Missing Authorization
CWE-862
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
We track 2,825 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 13 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- Architecture and Design: Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using authorization frameworks such as the JAAS Authorization Framework and the OWASP ESAPI Access Control feature.
- Architecture and Design: For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page. One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
- System Configuration Installation: Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a default deny policy when defining these ACLs.
Latest Missing Authorization vulnerabilities
- 7.8 High severity
Android: Missing Authorization
In onActivityResult of AvatarPickerActivity.java, there is a possible way to access images belonging to other users due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interac
- 8.8 High severity
Velociraptor: Missing Authorization
Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server including writing arbitrary files. However, lower privilege users are generally forbidden from writing
- 7.5 High severity
KubePi: Missing Authorization
KubePi is a modern Kubernetes panel. The API interfaces with unauthorized entities and may leak sensitive information. This issue has been patched in version 1.6.4. There are currently no known workarounds.
- 8.8 High severity
iubenda | All-in-one Compliance for GDPR /…: Cross-Site Request Forgery
The iubenda WordPress plugin before 3.3.3 does does not have authorisation and CSRF in an AJAX action, and does not ensure that the options to be updated belong to the plugin as long as they are arrays. As a result, any authenticated users, such as subscriber
- 7.8 High severity
Android: Missing Authorization
In multiple functions of AdapterService.java, there is a possible way to manipulate Bluetooth state due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not need
- 7.8 High severity
Android: Missing Authorization
In getSlice of ProviderModelSlice.java, there is a missing permission check. This could lead to local escalation of privilege from the guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVe
- 7.8 High severity
Android: Missing Authorization
In onAttach of ConfigureWifiSettings.java, there is a possible way for a guest user to change WiFi settings due to a permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not ne
- 7.8 High severity
Android: Missing Authorization
In onCreate of WifiDialogActivity.java, there is a missing permission check. This could lead to local escalation of privilege from a guest user with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVers
- 7.8 High severity
Android: Missing Authorization
In onCreate of WifiDppConfiguratorActivity.java, there is a possible way for a guest user to add a WiFi configuration due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User inter
- 8.8 High severity
pgadmin4: Missing Authorization
The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore. The utility is executed by the server to determine what PostgreSQL version it is from. Vers
- 8.6 High severity
NetWeaver Process Integration: Missing Authorization
An unauthenticated attacker over the network can attach to an open interface exposed through JNDI by the User Defined Search (UDS) of SAP NetWeaver Process Integration (PI) - version 7.50 and make use of an open naming and directory API to access services whic
- 9.4 Critical severity
NetWeaver Process Integration: Missing Authorization
An unauthenticated user can attach to an open interface exposed through JNDI by the Messaging System of SAP NetWeaver Process Integration (PI) - version 7.50. This user can make use of an open naming and directory API to access services that could perform unau
- 8.1 High severity
DPD Baltic Shipping: Cross-Site Request Forgery
The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable.
- 8.8 High severity
Content Navigator: Missing Authorization
IBM Content Navigator 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, and 3.0.12 is vulnerable to missing authorization and could allow an authenticated user to load external plugins and execute code. IBM X-Force ID: 23880
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In windows manager service, there is a missing permission check. This could lead to set up windows manager service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In UscAIEngine service, there is a missing permission check. This could lead to set up UscAIEngine service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In power management service, there is a missing permission check. This could lead to set up power management service with no additional execution privileges needed.
- 7.5 High severity
Stackstorm: Missing Authorization
Improper access control in Key-Value RBAC in StackStorm version 3.7.0 didn't check the permissions in Jinja filters, allowing attackers to access K/V pairs of other users, potentially leading to the exposure of sensitive Information.
- 7.5 High severity
Ourphoto: Missing Authentication for Critical Functionality
The /device/acceptBind end-point for Ourphoto App version 1.4.1 does not require authentication or authorization. The user_token header is not implemented or present on this end-point. An attacker can send a request to bind their account to any users picture f
- 8.2 High severity
xwiki-platform: Missing Authorization
org.xwiki.platform:xwiki-platform-user-profile-ui is missing authorization to enable or disable users. Any user (logged in or not) with access to the page XWiki.XWikiUserProfileSheet can enable or disable any user profile. This might allow to a disabled user t
- 8.8 High severity
Ckan: Missing Authorization
CKAN through 2.9.6 account takeovers by unauthenticated users when an existing user id is sent via an HTTP POST request. This allows a user to take over an existing account including superuser accounts.
- 8.1 High severity
xwiki-platform: Missing Authorization
XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. The application allows anyone with view access to modify any page of the wiki by importing a crafted XAR package. The problem has been patched in XWiki 14.
- 9.8 Critical severity
Micollab: Missing Authorization
The web conferencing component of Mitel MiCollab through 9.6.0.13 could allow an unauthenticated attacker to upload arbitrary scripts due to improper authorization controls. A successful exploit could allow remote code execution within the context of the appli
- 7.5 High severity
Consul: Missing Authorization
HashiCorp Consul and Consul Enterprise 1.13.0 up to 1.13.3 do not filter cluster filtering's imported nodes and services for HTTP or RPC endpoints used by the UI. Fixed in 1.14.0.
- 7.5 High severity
Jenkins CloudBees Docker Hub/Registry…: Missing Authorization
A missing permission check in Jenkins CloudBees Docker Hub/Registry Notification Plugin 2.6.2 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository.
- 9.8 Critical severity
Hyperic Server: Missing Authorization
A security filter misconfiguration exists in VMware Hyperic Server 5.8.6. Exploitation of this vulnerability enables a malicious party to bypass some authentication requirements when issuing requests to Hyperic Server. NOTE: This vulnerability only affects pro
- 7.5 High severity
HarmonyOS: Missing Authorization
The LBS module has a vulnerability in geofencing API access. Successful exploitation of this vulnerability may cause third-party apps to access the geofencing APIs without authorization, affecting user confidentiality.