Missing Authorization
CWE-862
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
We track 2,825 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 13 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- Architecture and Design: Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using authorization frameworks such as the JAAS Authorization Framework and the OWASP ESAPI Access Control feature.
- Architecture and Design: For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page. One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
- System Configuration Installation: Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a default deny policy when defining these ACLs.
Latest Missing Authorization vulnerabilities
- 7.1 High severity
Jenkins Orka by MacStadium Plugin: Missing Authorization
A missing permission check in Jenkins Orka by MacStadium Plugin 1.33 and earlier allows attackers with Overall/Read permission to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing credentia
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- 9.8 Critical severity
MStore API: Missing Authorization
The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features.
- 7.5 High severity
VMware SD-WAN (Edge): Missing Authorization
VMware SD-WAN (Edge) contains a bypass authentication vulnerability. An unauthenticated attacker can download the Diagnostic bundle of the application under VMware SD-WAN Management.
- 7.5 High severity
Lgdetailedorder: Missing Authorization
In the module "Detailed Order" (lgdetailedorder) in version up to 1.1.20 from Linea Grafica for PrestaShop, a guest can download personal informations without restriction formatted in json.
- 8.8 High severity
metersphere: Missing Authorization
Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks. This allows ordinary users to execute APIs that can only be executed by space administrators or project administrat
- 7.5 High severity
glpi: Missing Authorization
GLPI is a free asset and IT management software package. Starting in version 9.5.0 and prior to version 10.0.8, an incorrect rights check on a file allows an unauthenticated user to be able to access dashboards data. Version 10.0.8 contains a patch for this is
- 7.8 High severity
miniserver_go_gen_2: Missing Authorization
Loxone Miniserver Go Gen.2 through 14.0.3.28 allows an authenticated operating system user to escalate privileges via the Sudo configuration. This allows the elevated execution of binaries without a password requirement.
- 7.8 High severity
MT6580, MT6735, MT6737, MT6739, MT6753…: Missing Authorization
In vow, there is a possible escalation of privilege due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07611449; Iss
- 8.1 High severity
sealos: Missing Authorization
Sealos is a Cloud Operating System designed for managing cloud-native applications. In version 4.2.0 and prior, there is a permission flaw in the Sealos billing system, which allows users to control the recharge resource account `sealos[.] io/v1/Payment`, resu
- 7.5 High severity
Node: Missing Authorization
A privilege escalation vulnerability exists in Node.js 20 that allowed loading arbitrary OpenSSL engines when the experimental permission model is enabled, which can bypass and/or disable the permission model. The attack complexity is high. However, the crypto
- 7.5 High severity
sg_2404_mr: Missing Authorization
An authentication bypass in Intelbras Switch SG 2404 MR in firmware 1.00.54 allows an unauthenticated attacker to download the backup file of the device, exposing critical information about the device configuration.
- 7.8 High severity
Android: Missing Authorization
In multiple functions of WifiNetworkFactory.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product:
- 7.8 High severity
Android: Missing Authorization
In registerGsmaServiceIntentReceiver of ShannonRcsService.java, there is a possible way to activate/deactivate RCS service due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User
- 8.1 High severity
dataease: Missing Authorization
DataEase is an open source data visualization analysis tool to analyze data and gain insight into business trends. In affected versions Unauthorized users can delete an application erroneously. This vulnerability has been fixed in version 1.18.8. Users are adv
- 7.8 High severity
Android: Missing Authorization
In multiple functions of multiple files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction for tracing due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges neede
- 7.8 High severity
Android: Missing Authorization
In various functions of various files, there is a possible way to bypass the DISALLOW_DEBUGGING_FEATURES restriction for tracing due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed.
- 9.1 Critical severity
Quiz and Survey Master (QSM) – Easy Quiz and…: Missing Authorization
The Quiz And Survey Master for WordPress is vulnerable to authorization bypass due to a missing capability check on the function associated with the qsm_remove_file_fd_question AJAX action in versions up to, and including, 8.0.8. This makes it possible for una
- 8.8 High severity
Elementor Website Builder Pro: Missing Authorization
The Elementor Pro plugin for WordPress is vulnerable to unauthorized data modification due to a missing capability check on the update_page_option function in versions up to, and including, 3.11.6. This makes it possible for authenticated attackers with subscr
- 8.8 High severity
The Events Calendar Events Notification Bar…: Missing Authorization
Several WordPress plugins developed by Cool Plugins are vulnerable to arbitrary plugin installation and activation that can lead to remote code execution by authenticated attackers with minimal permissions, such as a subscriber.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In Connectivity Service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In dialer service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In telephony service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- 8.8 High severity
CONPROSYS HMI System (CHS): Missing Authorization
Improper access control vulnerability exists in CONPROSYS HMI System (CHS) versions prior to 3.5.3. A user of the PC where the affected product is installed may gain an administrative privilege. As a result, information regarding the product may be obtained an
- 8.8 High severity
Custom Login Page | Temporary Users | Rebrand…: Missing Authorization
The Feather Login Page plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'getListOfUsers' function in versions starting from 1.0.7 up to, and including, 1.1.1. This makes it possible for authenticated at
- 7.8 High severity
M-Files Client: Missing Authorization
Missing access permissions checks in M-Files Client before 23.5.12598.0 (excluding 23.2 SR2 and newer) allows elevation of privilege via UI extension applications
- 7.4 High severity
Briar: Missing Authorization
The Introduction Client in Briar through 1.5.3 does not implement out-of-band verification for the public keys of introducees. An introducer can launch man-in-the-middle attacks against later private communication between two introduced parties.
- 7.5 High severity
Portal: Missing Authorization
The Dynamic Data Mapping module in Liferay Portal 7.4.3.67, and Liferay DXP 7.4 update 67 does not limit Document and Media files which can be downloaded from a Form, which allows remote attackers to download any file from Document and Media via a crafted URL.
- 8.8 High severity
Go Pricing - WordPress Responsive Pricing Tables: Missing Authorization
The Go Pricing - WordPress Responsive Pricing Tables plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'process_postdata' function in versions up to, and including, 3.3.19. This makes it possible f
- 7.8 High severity
Nevado Jms: Missing Authorization
Skyscreamer Open Source Nevado JMS v1.3.2 does not perform security checks when receiving messages. This allows attackers to execute arbitrary commands via supplying crafted data.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In powerEx service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
.In srtd service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In audio service, there is a possible missing permission check. This could lead to local escalation of privilege with no additional execution privileges.