🎯 Missing Authorization

The items that name it 11

• Drupal warns of critical Commerce Core flaw exploited in attacks
  articleas techniques2026-10-30

  Weakness behind CVE-2026-118539: Commerce Core does not sufficiently protect certain routes and entity fields, so unauthenticated attackers can bypass access controls, with possible financial impact on the vendor

• Telegram Desktop vulnerability allowed any user's file to be stolen
  writeupas classification.key entities2026-10-10
• Why AI Coding Agents Keep Writing Broken Access Control
  articleas classification.key entities2026-10-01It is written here as CWE-862.
• WordPress Security Skills
  repoas techniques2026-09-15

  Documented failure mode in AI-generated WordPress code enabling access control issues

• Microsoft Patch Tuesday for September 2026 — Snort rules and prominent vulnerabilities
  advisoryas techniques2026-09-08
• How An Authorization Flaw Reveals A Common Security Blind Spot: CVE-2025-59305 Case Study | depthfirst
  writeupas classification.key entities2025-09-30It is written here as CWE-862.
• CVE-2026-55544: NextCRM is open-source customer relationship management (CRM) software
  advisoryas classification.key entitiesIt is written here as CWE-862.
• CVE-2026-49291: mcp-memory-service is a semantic memory layer for AI applications
  advisoryas classification.key entitiesIt is written here as CWE-862.
• Unauthenticated Administrator takeover exfiltrated via the MCP
  advisoryas techniquesIt is written here as Missing Authorization (CWE-862).

  POST /mcp is gated only by model.CheckAuth with no model.CheckAdminRole or model.CheckReadonly, allowing Reader-scoped principals to reach admin-equivalent tools

• Security Hardening Release for Splunk Apps and Add-ons - August 2026
  advisoryas techniques

  REST API handlers lacking authorization checks for container/connection management, CVE-2026-76394 and experiment history deletion CVE-2026-76398

• CVE-2026-49291 | THREATINT
  advisoryas techniquesIt is written here as Missing Authorization (CWE-862).

  MCP JSON-RPC endpoint /mcp requires only 'read' OAuth scope but dispatches tools/call to mutating handlers (store_memory, delete_memory), bypassing the 'write' scope required by equivalent REST endpoints, allowing a read-only client to perform write/delete operations