CWE-862
CVEs classified under CWE-862, newest first.
3007 CVEsRSS
CVE-2026-116660Medium· 4.3Tanium addressed an improper access controls vulnerability in Enforce.
Tanium addressed an improper access controls vulnerability in Enforce.
CVE-2026-108301Medium· 6.0Tanium addressed an improper access controls vulnerability in Comply.
Tanium addressed an improper access controls vulnerability in Comply.
CVE-2026-16491Medium· 6.5CVE-2026-16491 CVE Record
Grafana’s RBAC service ignored the requested folder when checking whether a user was a folder administrator for deleted dashboard listings. A user with dashboard permission-management rights on any folder could therefore be treated as an…
CVE-2026-116677Medium· 5.3OpenWISP Controller CA CRL REST API does not scope requests to managed organizations
OpenWISP Controller is a network and WiFi controller for provisioning, configuration management, updates, and PKI management. From 1.0.0 until 1.3.2, the GET /api/v1/controller/ca/<integer-id>/crl endpoint allows an authenticated organiz…
CVE-2026-90465High· 8.7Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation
A missing authentication vulnerability in the FireCluster Sync processing allows an attacker positioned on the cluster interconnect, such as a compromised cluster peer or an on-path network attacker, to invoke privileged firewall managem…
CVE-2026-93865Critical· 9.2Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection
A missing authentication vulnerability in the Fireware OS FireCluster synchronization daemon allows a remote, unauthenticated attacker to invoke privileged system-level administrative actions by sending a specially crafted request to the…
CVE-2026-116890High· 7.3Semantic MediaWiki 3.0.0 before 7.3.0 Missing Authorization via smwtask API
Semantic MediaWiki from 3.0.0 before 7.3.0 contains a missing authorization vulnerability in the api.php smwtask module that allows unauthenticated attackers to run admin-only maintenance tasks. Attackers can use the public anonymous CSR…
CVE-2026-10752Medium· 4.8Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field
The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 0.9.2.6. This is due to the plugin not properly verifying that a user is authorized to perform an actio…
CVE-2026-116893Medium· 6.8REDAXO core before 5.21.5 Missing Authorization in rex_api_package API
REDAXO core before 5.21.5 contains a missing authorization vulnerability in the rex_api_package API function that lets non-admin backend users manage packages with only a valid CSRF token. Attackers holding a token, such as demoted admin…
CVE-2026-116897Medium· 6.5REDAXO before 5.21.4 Missing Authorization in Version and History Previews
REDAXO core before 5.21.4 contains a missing authorization vulnerability in the structure/version and structure/history frontend preview modes, which do not check category or clang permissions for the previewed article. Any backend user,…
CVE-2026-116896High· 7.5REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
REDAXO before 5.21.5 contains a missing authorization vulnerability in the backup addon export that accepts any database table, allowing non-admin users with the backup[export] permission to export rex_user, rex_user_session, and other a…
CVE-2026-116876High· 7.1Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an improper authorization vulnerability that allows ordinary editors to permanently protect pages by adding an Is edit protected annotation. When $smwgEditProtectionRight is enabled, Ed…
CVE-2026-116879Medium· 5.4Semantic MediaWiki 7.3.0 before 7.3.1 Missing Authorization via smwtask Update Task
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask update task that allows users with edit rights to force semantic updates on arbitrary pages. Attackers can supply a serialized subje…
CVE-2026-116873High· 7.3Semantic MediaWiki 7.3.0 Missing Authorization via smwtask API run-joblist and update
Semantic MediaWiki from 7.3.0 before 7.3.1 contains a missing authorization vulnerability in the smwtask API module that allows unauthenticated attackers to run queued jobs and force store updates. Attackers can use the public anonymous …
CVE-2026-85299High· 8.3Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration
A Missing Authorization vulnerability in the disks.createSnapshot and regionDisks.createSnapshot APIs in Google Compute Engine versions prior to 2026-08-31 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-pro…
CVE-2026-117469Medium· 5.4File-transfer type confusion permits unauthorized repository writes in Psono Server
Psono Server (CE & EE) versions 1.0.0 through 7.2.3 did not enforce the direction of file-transfer credentials on file-repository operations. An authenticated remote attacker with read-only access to a file could present a download trans…
CVE-2026-116623High· 7.3code-projects Simple Content Management System Admin welcome.php authorization
A vulnerability was detected in code-projects Simple Content Management System 1.0. Impacted is an unknown function of the file /web/admin/welcome.php of the component Admin Interface. The manipulation of the argument addnews results in …
CVE-2026-105765High· 7.5Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API
HashiCorp Consul and Consul Enterprise 1.17.0 up to 2.0.4 are vulnerable to an authorization bypass in the agent's service mesh leaf certificate API that may allow an attacker without a valid ACL token to retrieve a cached service leaf c…
CVE-2026-116388Medium· 5.3WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability
Missing Authorization vulnerability in TMS Amelia ameliabooking allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Amelia: from n/a through 2.4.10.
CVE-2026-115598Medium· 5.3WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.
CVE-2026-115597Medium· 5.4WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
Missing Authorization vulnerability in ThimPress LearnPress learnpress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LearnPress: from n/a through 4.4.11.
CVE-2026-112839Medium· 4.3WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability
Missing Authorization vulnerability in VillaTheme Customer Coupons for WooCommerce woo-customer-coupons allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Customer Coupons for WooCommerce: from n/a…
CVE-2026-93328Critical· 9.3Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
Path Traversal and Missing Authorization in cloud-storage source in Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) versions 1.2.0 through 1.4.0 allows an unauthenticated remote attacker to exfiltrate host files to extern…
CVE-2026-116492Medium· 6.5Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API
Frappe CRM app before 1.89.1 contains a missing authorization vulnerability that allows authenticated low-privileged users to read CRM Lead records they are not permitted to access by querying the get_contact_by_phone_number API, which p…
CVE-2026-115195Medium· 6.5A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table})
A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}). The endpoint did not enforce permissions for several internal tables: an intended administrator-only restriction was never applied, and tables wit…
CVE-2026-115718Medium· 4.3Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt
Frappe Builder versions 1.33.0 before1.36.0 contain a missing authorization vulnerability in the improve_prompt endpoint that allows any authenticated non-Guest session to invoke LLM completions without proper permission checks. Attacker…
CVE-2026-115954Medium· 5.4WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability
Missing Authorization vulnerability in Dylan Kuhn Geo Mashup geo-mashup allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Geo Mashup: from n/a through 1.13.22.
CVE-2026-115960Medium· 4.3WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4…
CVE-2026-115959Medium· 5.3WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability
Missing Authorization vulnerability in WPExperts APIExperts Square for WooCommerce woosquare allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects APIExperts Square for WooCommerce: from n/a through 4…
CVE-2026-115595Medium· 5.3WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability
Missing Authorization vulnerability in Supsystic Contact Form by Supsystic contact-form-by-supsystic allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Contact Form by Supsystic: from n/a through 1…