Missing authorization vulnerabilities
The software checks who you are but not what you are allowed to do, so ordinary users can reach other people's data or admin functions.
Missing authorization in numbers
sbomify tracks 28,513 missing authorization vulnerabilities. Most are found in web application (36%), cms plugin (33%) and server software (17%).
How to fix missing authorization vulnerabilities
Upgrade, and check permissions on every request on the server, not only in the interface.
Most exploited missing authorization vulnerabilities
- CVE-2026-34908 Ubiquiti UniFi OS Improper Access Control
- CVE-2026-21962 Oracle HTTP Server and Oracle Weblogic Server Proxy Plug-in Improper Access Control
- CVE-2025-54253 Adobe Experience Manager Forms Code Execution
- CVE-2025-31324 SAP NetWeaver Unrestricted File Upload
- CVE-2023-22518 Atlassian Confluence Data Center and Server Improper Authorization
- CVE-2021-28799 QNAP NAS Improper Authorization
- CVE-2020-6287 SAP NetWeaver Missing Authentication for Critical Function
- CVE-2020-6207 SAP Solution Manager Missing Authentication for Critical Function
- CVE-2010-5326 SAP NetWeaver Remote Code Execution
- CVE-2026-84869 ConnectWise ScreenConnect Improper Privilege Management and Missing Authorization
- CVE-2026-20253 Splunk Enterprise Missing Authentication for Critical Function
- CVE-2024-11680 ProjectSend Improper Authentication
Recently published
- CVE-2025-10149 Arbitrary Operations via SCIM Endpoints in Multiple WSO2 Products Enables User Account Takeover
- CVE-2026-102503 Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)
- CVE-2026-103091 Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)
- CVE-2026-106010 BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery
- CVE-2026-106028 ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation
- CVE-2026-107187 Eptura Archibus Workflow Rule Enables Unauthenticated Database Read of Sensitive Tables
Other types of vulnerability
- Cross-site scripting54,178
- Memory corruption53,628
- Denial of service36,532
- 35,428
- SQL injection23,565
- Path traversal19,236
- 16,160
Find these in your own software.
Upload an SBOM and sbomify checks it against every vulnerability here, every day.