# Broken access control. Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first - [Subnet Solutions PowerSYSTEM Center Incorrect Authorization](https://agentprime.io/advisories/CVE-2026-63017.md) `CVE-2026-63017` · CVE record: Subnet Solutions PowerSYSTEM Center 2020 and 2 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Nov 2026 · Tags: Broken access control - [Dagu MCP DAG specification read bypasses path containment and workspace isolation](https://agentprime.io/advisories/CVE-2026-102943.md) `CVE-2026-102943` · CVE record: dagucloud dagu · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, Broken access control - [Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)](https://agentprime.io/advisories/CVE-2026-88982.md) `CVE-2026-88982` · CVE record: kubeflow pipelines · CVSS 5.4 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control, CWE-345 - [Kubeflow Pipelines API server lacks authorization for shared pipeline uploads](https://agentprime.io/advisories/CVE-2026-77596.md) `CVE-2026-77596` · CVE record: kubeflow pipelines · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines](https://agentprime.io/advisories/CVE-2026-88984.md) `CVE-2026-88984` · CVE record: kubeflow pipelines · CVSS 7.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Insecure direct object reference (IDOR) vulnerability in the MatchPoint API](https://agentprime.io/advisories/CVE-2026-111490.md) `CVE-2026-111490` · CVE record: TPC Software Matchpoint · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)](https://agentprime.io/advisories/CVE-2026-85076.md) `CVE-2026-85076` · CVE record: jhuckaby Cronicle · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Other injection, Broken access control - [OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment](https://agentprime.io/advisories/CVE-2026-102940.md) `CVE-2026-102940` · CVE record: openemr openemr · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)](https://agentprime.io/advisories/CVE-2026-104134.md) `CVE-2026-104134` · CVE record: openemr openemr · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [OpenEMR: Weno \`file_download.php\`: missing ACL/CSRF truncates the e-prescribing pharmacy directory](https://agentprime.io/advisories/CVE-2026-103939.md) `CVE-2026-103939` · CVE record: openemr openemr · CVSS 5.4 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [OpenEMR: Missing authorization on QRDA Category I/III download endpoints](https://agentprime.io/advisories/CVE-2026-104138.md) `CVE-2026-104138` · CVE record: openemr openemr · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration](https://agentprime.io/advisories/CVE-2026-115573.md) `CVE-2026-115573` · CVE record: openemr openemr · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [OpenEMR: Missing authorization in DORN \`compendium_install.php\` — non-admin destructive lab-compendium reinstall](https://agentprime.io/advisories/CVE-2026-104133.md) `CVE-2026-104133` · CVE record: openemr openemr · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth](https://agentprime.io/advisories/CVE-2026-104135.md) `CVE-2026-104135` · CVE record: openemr openemr · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [OpenEMR: Arbitrary Patient Recall and Contact Detail Read](https://agentprime.io/advisories/CVE-2026-104136.md) `CVE-2026-104136` · CVE record: openemr openemr · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [OpenEMR: Patient Data Search Without Sufficient ACL](https://agentprime.io/advisories/CVE-2026-104137.md) `CVE-2026-104137` · CVE record: openemr openemr · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI](https://agentprime.io/advisories/CVE-2026-104139.md) `CVE-2026-104139` · CVE record: openemr openemr · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Incorrect default permissions in Hewlett Packard Enterprise (HPE) HPE Cray Programming Environment](https://agentprime.io/advisories/CVE-2026-44875.md) `CVE-2026-44875` · CVE record: Hewlett Packard Enterprise (HPE) HPE Cray Programming Environment · CVSS 7.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record](https://agentprime.io/advisories/CVE-2026-100360.md) `CVE-2026-100360` · CVE record: SuiteCRM SuiteCRM · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)](https://agentprime.io/advisories/CVE-2026-100361.md) `CVE-2026-100361` · CVE record: SuiteCRM SuiteCRM · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack](https://agentprime.io/advisories/CVE-2026-100364.md) `CVE-2026-100364` · CVE record: SuiteCRM SuiteCRM · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php](https://agentprime.io/advisories/CVE-2026-69144.md) `CVE-2026-69144` · CVE record: SuiteCRM SuiteCRM · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorization](https://agentprime.io/advisories/CVE-2026-61650.md) `CVE-2026-61650` · CVE record: SuiteCRM SuiteCRM · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [SuiteCRM: IDOR in generatePdf Entry Point Allows Record Data Exfiltration](https://agentprime.io/advisories/CVE-2026-63217.md) `CVE-2026-63217` · CVE record: SuiteCRM SuiteCRM · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPage](https://agentprime.io/advisories/CVE-2026-63218.md) `CVE-2026-63218` · CVE record: SuiteCRM SuiteCRM · CVSS 6.5 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cron](https://agentprime.io/advisories/CVE-2026-63111.md) `CVE-2026-63111` · CVE record: SuiteCRM SuiteCRM · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control, Server-side request forgery (SSRF) - [Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6](https://agentprime.io/advisories/CVE-2026-115451.md) `CVE-2026-115451` · CVE record: tassos.gr Advanced Custom Fields extension for Joomla and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0](https://agentprime.io/advisories/CVE-2026-107130.md) `CVE-2026-107130` · CVE record: balbooa.com Gridbox extension for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes](https://agentprime.io/advisories/CVE-2026-123184.md) `CVE-2026-123184` · CVE record: Altium Altium 365 · CVSS 7.2 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control, CWE-20 - [lxd allows Cross-guest volume hijack via DevLXD device patch](https://agentprime.io/advisories/GHSA-hhf9-qw4v-72xp.md) `GHSA-hhf9-qw4v-72xp`, `CVE-2026-12411`, `GO-2026-6917` · Go `github.com/canonical/lxd`: affected `>=0.0.0-20250721152936-fe86ceb2c3fa, <0.0.0-20260626085133-7cb96ac80a6d`, fixed in `0.0.0-20260626085133-7cb96ac80a6d` · CVSS 8.4 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [HedgeDoc: Missing validation of incoming permission values on change](https://agentprime.io/advisories/CVE-2026-102927.md) `CVE-2026-102927` · CVE record: hedgedoc hedgedoc · CVSS 5.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control, CWE-20 - [Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints](https://agentprime.io/advisories/CVE-2026-77439.md) `CVE-2026-77439` · CVE record: immich-app immich · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Privilege escalation, Broken access control - [Immich calendar heatmap endpoint discloses cross-user activity through broken access control](https://agentprime.io/advisories/CVE-2026-104867.md) `CVE-2026-104867` · CVE record: immich-app immich · CVSS 4.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control, CWE-1220 - [OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)](https://agentprime.io/advisories/CVE-2026-54146.md) `CVE-2026-54146` · CVE record: tinyhumansai openhuman · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control, CWE-526 - [OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution](https://agentprime.io/advisories/CVE-2026-54143.md) `CVE-2026-54143` · CVE record: tinyhumansai openhuman · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Command injection, Broken access control - [OpenHuman: Yuanbao non-web channel can bypass human approval to execute \`node_exec\`](https://agentprime.io/advisories/CVE-2026-54141.md) `CVE-2026-54141` · CVE record: tinyhumansai openhuman · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Nov 2026 · Tags: Code injection, Broken access control - [Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction](https://agentprime.io/advisories/CVE-2026-111253.md) `CVE-2026-111253` · CVE record: Red Hat Red Hat Hardened Images · CVSS 6.6 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture](https://agentprime.io/advisories/CVE-2026-54144.md) `CVE-2026-54144` · CVE record: tinyhumansai openhuman · CVSS 6.1 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control, Information disclosure - [Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access](https://agentprime.io/advisories/CVE-2026-114232.md) `CVE-2026-114232` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 8.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Content Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blocks](https://agentprime.io/advisories/CVE-2026-119751.md) `CVE-2026-119751` · CVE record: keywordrush Content Egg – Affiliate Product Importer & Price Comparison · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints](https://agentprime.io/advisories/CVE-2026-122327.md) `CVE-2026-122327` · CVE record: Arthi-chaud Meelo · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contents](https://agentprime.io/advisories/CVE-2026-122326.md) `CVE-2026-122326` · CVE record: Chevereto Chevereto · CVSS 6.9 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API](https://agentprime.io/advisories/CVE-2026-122325.md) `CVE-2026-122325` · CVE record: fossasia eventyay-exhibition · CVSS 2.3 Low · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails](https://agentprime.io/advisories/CVE-2026-122324.md) `CVE-2026-122324` · CVE record: oss-apps SplitPro · CVSS 2.3 Low · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query](https://agentprime.io/advisories/CVE-2026-122317.md) `CVE-2026-122317` · CVE record: oss-apps SplitPro · CVSS 5.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Unauthenticated HR organization and employee disclosure](https://agentprime.io/advisories/CVE-2026-73580.md) `CVE-2026-73580` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, Broken access control - [Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage](https://agentprime.io/advisories/CVE-2026-76150.md) `CVE-2026-76150` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, Broken access control - [Apache OFBiz: Missing authorization - catalog quick-admin product writes](https://agentprime.io/advisories/CVE-2026-81734.md) `CVE-2026-81734` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services](https://agentprime.io/advisories/CVE-2026-76152.md) `CVE-2026-76152` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, Broken access control - [Apache OFBiz: Authorization bypass - self-grant content OWNER](https://agentprime.io/advisories/CVE-2026-81744.md) `CVE-2026-81744` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Missing authorization - search-result bulk catalog mutation](https://agentprime.io/advisories/CVE-2026-81808.md) `CVE-2026-81808` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile](https://agentprime.io/advisories/CVE-2026-82902.md) `CVE-2026-82902` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 4.3 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control, Server-side request forgery (SSRF) - [Apache OFBiz: Unbounded multi-form row count from a parameter name](https://agentprime.io/advisories/CVE-2026-82904.md) `CVE-2026-82904` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 7.5 High · Not analysed yet · Published 5 Nov 2026 · Tags: Denial of service, Broken access control - [Apache OFBiz: webtools xmldsdump exports any entity to any path](https://agentprime.io/advisories/CVE-2026-82916.md) `CVE-2026-82916` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 7.1 High · Not analysed yet · Published 5 Nov 2026 · Tags: Path traversal, Broken access control - [Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers](https://agentprime.io/advisories/CVE-2026-83538.md) `CVE-2026-83538` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Information disclosure, Broken access control - [Apache OFBiz: Content Manager VIEW-only RCE in updateLayout](https://agentprime.io/advisories/CVE-2026-84183.md) `CVE-2026-84183` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 8.8 High · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login](https://agentprime.io/advisories/CVE-2026-84728.md) `CVE-2026-84728` · CVE record: Apache Software Foundation Apache OFBiz · CVSS 5.4 Medium · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Authenticated Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-85627.md) `CVE-2026-85627` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control, Code injection - [Apache OFBiz: Missing Authorization vulnerability](https://agentprime.io/advisories/CVE-2026-100168.md) `CVE-2026-100168` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control - [Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations](https://agentprime.io/advisories/CVE-2026-105325.md) `CVE-2026-105325` · CVE record: Apache Software Foundation Apache OFBiz · No CVSS score · Not analysed yet · Published 5 Nov 2026 · Tags: Broken access control Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .