# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Budibase before 3.45.0 Information Disclosure via Chat Links](https://agentprime.io/advisories/CVE-2026-100685.md)
  `CVE-2026-100685` · CVE record: budibase server · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [stoatchat before 0.15.5 MFA Bypass via Cross-Account Ticket](https://agentprime.io/advisories/CVE-2026-100679.md)
  `CVE-2026-100679` · CVE record: stoatchat stoatchat · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Grav CMS 2.0.14 through 2.0.24 Privilege Escalation via Blueprint Guard Bypass](https://agentprime.io/advisories/CVE-2026-100670.md)
  `CVE-2026-100670` · CVE record: getgrav grav · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [SiYuan before v3.8.4 Missing Authorization via siyuan-send-windows](https://agentprime.io/advisories/CVE-2026-100634.md)
  `CVE-2026-100634` · CVE record: siyuan-note siyuan · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [SiYuan 3.8.0 through 3.8.3 Path Traversal via MCP File Operations](https://agentprime.io/advisories/CVE-2026-100633.md)
  `CVE-2026-100633` · CVE record: siyuan-note siyuan · CVSS 8.5 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Capgo backend before 12.127.5 Privilege Escalation via role_bindings PATCH](https://agentprime.io/advisories/CVE-2026-100629.md)
  `CVE-2026-100629` · CVE record: Cap-go capgo.app · CVSS 7.0 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [capgo.app before 12.128.12 Authentication Bypass via apikey](https://agentprime.io/advisories/CVE-2026-100628.md)
  `CVE-2026-100628` · CVE record: Cap-go capgo.app · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Capgo bundle promotion API channel RBAC deny override bypass](https://agentprime.io/advisories/CVE-2026-100627.md)
  `CVE-2026-100627` · CVE record: Cap-go capgo.app · CVSS 7.2 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Capgo Authentication Bypass via Direct PostgREST org_users Table Write](https://agentprime.io/advisories/CVE-2026-100623.md)
  `CVE-2026-100623` · CVE record: Cap-go capgo.app · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [capgo.app Content-Lock Bypass via r2-direct Bundle Mutation](https://agentprime.io/advisories/CVE-2026-100621.md)
  `CVE-2026-100621` · CVE record: Cap-go capgo.app · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Capgo App Icon Update Privilege Escalation via Service-Role Worker](https://agentprime.io/advisories/CVE-2026-100618.md)
  `CVE-2026-100618` · CVE record: Cap-go capgo.app · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Cap-go capgo.app Authorization Bypass via channel_permission_overrides](https://agentprime.io/advisories/CVE-2026-100617.md)
  `CVE-2026-100617` · CVE record: Cap-go capgo.app · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [capgo.app Authentication Bypass via PostgREST customer_id Mutation](https://agentprime.io/advisories/CVE-2026-100616.md)
  `CVE-2026-100616` · CVE record: Cap-go capgo.app · CVSS 7.0 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Capgo before 12.244.1 Cross-Tenant Image Overwrite via Metadata Worker](https://agentprime.io/advisories/CVE-2026-100614.md)
  `CVE-2026-100614` · CVE record: Cap-go capgo.app · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [capgo.app Authorization Bypass via Stale Channel Permission Overrides](https://agentprime.io/advisories/CVE-2026-100613.md)
  `CVE-2026-100613` · CVE record: Cap-go capgo.app · CVSS 6.0 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Capgo SSO Provider ID Authentication Bypass via Incomplete Migration](https://agentprime.io/advisories/CVE-2026-100612.md)
  `CVE-2026-100612` · CVE record: Cap-go capgo.app · CVSS 8.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Flowise through 3.1.4 Missing Authorization via upsert-history](https://agentprime.io/advisories/CVE-2026-100610.md)
  `CVE-2026-100610` · CVE record: FlowiseAI Flowise · CVSS 7.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Flowise through 3.1.4 Insecure Direct Object Reference via Credential](https://agentprime.io/advisories/CVE-2026-100609.md)
  `CVE-2026-100609` · CVE record: FlowiseAI Flowise · CVSS 7.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Flowise through 3.1.4 Authorization Bypass via BullMQ Dashboard](https://agentprime.io/advisories/CVE-2026-100608.md)
  `CVE-2026-100608` · CVE record: FlowiseAI Flowise · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Flowise through 3.1.4 Missing Authorization via Chat Message Routes](https://agentprime.io/advisories/CVE-2026-100605.md)
  `CVE-2026-100605` · CVE record: FlowiseAI Flowise · CVSS 7.5 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [ClawHub Authentication Bypass via Former Publisher Skill Control](https://agentprime.io/advisories/CVE-2026-100604.md)
  `CVE-2026-100604` · CVE record: openclaw clawhub · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [ClawHub Changelog Preview Information Disclosure via Authorization Bypass](https://agentprime.io/advisories/CVE-2026-100602.md)
  `CVE-2026-100602` · CVE record: openclaw clawhub · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Testimonials Widget <= 4.0.4 - Unauthenticated Arbitrary Post Update](https://agentprime.io/advisories/CVE-2026-96532.md)
  `CVE-2026-96532` · CVE record: Unknown Testimonials Widget · CVSS 7.5 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [MCP Server for WordPress < 1.8.2 - Contributor+ Workflow Modification and Deletion via Missing Ownership Check](https://agentprime.io/advisories/CVE-2026-96525.md)
  `CVE-2026-96525` · CVE record: Unknown MCP Server for WordPress · CVSS 2.7 Low · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.7.1 Authorization Bypass via MCP Configuration](https://agentprime.io/advisories/CVE-2026-100596.md)
  `CVE-2026-100596` · CVE record: OpenClaw OpenClaw · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.7.1 Authentication Bypass via activation](https://agentprime.io/advisories/CVE-2026-100593.md)
  `CVE-2026-100593` · CVE record: OpenClaw OpenClaw · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.7.1 Authentication Bypass via Memory Dreaming](https://agentprime.io/advisories/CVE-2026-100592.md)
  `CVE-2026-100592` · CVE record: OpenClaw OpenClaw · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.7.1 Authentication Bypass via Active Memory](https://agentprime.io/advisories/CVE-2026-100591.md)
  `CVE-2026-100591` · CVE record: OpenClaw OpenClaw · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.7.1 Authorization Bypass via voice set](https://agentprime.io/advisories/CVE-2026-100590.md)
  `CVE-2026-100590` · CVE record: OpenClaw OpenClaw · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.7.1 Sandbox Bypass via Browser Node](https://agentprime.io/advisories/CVE-2026-100589.md)
  `CVE-2026-100589` · CVE record: OpenClaw OpenClaw · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.7.1 Authentication Bypass via node.invoke](https://agentprime.io/advisories/CVE-2026-100588.md)
  `CVE-2026-100588` · CVE record: OpenClaw OpenClaw · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.7.1 Authorization Bypass via Codex Install](https://agentprime.io/advisories/CVE-2026-100587.md)
  `CVE-2026-100587` · CVE record: OpenClaw OpenClaw · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.7.1 Authentication Bypass via MCP Channel](https://agentprime.io/advisories/CVE-2026-100585.md)
  `CVE-2026-100585` · CVE record: OpenClaw OpenClaw · CVSS 8.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw Discord before 2026.7.1 Authorization Bypass](https://agentprime.io/advisories/CVE-2026-100583.md)
  `CVE-2026-100583` · CVE record: openclaw discord · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.7.1 Authentication Bypass via Spoofed Requester](https://agentprime.io/advisories/CVE-2026-100579.md)
  `CVE-2026-100579` · CVE record: OpenClaw OpenClaw · CVSS 7.2 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw Slack before 2026.8.1 Authentication Bypass via Group DM](https://agentprime.io/advisories/CVE-2026-100575.md)
  `CVE-2026-100575` · CVE record: openclaw slack · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.8.1 Sandbox Policy Bypass via MCP Loopback](https://agentprime.io/advisories/CVE-2026-100573.md)
  `CVE-2026-100573` · CVE record: OpenClaw OpenClaw · CVSS 4.8 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw LINE before 2026.8.1 Access Control Inheritance](https://agentprime.io/advisories/CVE-2026-100566.md)
  `CVE-2026-100566` · CVE record: openclaw line · CVSS 6.9 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.8.1 Authorization Bypass via sessions.create](https://agentprime.io/advisories/CVE-2026-100562.md)
  `CVE-2026-100562` · CVE record: OpenClaw OpenClaw · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.8.1 Reusable Exec Approvals Authorization Bypass](https://agentprime.io/advisories/CVE-2026-100560.md)
  `CVE-2026-100560` · CVE record: OpenClaw OpenClaw · CVSS 7.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.8.1 Authorization Bypass via Skill Tool Dispatch](https://agentprime.io/advisories/CVE-2026-100557.md)
  `CVE-2026-100557` · CVE record: OpenClaw OpenClaw · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.8.1 Authentication Bypass via Session Reset](https://agentprime.io/advisories/CVE-2026-100556.md)
  `CVE-2026-100556` · CVE record: OpenClaw OpenClaw · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw 2026.6.9 before 2026.8.1 Cross-Context Policy Bypass via Feishu unpin](https://agentprime.io/advisories/CVE-2026-100553.md)
  `CVE-2026-100553` · CVE record: OpenClaw OpenClaw · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.8.1 Policy Bypass via Native Tools](https://agentprime.io/advisories/CVE-2026-100552.md)
  `CVE-2026-100552` · CVE record: OpenClaw OpenClaw · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.8.1 Authentication Bypass via Access Group](https://agentprime.io/advisories/CVE-2026-100550.md)
  `CVE-2026-100550` · CVE record: OpenClaw OpenClaw · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.8.1 Policy Bypass via Session Filename Generation](https://agentprime.io/advisories/CVE-2026-100545.md)
  `CVE-2026-100545` · CVE record: OpenClaw OpenClaw · CVSS 6.0 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [openclaw voice-call before 2026.8.1 Authorization Bypass](https://agentprime.io/advisories/CVE-2026-100544.md)
  `CVE-2026-100544` · CVE record: openclaw voice-call · CVSS 8.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw Feishu before 2026.8.1 Authentication Bypass via Disabled Account](https://agentprime.io/advisories/CVE-2026-100540.md)
  `CVE-2026-100540` · CVE record: openclaw feishu · CVSS 7.6 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.8.1 Memory Access Control Bypass](https://agentprime.io/advisories/CVE-2026-100539.md)
  `CVE-2026-100539` · CVE record: OpenClaw OpenClaw · CVSS 2.1 Low · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.8.1 Local File Read via Outbound Attachments](https://agentprime.io/advisories/CVE-2026-100538.md)
  `CVE-2026-100538` · CVE record: OpenClaw OpenClaw · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.8.1 Authentication Bypass via Active Memory](https://agentprime.io/advisories/CVE-2026-100537.md)
  `CVE-2026-100537` · CVE record: OpenClaw OpenClaw · CVSS 2.3 Low · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.8.1 Privilege Escalation via Session Memory](https://agentprime.io/advisories/CVE-2026-100535.md)
  `CVE-2026-100535` · CVE record: OpenClaw OpenClaw · CVSS 7.7 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.8.1 Session Cancellation Authorization Bypass](https://agentprime.io/advisories/CVE-2026-100534.md)
  `CVE-2026-100534` · CVE record: OpenClaw OpenClaw · CVSS 2.3 Low · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [openclaw WhatsApp before 2026.8.1 Authentication Bypass](https://agentprime.io/advisories/CVE-2026-100532.md)
  `CVE-2026-100532` · CVE record: openclaw whatsapp · CVSS 7.2 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [openclaw Slack before 2026.8.1 Authorization Bypass](https://agentprime.io/advisories/CVE-2026-100531.md)
  `CVE-2026-100531` · CVE record: openclaw slack · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.8.1 Exec Approval Directory Binding](https://agentprime.io/advisories/CVE-2026-100530.md)
  `CVE-2026-100530` · CVE record: OpenClaw OpenClaw · CVSS 8.5 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.8.1 Authorization Scope Widening via File-Transfer](https://agentprime.io/advisories/CVE-2026-100529.md)
  `CVE-2026-100529` · CVE record: OpenClaw OpenClaw · CVSS 7.4 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Vulnerability in discord](https://agentprime.io/advisories/CVE-2026-100526.md)
  `CVE-2026-100526` · CVE record: openclaw discord · CVSS 6.0 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [OpenClaw diagnostics-prometheus before 2026.9.3 Authentication Bypass](https://agentprime.io/advisories/CVE-2026-100525.md)
  `CVE-2026-100525` · CVE record: openclaw diagnostics-prometheus · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Horilla: Missing Authorization on Payroll Component Views Exposes Employee Salary Structures and Personal Loan Records (IDOR)](https://agentprime.io/advisories/CVE-2026-63431.md)
  `CVE-2026-63431` · CVE record: horilla horilla-hr · CVSS 6.5 Medium · Not analysed yet · Published 25 Sept 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTA5LTI1VDIxOjU2OjAwLjA3NDAwMFoiLCJDVkUtMjAyNi02MzQzMSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTA5LTI2VDEzOjIzOjQ4LjA2MTAwMFoiLCJDVkUtMjAyNi0xMDA2ODgiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTA5LTI2VDEzOjIzOjQ4LjA2MTAwMFoiLCJDVkUtMjAyNi0xMDA2ODgiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.