CWE-862
CVEs classified under CWE-862, newest first.
3503 CVEsRSS
CVE-2026-96855Medium· 5.5Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
Improper access control in Windows Modern Device Management (MDM) allows an authorized attacker to perform tampering locally.
CVE-2026-96316Medium· 5.5Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to perform tampering locally.
Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to perform tampering locally.
CVE-2026-96315Medium· 5.5Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally.
Missing authorization in Windows Overlay Filter allows an authorized attacker to perform tampering locally.
CVE-2026-96311Medium· 5.5Improper authorization in Windows Network List Service allows an authorized attacker to perform tampering locally.
Improper authorization in Windows Network List Service allows an authorized attacker to perform tampering locally.
CVE-2026-88198High· 8.8Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-88135High· 7.8Improper access control in WebDAV allows an authorized attacker to elevate privileges locally.
Improper access control in WebDAV allows an authorized attacker to elevate privileges locally.
CVE-2026-87714Medium· 6.5Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a network.
Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a network.
CVE-2026-85938Medium· 5.5Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.
Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally.
CVE-2026-83658Medium· 5.5Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally.
Improper access control in Windows Error Reporting allows an authorized attacker to disclose information locally.
CVE-2026-83583High· 7.8Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Geotag Broker allows an authorized attacker to elevate privileges locally.
CVE-2026-83568High· 7.8Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
Improper access control in Windows Kernel-Mode Drivers allows an authorized attacker to elevate privileges locally.
CVE-2026-70235Medium· 5.5Improper authentication in Windows Event Tracing allows an authorized attacker to perform spoofing locally.
Improper authentication in Windows Event Tracing allows an authorized attacker to perform spoofing locally.
CVE-2026-70085Medium· 5.5Missing authorization in DNS Server allows an authorized attacker to perform tampering locally.
Missing authorization in DNS Server allows an authorized attacker to perform tampering locally.
CVE-2026-69945High· 8.8Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.
Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.
CVE-2026-69905Medium· 5.5Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform tampering locally.
Missing authorization in Windows AppX Deployment Service allows an authorized attacker to perform tampering locally.
CVE-2026-110230Medium· 5.4XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/{id}/vanity route
XBackBone through 3.8.2 contains a missing authorization vulnerability that allows authenticated users to change other users' upload share codes via the POST /upload/{id}/vanity route. Attackers can supply sequential upload ids to MediaC…
CVE-2026-110229Medium· 5.4QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels
QloApps through 1.7.0 contains an improper access control vulnerability in AdminSlipController that allows hotel-restricted back-office employees to access credit slips of all hotels. Attackers can list, export as PDF, mark as redeemed, …
CVE-2026-110218Low· 3.7Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page
Aureus ERP through 1.6.0 contains an authorization bypass vulnerability that allows unauthenticated attackers to read unpublished draft blog posts via the customer-facing post view page. Attackers who know or guess a post slug can retrie…
CVE-2026-110216High· 7.1youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows any authenticated user to enable or disable accounts because the updateUserStatus handler lacks a @PreAuthorize check. Attackers can send PATCH request…
CVE-2026-110215High· 8.8PoCyoulai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus
youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUE…
CVE-2026-110211High· 8.1iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}
iFlytek SkillHub through 0.2.22 contains a missing authorization vulnerability that allows any authenticated user to permanently delete other users' skills via DELETE /api/cli/v1/skills/{namespace}/{slug}. Attackers can locate targets th…
CVE-2026-110210Medium· 5.3PoCPhase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query
Phase Console through 2.77.3 contains a missing authorization vulnerability that allows organisation members without Secrets read permission to read secret history via the secretHistory GraphQL query. Attackers holding an environment key…
CVE-2026-110209Medium· 6.5PoCStonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints
Stonewuu ai-fusion-video through 1.2.0 contains a missing authorization vulnerability that allows authenticated non-admin users to read stored secrets through unprotected ApiConfigController and SystemConfigController endpoints. Attacker…
CVE-2026-110208High· 7.1Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key
Wukong AICRM through 20260610 contains a missing authorization vulnerability in the /systemConfig controller that allows any authenticated user to read the stored AI provider API key. Attackers can request GET /systemConfig/byType/ai for…
CVE-2026-110207High· 8.8PoCWukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists
Wukong AICRM through 20260610 contains a missing authorization vulnerability that allows any authenticated user to call user, role, department and agent administration APIs because no administrator check exists. Attackers can send POST r…
CVE-2026-103560Medium· 5.5Improper authorization in DNS Server allows an authorized attacker to perform tampering locally.
Improper authorization in DNS Server allows an authorized attacker to perform tampering locally.
CVE-2026-102861High· 8.8Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
Missing authorization in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
CVE-2026-102233High· 7.8Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
Missing authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-100217High· 7.8Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.
Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.
CVE-2026-106176Low· 3.8A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests
A missing authorization vulnerability in Fortinet FortiSIEM 7.5.0 may allow attacker to execute unauthorized code or commands via Specially crafted HTTP requests