Missing Authorization
CWE-862
The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
We track 2,825 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.3. 13 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries. Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
- Architecture and Design: Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
- Architecture and Design: Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid. For example, consider using authorization frameworks such as the JAAS Authorization Framework and the OWASP ESAPI Access Control feature.
- Architecture and Design: For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page. One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
- System Configuration Installation: Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a default deny policy when defining these ACLs.
Latest Missing Authorization vulnerabilities
- 7.8 High severity
Android: Missing Authorization
In onCallRedirectionComplete of CallsManager.java, there is a possible permissions bypass due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploit
- 7.8 High severity
Android: Missing Authorization
In restorePermissionState of PermissionManagerServiceImpl.java, there is a possible way to bypass user consent due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction
- 8.8 High severity
WARP: Missing Authorization
Using warp-cli command "add-trusted-ssid", a user was able to disconnect WARP client and bypass the "Lock WARP switch" feature resulting in Zero Trust policies not being enforced on an affected endpoint.
- 8.5 High severity
WARP: Authentication Bypass by Spoofing
It was possible for a user to delete a VPN profile from WARP mobile client on iOS platform despite the Lock WARP switch https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch feature being enabled on Z
- 7.5 High severity
WARP: Improper Verification of Cryptographic Signature
Lock Warp switch is a feature of Zero Trust platform which, when enabled, prevents users of enrolled devices from disabling WARP client. Due to insufficient policy verification by WARP iOS client, this feature could be bypassed by using the "Disable WARP" quic
- 8.2 High severity
WARP: Missing Authorization
It was possible to bypass Lock WARP switch feature https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/warp-settings/#lock-warp-switch on the WARP iOS mobile client by enabling both "Disable for cellular networks" and "Disable for
- 9.8 Critical severity
WARP: Missing Authorization
It was possible to bypass policies configured for Zero Trust Secure Web Gateway by using warp-cli 'set-custom-endpoint' subcommand. Using this command with an unreachable endpoint caused the WARP Client to disconnect and allowed bypassing administrative restri
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In Music service, there is a missing permission check. This could lead to elevation of privilege in Music service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In Soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in Soundrecorder service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In messaging service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In soundrecorder service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In music service, there is a missing permission check. This could lead to elevation of privilege in contacts service with no additional execution privileges needed.
- 7.8 High severity
OpenHarmony: Missing Authorization
OpenHarmony-v3.1.2 and prior versions have a Missing permission validation vulnerability in param service of startup subsystem. An malicious application installed on the device could elevate its privileges to the root user, disable security features, or cause
- 8.8 High severity
Airframe Bmc Web Gui R18 Firmware: Missing Authorization
Multiple Improper Access Control was discovered in Nokia AirFrame BMC Web GUI < R18 Firmware v4.13.00. It does not properly validate requests for access to (or editing of) data and functionality in all endpoints under /#settings/* and /api/settings/*. By not v
- 7.8 High severity
Android: Missing Authorization
There is an missing authorization issue in the system service. Since the component does not have permission check , resulting in Local Elevation of privilege.Product: AndroidVersions: Android SoCAndroid ID: A-242244028
- 7.8 High severity
Android: Missing Authorization
There is an missing authorization issue in the system service. Since the component does not have permission check , resulting in Local Elevation of privilege.Product: AndroidVersions: Android SoCAndroid ID: A-242221901
- 7.8 High severity
Android: Missing Authorization
There is an missing authorization issue in the system service. Since the component does not have permission check and permission protection,, resulting in Local Elevation of privilege.Product: AndroidVersions: Android SoCAndroid ID: A-242221899
- 7.8 High severity
Android: Missing Authorization
There is an missing authorization issue in the system service. Since the component does not have permission check , resulting in Local Elevation of privilege.Product: AndroidVersions: Android SoCAndroid ID: A-242221238
- 7.8 High severity
Android: Missing Authorization
There is an missing authorization issue in the system service. Since the component does not have permission check , resulting in Local Elevation of privilege.Product: AndroidVersions: Android SoCAndroid ID: A-242221233
- 8.8 High severity
RUGGEDCOM RM1224 LTE(4G) EU: Missing Authorization
Affected devices do not properly authorize the change password function of the web interface. This could allow low privileged users to escalate their privileges.
- 7.5 High severity
zoneminder: Missing Authorization
ZoneMinder is a free, open source Closed-circuit television software application. In affected versions the ZoneMinder API Exposes Database Log contents to user without privileges, allows insertion, modification, deletion of logs without System Privileges. User
- 7.5 High severity
Ldap WP Login / Active Directory Integration: Cross-Site Request Forgery
The Ldap WP Login / Active Directory Integration WordPress plugin before 3.0.2 does not have any authorisation and CSRF checks when updating it's settings (which are hooked to the init action), allowing unauthenticated attackers to update them. Attackers could
- 9.8 Critical severity
Jenkins DotCi Plugin: Missing Authorization
A missing permission check in Jenkins DotCi Plugin 2.40.00 and earlier allows unauthenticated attackers to trigger builds of jobs corresponding to the attacker-specified repository for attacker-specified commits.
- 8.8 High severity
Jenkins Rundeck Plugin: Missing Authorization
Jenkins Rundeck Plugin 3.6.11 and earlier does not protect access to the /plugin/rundeck/webhook/ endpoint, allowing users with Overall/Read permission to trigger jobs that are configured to be triggerable via Rundeck.
- 8.8 High severity
Jenkins NS-ND Integration Performance…: Missing Authorization
A missing permission check in Jenkins NS-ND Integration Performance Publisher Plugin 4.8.0.129 and earlier allows attackers with Overall/Read permissions to connect to an attacker-specified webserver using attacker-specified credentials.
- 7.8 High severity
SC9863A/SC9832E/SC7731E/T610/T310/T606/T760/T61…: Missing Authorization
In network service, there is a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed
- 7.5 High severity
xwiki-platform: Missing Authorization
XWiki Platform Web Templates are templates for XWiki Platform, a generic wiki platform. Through the suggestion feature, string and list properties of objects the user shouldn't have access to can be accessed in versions prior to 13.10.4 and 14.2. This includes
- 7.5 High severity
Apache IoTDB: Missing Authorization
Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database. Users should upgrade to version 0.13.1 which addresses this issue.
- 9.8 Critical severity
Omnia Mpx Node Firmware: Missing Authorization
A local file disclosure vulnerability in /appConfig/userDB.json of Telos Alliance Omnia MPX Node through 1.0.0-1.4.9 allows attackers to access users credentials which makes him able to gain initial access to the control panel with high privilege because the c
- 7.5 High severity
Easy Student Results: Missing Authorization
The Easy Student Results WordPress plugin through 2.2.8 lacks authorisation in its REST API, allowing unauthenticated users to retrieve information related to the courses, exams, departments as well as student's grades and PII such as email address, physical a
- 7.8 High severity
Android: Missing Authorization
In Wifi, there is a possible way to enable Wifi without permissions due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: And
- 7.8 High severity
Android: Missing Authorization
In AppWidget, there is a possible way to start an activity from the background due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.Produ
- 7.8 High severity
Android: Missing Authorization
In Core, there is a possible way to start an activity from the background due to a missing permission check. This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: Androi
- 7.8 High severity
Android: Missing Authorization
In Keyguard, there is a missing permission check. This could lead to local escalation of privilege and prevention of screen timeout with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-13Andro
- 9.1 Critical severity
SAP Enable Now Manager: Missing Authorization
Due to insecure session management, SAP Enable Now allows an unauthenticated attacker to gain access to user's account. On successful exploitation, an attacker can view or modify user data causing limited impact on confidentiality and integrity of the applicat