Connect – 1-click WP Staging & Migration: Missing Authorization
The InstaWP Connect plugin for WordPress is vulnerable to unauthorized access of data, modification of data and loss of data due to a missing capability check on the 'events_receiver' function in versions up to, and including, 0.0.9.18. This makes it possible
- 7.5 High severity
Jenkins plug-in for ServiceNow DevOps: Missing Authorization
A missing authorization vulnerability exists in versions of the Jenkins Plug-in for ServiceNow DevOps prior to 1.38.1 that, if exploited successfully, could cause the unwanted exposure of sensitive information. To address this issue, apply the 1.38.1 version o
- 9.8 Critical severity
HP LaserJet Pro: Missing Authorization
Certain HP LaserJet Pro print products are potentially vulnerable to an Elevation of Privilege and/or Information Disclosure related to a lack of authentication with certain endpoints.
- 8.8 High severity
Hazelcast: Missing Authorization
In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.
- 8.8 High severity
ProfileGrid – User Profiles, Groups and…: Missing Authorization
The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'edit_group' handler in versions up to, and including, 5.5.2. This makes it possible for authenticated attackers, with group owners
- 8.8 High severity
ProfileGrid – User Profiles, Groups and…: Missing Authorization
The ProfileGrid plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'profile_magic_check_smtp_connection' function in versions up to, and including, 5.5.1. This makes it possible for authenticated at
- 7.8 High severity
Android: Missing Authorization
In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profile due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User in
- 7.8 High severity
Android: Missing Authorization
In getAvailabilityStatus of WifiScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileg
- 7.8 High severity
Android: Missing Authorization
In getAvailabilityStatus of BluetoothScanningMainSwitchPreferenceController.java, there is a possible way to bypass a device policy restriction due to a missing permission check. This could lead to local escalation of privilege with no additional execution pri
- 7.1 High severity
Jenkins ElasticBox CI Plugin: Missing Authorization
A missing permission check in Jenkins ElasticBox CI Plugin 5.0.1 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentials s