CWE-862

Private Repository Metadata Remains Accessible After Access Revocation

Cross-repository IDOR in issue-dependency removal lets an attacker tamper with and comment on private repos they cannot

The Extra Product Options Builder for WooCommerce WordPress plugin before 1.2.176 does not verify that the requester is

The WP Travel Engine – Tour Booking Plugin – Tour Operator Software plugin for WordPress is vulnerable to authorization

Missing Authorization vulnerability in Dolusoft Software Technologies Fortilogger allows Accessing Functionality Not Pro

Missing Authorization vulnerability in Dolusoft Software Technologies Sonlogger allows Accessing Functionality Not Prope

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (incl

Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.

Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.

Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.

Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.

Unauthenticated Broken Access Control in Outranking Plugin Options <= 1.1.3 versions.

Unauthenticated Broken Access Control in Stitch Express <= 1.9.0 versions.

Unauthenticated Broken Access Control in Koji <= 2.2.1 versions.

Unauthenticated Broken Access Control in Chaplin <= 2.6.8 versions.

Missing Authorization, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache CloudStack's U

Reconmap's API applies a fallback authorization policy in apps/api/app/Program.cs that requires an authenticated user ho

Unauthenticated Broken Access Control in Notification Master &#8211; Real-Time WordPress Notifications With Email, SMS,

GROWI applies its page-viewer permission check to attachment requests only when the request carries an authenticated use

The Project Manager WordPress plugin before 4.0.7 does not have any authorisation check on its import routes, allowing

The StoreGrowth WordPress plugin before 2.1.2 does not validate a browser-supplied product price on two of its unauthen

Subscriber Sensitive Data Exposure in SureFeedback Client Site <= 1.2.12 versions.

Baserow dispatches an Application Builder data source without acting on the result of its permission check. The dispatch

Certain configuration endpoints may lack proper server-side authorization checks, allowing unauthorized users to access

Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.

Typebot is an open-source chatbot builder. In versions prior to 3.13.2, client-side script execution in Typebot allows s

Insufficient authentication security controls in the browser-based authentication components in Amazon Athena ODBC drive

Grav before 2.0.4 contains a two-factor authentication bypass vulnerability in the login plugin where the regenerate2FAS

Missing authorization in CustomTabs in Google Chrome on on Android prior to 152.0.7977.65 allowed a local attacker to po

Missing Authorization vulnerability in e-plugins Lawyer Directory lawyer-directory allows Exploiting Incorrectly Configu

Missing Authorization vulnerability in e-plugins Institutions Directory institutions-directory allows Exploiting Incorre

Missing Authorization vulnerability in e-plugins Hotel Listing hotel-listing allows Exploiting Incorrectly Configured Ac

Missing Authorization vulnerability in e-plugins Hospital Doctor Directory hospital-doctor-directory allows Exploiting I

Missing Authorization vulnerability in e-plugins Final User final-user allows Exploiting Incorrectly Configured Access C

Missing Authorization vulnerability in e-plugins fitness-trainer fitness-trainer allows Exploiting Incorrectly Configure

Missing Authorization vulnerability in e-plugins Listihub listihub allows Exploiting Incorrectly Configured Access Contr

Missing Authorization vulnerability in e-plugins ListingHub listinghub allows Exploiting Incorrectly Configured Access C

Missing Authorization vulnerability in e-plugins Real Estate Pro real-estate-pro allows Exploiting Incorrectly Configure

Missing Authorization vulnerability in e-plugins WP Membership wp-membership allows Exploiting Incorrectly Configured Ac

The New User Approve plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a

Missing Authorization vulnerability in soporteblue Plugin BlueX for WooCommerce bluex-for-woocommerce allows Exploiting

Missing Authorization vulnerability in LottieFiles LottieFiles lottiefiles allows Exploiting Incorrectly Configured Acce

In relayoutWindow of WindowManagerService.java, there is a possible tapjack attack due to a missing permission check. Th

Missing Authorization vulnerability in e-plugins Directory Pro directory-pro allows Exploiting Incorrectly Configured Ac

Missing Authorization vulnerability in Aarsiv Groups Automated FedEx live/manual rates with shipping labels a2z-fedex-sh

Missing Authorization vulnerability in Brainstorm Force SureForms Pro allows Exploiting Incorrectly Configured Access Co

A vulnerability was identified in NousResearch hermes-agent up to 2026.4.16. This affects the function check_all_command