Home/CWE/Missing Authorization
Weakness

Missing Authorization

CWE-862 · Class · Incomplete

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

△

Weakness Relationships

Where this weakness sits in the CWE hierarchy. Walk up to broader classes or down to more specific variants.
Parent of this (broader)
ChildOfCWE-284 · Improper Access Control
ChildOfCWE-285 · Improper Authorization
Children (more specific)
ParentOfCWE-1314 · Missing Write Protection for Parametric Data Values
ParentOfCWE-425 · Direct Request ('Forced Browsing')
ParentOfCWE-638 · Not Using Complete Mediation
ParentOfCWE-939 · Improper Authorization in Handler for Custom URL Scheme
◆

Attack Patterns (CAPEC)

1
How adversaries exploit this weakness, per MITRE CAPEC.
CAPEC-665Exploitation of Thunderbolt Protection Flaws
⚠

CVEs With This Weakness

8,793
A sample of the 8,793 CVEs tagged with this weakness.
CVECVE-2026-8681
CVECVE-2026-8547
CVECVE-2026-8407
CVECVE-2026-8194
CVECVE-2026-8144
CVECVE-2026-8077
CVECVE-2026-7563
CVECVE-2026-7525
CVECVE-2026-7108
CVECVE-2026-7051
CVECVE-2026-7050
CVECVE-2026-6963
◉

Nuclei Scanner Templates

30
Open-source Nuclei templates that detect this weakness class - an actionable scan-for-it pivot. Licensed under the ProjectDiscovery / Nuclei terms.
criticalHyperComments <= 1.2.2 - Arbitrary Options Update
criticalOrder Delivery Date Pro for WooCommerce < 12.3.1 - Arbitrary Option Update
criticalPost SMTP <= 3.6.0 - Email Log Disclosure
criticalRecover WooCommerce Cart Abandonment, Newsletter, Email Marketing, Marketing Automation By FunnelKit - Broken Access Control
criticalJEHC-BPM - Remote Code Execute
criticalMember Hero <=1.0.9 - Remote Code Execution
criticalOmnia MPX 1.5.0+r1 - Local File Inclusion
criticalApache ShenYu Admin Unauth Access
criticalpgAdmin < 6.17 - Unauthenticated Remote Code Execution
criticalListingPro < 2.6.1 - Arbitrary Plugin Installation/Activation/Deactivation
criticalRank Math SEO <= 1.0.40.2 - Privilege Escalation via Unprotected REST API Endpoint
criticalWordPress InfiniteWP <1.9.4.5 - Authorization Bypass
criticalMaian Cart <=3.8 - Remote Code Execution
criticalWordPress Automatic Plugin - Unauthenticated Options Change
criticalControl Web Panel (CWP) - File Inclusion
criticalLucee Admin - Remote Code Execution
criticalWordPress POST SMTP Mailer <= 2.8.7 - Authorization Bypass
criticalZoneMinder Snapshots - Command Injection
criticalContact Form Plugin by Fluent Forms < 5.1.17 - Unauthenticated Limited Privilege Escalation
criticalHunk Companion <= 1.8.4 - Arbitrary Plugin Installation
criticalYARPP <= 5.30.10 - Missing Authorization
criticalGutenKit <= 2.1.0 - Arbitrary File Upload
criticalWordPress InstaWP Connect <= 0.1.0.38 - Unauthenticated User Creation
criticalEasy WP SMTP <= 1.3.9 - Missing Authorization to Arbitrary Options Update
criticalDell EMC Avamar and Integrated Data Protection Appliance Installation Manager - Invalid Access Control
highLottieFiles WordPress Plugin <= 3.0.0 - Missing Authorization
highDELMIA Apriso - Broken Access Control
highUncanny Automator <= 6.3.0.2 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation
highIP2Location Country Blocker < 2.38.9 - Unauthenticated Information Disclosure
highElementor Website Builder - Remote Code Execution
External lookups - second-class, for what we don’t hold ourselves
MITRE CWE
Vulnerabilities
CISA KEV catalog
CWE weaknesses
CAPEC attack patterns
Package vulnerabilities
Threat intelligence
Threat actors
Tools & malware
ATT&CK techniques
IOCs
Detection & defense
Sigma rules
YARA rules
Atomic Red Team tests
D3FEND countermeasures
Compliance
NIST 800-53
ISO 27001:2022
SOC 2 TSC
PCI-DSS v4.0
CIS Controls v8.1
About
All capabilities
Live statistics
Data sources
Privacy policy
Terms of service
threatengine.sh  ·  Open-source threat intelligence platform  ·  100+ authoritative sources  ·  Every fact traces to its origin