CWE-862 Missing Authorization
classThe product does not perform an authorization check when an actor attempts to access a resource or perform an action.
01
parent weaknesses
Broader classes this is a kind of.
02
child weaknesses
More specific entries beneath this one.
03
vulnerabilities (11437)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-84869US | —OT critical | KEV | ||
A condition in the ScreenConnect client may allow files to be transferred and executed through an active remote session without authorization or Host confirmation in certain circum… | ||||
| CVE-2026-63219US | —OT critical | — | ||
GeoNetwork is a catalog application to manage spatially referenced resources. Prior to versions 4.4.12 and 4.2.17, the API endpoint for creating a new formatter via file upload is… | ||||
| CVE-2026-41679US | —OT critical | Exploit | ||
Paperclip is a Node.js server and React UI that orchestrates a team of AI agents to run a business. Prior to version 2026.416.0, an unauthenticated attacker can achieve full remote… | ||||
| CVE-2025-40602US | —OT critical | KEV | ||
A local privilege escalation vulnerability due to insufficient authorization in the SonicWall SMA1000 appliance management console (AMC). | ||||
| CVE-2025-20362US | high8.6OT critical | KEV | ||
Update: On November 5, 2025, Cisco became aware of a new attack variant against devices running Cisco Secure ASA Software or Cisco Secure FTD Software releases that are affected by… | ||||
| CVE-2025-6205US | —OT critical | KEV | ||
A missing authorization vulnerability affecting DELMIA Apriso from Release 2020 through Release 2025 could allow an attacker to gain privileged access to the application. | ||||
| CVE-2023-52163US | —OT critical | KEV | ||
Digiever DS-2105 Pro 3.1.0.71-11 devices allow time_tzsetup.cgi Command Injection. NOTE: This vulnerability only affects products that are no longer supported by the maintainer. | ||||
| CVE-2024-57726US | critical9.9OT critical | KEV | ||
SimpleHelp remote support software v5.5.7 and before has a vulnerability that allows low-privileges technicians to create API keys with excessive permissions. These API keys can be… | ||||
| CVE-2022-0492US | high7.8OT critical | KEV | ||
A vulnerability was found in the Linux kernel’s cgroup_release_agent_write in the kernel/cgroup/cgroup-v1.c function. This flaw, under certain circumstances, allows the use of the… | ||||
| CVE-2022-0543US | critical10.0OT critical | KEV | ||
It was discovered, that redis, a persistent key-value database, due to a packaging issue, is prone to a (Debian-specific) Lua sandbox escape, which could result in remote code exec… | ||||
| CVE-2022-20701US | high7.8OT critical | KEV | ||
Multiple vulnerabilities in Cisco Small Business RV160, RV260, RV340, and RV345 Series Routers could allow an attacker to do any of the following: Execute arbitrary code Elevate pr… | ||||
| CVE-2021-37976US | medium6.5OT critical | KEV | ||
Inappropriate implementation in Memory in Google Chrome prior to 94.0.4606.71 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafte… | ||||
| CVE-2021-39226US | high7.3OT critical | KEV | ||
Grafana is an open source data visualization platform. In affected versions unauthenticated and authenticated users are able to view the snapshot with the lowest database key by ac… | ||||
| CVE-2021-30713US | high7.8OT critical | KEV | ||
A permissions issue was addressed with improved validation. This issue is fixed in macOS Big Sur 11.4. A malicious application may be able to bypass Privacy preferences. Apple is a… | ||||
| CVE-2021-30657US | medium5.5OT critical | KEV | ||
A logic issue was addressed with improved state management. This issue is fixed in macOS Big Sur 11.3, Security Update 2021-002 Catalina. A malicious application may bypass Gatekee… | ||||
| CVE-2021-26085US | medium5.3OT critical | KEV | ||
Affected versions of Atlassian Confluence Server allow remote attackers to view restricted resources via a Pre-Authorization Arbitrary File Read vulnerability in the /s/ endpoint.… | ||||
| CVE-2020-8196US | medium4.3OT critical | KEV | ||
Improper access control in Citrix ADC and Citrix Gateway versions before 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 and Citrix SDWAN WAN-OP versions before 11.1.… | ||||
| CVE-2021-21978US | critical9.8OT critical | Exploit | ||
VMware View Planner 4.x prior to 4.6 Security Patch 1 contains a remote code execution vulnerability. Improper input validation and lack of authorization leading to arbitrary file… | ||||
| CVE-2023-6875US | critical9.8OT critical | Exploit | ||
The POST SMTP Mailer – Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress is vulnerable to unauthorized access of data and modification… | ||||
| CVE-2021-21307US | critical9.8OT critical | Exploit | ||
Lucee Server is a dynamic, Java based (JSR-223), tag and scripting language used for rapid web application development. In Lucee Admin before versions 5.3.7.47, 5.3.6.68 or 5.3.5.9… | ||||
04
attack patterns (1)
CAPEC attack patterns that exploit this.
05
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan