# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Nginx Proxy Manager through 2.16.0 Improper Authorization via advanced_config](https://agentprime.io/advisories/CVE-2026-102335.md)
  `CVE-2026-102335` · CVE record: NginxProxyManager nginx-proxy-manager · CVSS 7.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [ZoneMinder before 1.38.4 Incorrect Authorization in frames API index](https://agentprime.io/advisories/CVE-2026-102297.md)
  `CVE-2026-102297` · CVE record: ZoneMinder zoneminder · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [jackson-databind: Comparable missing from DefaultBaseTypeLimitingValidator's unsafe base types (incomplete PolymorphicTypeValidator denylist)](https://agentprime.io/advisories/GHSA-gx83-3vf8-gh7j.md)
  `GHSA-gx83-3vf8-gh7j`, `CVE-2026-83557` · Maven `com.fasterxml.jackson.core:jackson-databind` and 1 more: affected `>=2.11.0, <2.18.10 || >=2.19.0, <2.21.6 || >=2.22.0, <2.22.2`, fixed in `2.18.10`, `2.21.6`, `2.22.2` · CVSS 5.6 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Insecure deserialization, Broken access control
- [Eleveo Quality Management GWT RPC QMUtilsService UtilsService.createAndSaveAudit information disclosure](https://agentprime.io/advisories/CVE-2026-101146.md)
  `CVE-2026-101146` · CVE record: Eleveo Quality Management · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure, Broken access control
- [InvoicePlane: Primary Administrator Privilege Downgrade via \`Users::form()\` (Missing Object-Level Authorization)](https://agentprime.io/advisories/CVE-2026-100392.md)
  `CVE-2026-100392` · CVE record: InvoicePlane InvoicePlane · CVSS 7.0 High · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [InvoicePlane: Incomplete Authorization Remediation in Users::form() Enables Primary Administrator Account Takeover via Email Reassignment and Password Recovery](https://agentprime.io/advisories/CVE-2026-100371.md)
  `CVE-2026-100371` · CVE record: InvoicePlane InvoicePlane · CVSS 8.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Eleveo Call Recording Software Query Builder searchAction.do access control](https://agentprime.io/advisories/CVE-2026-101144.md)
  `CVE-2026-101144` · CVE record: Eleveo Call Recording Software · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Eleveo Quality Management QMBODownload information disclosure](https://agentprime.io/advisories/CVE-2026-101143.md)
  `CVE-2026-101143` · CVE record: Eleveo Quality Management · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure, Broken access control
- [@grpc/grpc-js: The exact path match matcher incorrectly only applies a prefix match for case-insensitive matches](https://agentprime.io/advisories/GHSA-88h9-xgvx-hvf2.md)
  `GHSA-88h9-xgvx-hvf2`, `CVE-2026-101914` · npm `@grpc/grpc-js-xds`: affected `<1.13.1 || >=1.14.0, <1.14.1`, fixed in `1.13.1`, `1.14.1` · CVSS 6.5 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control, CWE-187
- [Webkul Bagisto Invoice Mass Status Update state authorization](https://agentprime.io/advisories/CVE-2026-101139.md)
  `CVE-2026-101139` · CVE record: Webkul Bagisto · CVSS 5.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Bluehood: Missing authentication on Bluehood API routes when web auth is enabled](https://agentprime.io/advisories/CVE-2026-49994.md)
  `CVE-2026-49994` · CVE record: dannymcc bluehood · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass, Broken access control
- [WatchGuard AP Command Injection in Internal Management API Allows Command Execution](https://agentprime.io/advisories/CVE-2026-86102.md)
  `CVE-2026-86102` · CVE record: WatchGuard WatchGuard AP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Command injection, Broken access control
- [WatchGuard AP Improper Access Control in API Service Allows Unauthenticated Access](https://agentprime.io/advisories/CVE-2026-101891.md)
  `CVE-2026-101891` · CVE record: WatchGuard WatchGuard AP · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control, CWE-923
- [PMWeb encryptionhelper.dll information disclosure](https://agentprime.io/advisories/CVE-2026-101083.md)
  `CVE-2026-101083` · CVE record: PMWeb · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure, Broken access control
- [WarehousePG pg_file_write/pg_file_rename/pg_file_unlink/pg_logdir_ls privilege escalation](https://agentprime.io/advisories/CVE-2026-96538.md)
  `CVE-2026-96538` · CVE record: EnterpriseDB WarehousePG · CVSS 8.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Cross-tenant BundleDeployment and Secret disclosure via spoofed cluster labels during agent-initiated registration in Fleet](https://agentprime.io/advisories/CVE-2026-93538.md)
  `CVE-2026-93538` · CVE record: SUSE Rancher · CVSS 7.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: Authentication bypass, Broken access control
- [scim-patch: Mutation of Inherited Built-in Method Objects](https://agentprime.io/advisories/GHSA-2mhw-wcx5-v3xj.md)
  `GHSA-2mhw-wcx5-v3xj`, `CVE-2026-61834` · npm `scim-patch`: affected `<0.9.2`, fixed in `0.9.2` · CVSS 4.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control, Prototype pollution
- [Acrel Electric Unet Web Service Upload Endpoint upload unrestricted upload](https://agentprime.io/advisories/CVE-2026-101071.md)
  `CVE-2026-101071` · CVE record: Acrel Electric Unet Web Service · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control, Unrestricted file upload
- [Incorrect authorization in LXD storage volume API allows reading volumes from other projects](https://agentprime.io/advisories/CVE-2026-97335.md)
  `CVE-2026-97335` · CVE record: Canonical LXD · CVSS 7.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [LXD Cross-Project Private Image Theft via Unsanitized GetImageFromAnyProject Local Reuse](https://agentprime.io/advisories/CVE-2026-86335.md)
  `CVE-2026-86335` · CVE record: Canonical LXD · CVSS 6.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Improper Permission Assignment in Scheduler Service](https://agentprime.io/advisories/CVE-2026-15952.md)
  `CVE-2026-15952` · CVE record: ABB Protection and control IED manager (PCM600) · CVSS 7.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Improper Authorization in Enocta Educational's Enocta Platform](https://agentprime.io/advisories/CVE-2026-82323.md)
  `CVE-2026-82323` · CVE record: Enocta Educational Technologies Inc. Enocta Platform · CVSS 8.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Authenticated Broken Access Control](https://agentprime.io/advisories/CVE-2026-12265.md)
  `CVE-2026-12265` · CVE record: Zohocorp DDI Central · CVSS 8.8 High · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Thinkware U3000 TCP Service GET_STATUS information disclosure](https://agentprime.io/advisories/CVE-2026-101055.md)
  `CVE-2026-101055` · CVE record: Thinkware U3000 · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure, Broken access control
- [Thinkware U3000 TCP Service wpa_supplicant.conf get_file access control](https://agentprime.io/advisories/CVE-2026-101054.md)
  `CVE-2026-101054` · CVE record: Thinkware U3000 · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Thinkware U3000 TCP Service wpa_supplicant.conf PUT_FILE access control](https://agentprime.io/advisories/CVE-2026-101053.md)
  `CVE-2026-101053` · CVE record: Thinkware U3000 · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution](https://agentprime.io/advisories/CVE-2026-19759.md)
  `CVE-2026-19759` · CVE record: Google Cloud Application Integration · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Apache Roller: Missing weblog authorization in XML-RPC Blogger/MetaWeblog handlers](https://agentprime.io/advisories/CVE-2026-82377.md)
  `CVE-2026-82377` · CVE record: Apache Software Foundation Apache Roller · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Apache Roller: OAuth authorization endpoint trusts request-supplied identity](https://agentprime.io/advisories/CVE-2026-82378.md)
  `CVE-2026-82378` · CVE record: Apache Software Foundation Apache Roller · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Apache Roller: Cross-weblog resource tampering via unscoped authoring lookups](https://agentprime.io/advisories/CVE-2026-82348.md)
  `CVE-2026-82348` · CVE record: Apache Software Foundation Apache Roller · CVSS 7.7 High · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Frappe HR Permission Validation \_\_init\_\_.py get_attendance_requests authorization](https://agentprime.io/advisories/CVE-2026-101006.md)
  `CVE-2026-101006` · CVE record: Frappe HR · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [WP Verify API <= 1.0.0 - Unauthenticated Verification Code Email Sending to Arbitrary Recipients](https://agentprime.io/advisories/CVE-2026-89300.md)
  `CVE-2026-89300` · CVE record: Unknown WP Verify API · CVSS 5.3 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Netcore NBR100V2 ACL unauthenticated.json uci.apply authorization](https://agentprime.io/advisories/CVE-2026-101000.md)
  `CVE-2026-101000` · CVE record: Netcore NBR100V2 · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Eyeplus p2pcam Service snapshot information disclosure](https://agentprime.io/advisories/CVE-2026-100907.md)
  `CVE-2026-100907` · CVE record: Eyeplus · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure, Broken access control
- [Eyeplus ONVIF Device GetUsers information disclosure](https://agentprime.io/advisories/CVE-2026-100906.md)
  `CVE-2026-100906` · CVE record: Eyeplus · CVSS 6.9 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Information disclosure, Broken access control
- [fuzui StudentInfo Password Change Endpoint moditypasswordstu authorization](https://agentprime.io/advisories/CVE-2026-100897.md)
  `CVE-2026-100897` · CVE record: fuzui StudentInfo · CVSS 5.1 Medium · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control
- [Krayin laravel-crm admin-config-setup API Endpoint CanInstall.php authorization](https://agentprime.io/advisories/CVE-2026-100885.md)
  `CVE-2026-100885` · CVE record: Krayin laravel-crm · CVSS 6.9 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Broken access control
- [Krayin laravel-crm acl.php access control](https://agentprime.io/advisories/CVE-2026-100883.md)
  `CVE-2026-100883` · CVE record: Krayin laravel-crm · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Privilege escalation, Broken access control
- [Flatpak: flatpak: flatpak-system-helper cross-user cancelpull orphans another user's ongoing pull](https://agentprime.io/advisories/CVE-2026-96283.md)
  `CVE-2026-96283` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 3.3 Low · Not analysed yet · Published 27 Sept 2026 · Tags: Broken access control
- [Flatpak: flatpak: unprivileged active user can bypass anti-downgrade checks for system apps/runtimes](https://agentprime.io/advisories/CVE-2026-96281.md)
  `CVE-2026-96281` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 3 more · CVSS 6.2 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Broken access control
- [zhistaredu StarTraining dataScope Endpoint SysRoleServiceImpl.java checkRoleAllowed authorization](https://agentprime.io/advisories/CVE-2026-100879.md)
  `CVE-2026-100879` · CVE record: zhistaredu StarTraining · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Broken access control
- [zhistaredu StarTraining authRole Endpoint SysUser.java SysUser.isAdmin authorization](https://agentprime.io/advisories/CVE-2026-100878.md)
  `CVE-2026-100878` · CVE record: zhistaredu StarTraining · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Broken access control
- [mathurvishal CloudClassroom-PHP-Project cross-site request forgery](https://agentprime.io/advisories/CVE-2026-100873.md)
  `CVE-2026-100873` · CVE record: mathurvishal CloudClassroom-PHP-Project · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [KitchenOwl through 0.7.10 IDOR via unchecked category ID](https://agentprime.io/advisories/CVE-2026-101033.md)
  `CVE-2026-101033` · CVE record: TomBursch kitchenowl · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Broken access control
- [NextScripts: Social Networks Auto-Poster < 4.4.8 - Authenticated Social Account Credential Disclosure and Data Deletion](https://agentprime.io/advisories/CVE-2026-97227.md)
  `CVE-2026-97227` · CVE record: Unknown NextScripts: Social Networks Auto-Poster · CVSS 5.9 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Broken access control
- [Optima Express 8.5.0 - 8.7.5 - Unauthenticated Author Account Creation & Application Password Rotation via ihf_clear_cache](https://agentprime.io/advisories/CVE-2026-96897.md)
  `CVE-2026-96897` · CVE record: Unknown Optima Express IDX · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Broken access control
- [Malcure Malware Shield < 19.9.7 - Multisite Subsite Admin+ Arbitrary File Write and Deletion via wpmr_ajax_request](https://agentprime.io/advisories/CVE-2026-96896.md)
  `CVE-2026-96896` · CVE record: Unknown Malcure Malware Shield — Removal, Repair, Monitor · CVSS 7.2 High · Not analysed yet · Published 27 Sept 2026 · Tags: Broken access control
- [Mailchimp for WooCommerce < 6.3 - Unauthenticated Customer Email and Cart Disclosure via IDOR](https://agentprime.io/advisories/CVE-2026-92436.md)
  `CVE-2026-92436` · CVE record: Unknown Mailchimp for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Broken access control
- [Bookly < 28.3 - Staff+ Appointment and Payment Disclosure, Modification and Deletion via IDOR](https://agentprime.io/advisories/CVE-2026-86839.md)
  `CVE-2026-86839` · CVE record: Unknown Online Scheduling and Appointment Booking System · CVSS 3.8 Low · Not analysed yet · Published 27 Sept 2026 · Tags: Broken access control
- [Duplicate Advisory: vm2: NodeVM custom resolution bypasses external path boundaries](https://agentprime.io/advisories/GHSA-c9wr-qm7p-p6vc.md)
  `GHSA-c9wr-qm7p-p6vc` · npm `vm2`: affected `<3.12.2`, fixed in `3.12.2` · CVSS 9.0 Critical · Withdrawn · Not analysed yet · Published 27 Sept 2026 · Tags: Broken access control
- [AzuraCast before 0.23.8 On-Demand Download Endpoint Authorization Bypass](https://agentprime.io/advisories/CVE-2026-100853.md)
  `CVE-2026-100853` · CVE record: AzuraCast AzuraCast · CVSS 8.2 High · Not analysed yet · Published 27 Sept 2026 · Tags: Broken access control
- [coollabsio Coolify Route-Level Middleware CanUpdateResource.php authorization](https://agentprime.io/advisories/CVE-2026-100744.md)
  `CVE-2026-100744` · CVE record: coollabsio Coolify · CVSS 6.9 Medium · Not analysed yet · Published 27 Sept 2026 · Tags: Broken access control
- [Missing Authorization in Kibana Leading to Unauthorized Deletion of Data](https://agentprime.io/advisories/CVE-2026-78582.md)
  `CVE-2026-78582` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Authorization Bypass Through User-Controlled Key in Kibana Leading to Unauthorized Disclosure, Modification, and Deletion of Data](https://agentprime.io/advisories/CVE-2026-72662.md)
  `CVE-2026-72662` · CVE record: Elastic Kibana · CVSS 6.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Joomla Extension - lomart.fr - Various path traversal / file access vectors in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29](https://agentprime.io/advisories/CVE-2026-97161.md)
  `CVE-2026-97161` · CVE record: lomart.fr UP plugin for Joomla · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal, Broken access control
- [Joomla Extension - lomart.fr - Unauthenticated remote code installation in UP plugin extension 5.0.0-5.2.0, 6.0.0-6.0.29](https://agentprime.io/advisories/CVE-2026-97163.md)
  `CVE-2026-97163` · CVE record: lomart.fr UP plugin for Joomla · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Sept 2026 · Tags: Path traversal, Broken access control
- [capgo through 12.128.2 IDOR via PUT /app icon endpoint](https://agentprime.io/advisories/CVE-2026-100626.md)
  `CVE-2026-100626` · CVE record: Cap-go capgo.app · CVSS 5.3 Medium · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Froxlor before 2.3.12 Authentication Bypass via EmailSender.add](https://agentprime.io/advisories/CVE-2026-100718.md)
  `CVE-2026-100718` · CVE record: froxlor froxlor · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Kyverno before 1.19.1 ImageValidatingPolicy Exception Bypass](https://agentprime.io/advisories/CVE-2026-100704.md)
  `CVE-2026-100704` · CVE record: kyverno kyverno · CVSS 8.3 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control
- [Budibase server before 3.45.0 Cross-Tenant Information Disclosure](https://agentprime.io/advisories/CVE-2026-100688.md)
  `CVE-2026-100688` · CVE record: budibase server · CVSS 7.1 High · Not analysed yet · Published 26 Sept 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTA5LTI2VDEzOjIzOjQ4LjA2MTAwMFoiLCJDVkUtMjAyNi0xMDA2ODgiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTA5LTI4VDIzOjM0OjI5LjkwNTAwMFoiLCJDVkUtMjAyNi0xMDIzNjUiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTA5LTI4VDIzOjM0OjI5LjkwNTAwMFoiLCJDVkUtMjAyNi0xMDIzNjUiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.