# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95278.md)
  `CVE-2026-95278` · CVE record: Google Chrome · CVSS 8.4 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95285.md)
  `CVE-2026-95285` · CVE record: Google Chrome · CVSS 8.4 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95358.md)
  `CVE-2026-95358` · CVE record: Google Chrome · CVSS 4.4 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95289.md)
  `CVE-2026-95289` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95300.md)
  `CVE-2026-95300` · CVE record: Google Chrome · CVSS 4.8 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95374.md)
  `CVE-2026-95374` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95290.md)
  `CVE-2026-95290` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95371.md)
  `CVE-2026-95371` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95314.md)
  `CVE-2026-95314` · CVE record: Google Chrome · CVSS 8.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95317.md)
  `CVE-2026-95317` · CVE record: Google Chrome · CVSS 3.1 Low · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95320.md)
  `CVE-2026-95320` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95302.md)
  `CVE-2026-95302` · CVE record: Google Chrome · CVSS 2.9 Low · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95375.md)
  `CVE-2026-95375` · CVE record: Google Chrome · CVSS 6.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95297.md)
  `CVE-2026-95297` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95287.md)
  `CVE-2026-95287` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95355.md)
  `CVE-2026-95355` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95301.md)
  `CVE-2026-95301` · CVE record: Google Chrome · CVSS 8.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket](https://agentprime.io/advisories/CVE-2026-102807.md)
  `CVE-2026-102807` · CVE record: OpenClaw OpenClaw · CVSS 6.0 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines](https://agentprime.io/advisories/CVE-2026-102806.md)
  `CVE-2026-102806` · CVE record: OpenClaw OpenClaw · CVSS 6.0 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4](https://agentprime.io/advisories/CVE-2026-101112.md)
  `CVE-2026-101112` · CVE record: balbooa.com Balbooa Forms extension for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization](https://agentprime.io/advisories/CVE-2026-102697.md)
  `CVE-2026-102697` · CVE record: ollama ollama · CVSS 8.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Joomla! Core - \[20260913\] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-92226.md)
  `CVE-2026-92226` · CVE record: Joomla! Project Joomla! CMS · CVSS 7.0 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Joomla! Core - \[20260902\] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90907.md)
  `CVE-2026-90907` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Joomla! Core - \[20260910\] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-92223.md)
  `CVE-2026-92223` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Joomla! Core - \[20260907\] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90917.md)
  `CVE-2026-90917` · CVE record: Joomla! Project Joomla! CMS · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Joomla! Core - \[20260906\] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90916.md)
  `CVE-2026-90916` · CVE record: Joomla! Project Joomla! CMS · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Joomla! Core - \[20260903\] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3](https://agentprime.io/advisories/CVE-2026-90913.md)
  `CVE-2026-90913` · CVE record: Joomla! Project Joomla! CMS · CVSS 7.0 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [TemplateSandbox does not check read permissions for the page being previewed](https://agentprime.io/advisories/CVE-2026-100240.md)
  `CVE-2026-100240` · CVE record: Wikimedia Foundation Mediawiki - TemplateSandbox Extension · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2026-100289.md)
  `CVE-2026-100289` · CVE record: Devolutions Server · CVSS 5.0 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Remote Session Access Control Bypass Leading to Remote Code Execution](https://agentprime.io/advisories/CVE-2026-92370.md)
  `CVE-2026-92370` · CVE record: TeamViewer Full Client and 1 more · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2026-100287.md)
  `CVE-2026-100287` · CVE record: Devolutions Server · CVSS 5.4 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2026-93332.md)
  `CVE-2026-93332` · CVE record: Devolutions Server · CVSS 5.4 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py](https://agentprime.io/advisories/CVE-2026-102568.md)
  `CVE-2026-102568` · CVE record: pardus pardus-parental-control · CVSS 6.8 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials](https://agentprime.io/advisories/CVE-2026-97395.md)
  `CVE-2026-97395` · CVE record: Apache Software Foundation Apache Polaris · CVSS 8.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints](https://agentprime.io/advisories/CVE-2026-71897.md)
  `CVE-2026-71897` · CVE record: Apache Software Foundation Apache DolphinScheduler · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions](https://agentprime.io/advisories/CVE-2026-71898.md)
  `CVE-2026-71898` · CVE record: Apache Software Foundation Apache DolphinScheduler · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure](https://agentprime.io/advisories/CVE-2026-71899.md)
  `CVE-2026-71899` · CVE record: Apache Software Foundation Apache DolphinScheduler · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths](https://agentprime.io/advisories/CVE-2026-78214.md)
  `CVE-2026-78214` · CVE record: Apache Software Foundation Apache DolphinScheduler · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution](https://agentprime.io/advisories/CVE-2026-81569.md)
  `CVE-2026-81569` · CVE record: Apache Software Foundation Apache DolphinScheduler · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Sandbox escape in the DOM: Navigation component](https://agentprime.io/advisories/CVE-2026-100758.md)
  `CVE-2026-100758` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect permission assignment in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2026-73598.md)
  `CVE-2026-73598` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 7.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Revenue information leak](https://agentprime.io/advisories/CVE-2026-101267.md)
  `CVE-2026-101267` · CVE record: pretix pretix · CVSS 2.7 Low · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Privilege Escalation via Account Takeover in Interprobe's Qorela DC](https://agentprime.io/advisories/CVE-2026-87748.md)
  `CVE-2026-87748` · CVE record: Interprobe Information Technologies Inc. Qorela DC · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-4523.md)
  `CVE-2026-4523` · CVE record: GitLab GitLab · CVSS 3.7 Low · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-8937.md)
  `CVE-2026-8937` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-10518.md)
  `CVE-2026-10518` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Hitachi Energy RTU500 series CMU firmware](https://agentprime.io/advisories/CVE-2026-8067.md)
  `CVE-2026-8067` · CVE record: Hitachi Energy RTU500 series CMU firmware · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Apache Karaf: Authorization bypass in JMX MBean lifecycle operations](https://agentprime.io/advisories/CVE-2026-92142.md)
  `CVE-2026-92142` · CVE record: Apache Software Foundation Apache Karaf · CVSS 8.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Apache Karaf: config:install missing ACL entry allows privilege escalation to admin](https://agentprime.io/advisories/CVE-2026-91085.md)
  `CVE-2026-91085` · CVE record: Apache Software Foundation Apache Karaf · CVSS 6.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Apache Karaf: Missing authorization on the jdbc:\* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create](https://agentprime.io/advisories/CVE-2026-91048.md)
  `CVE-2026-91048` · CVE record: Apache Software Foundation Apache Karaf · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [realjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization](https://agentprime.io/advisories/CVE-2026-102293.md)
  `CVE-2026-102293` · CVE record: realjerrytang tacomall · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Privilege escalation, Broken access control
- [mwasikz robo-cafe-rms manage-food.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-102263.md)
  `CVE-2026-102263` · CVE record: mwasikz robo-cafe-rms · CVSS 5.1 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control, Unrestricted file upload
- [owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization](https://agentprime.io/advisories/CVE-2026-102261.md)
  `CVE-2026-102261` · CVE record: owen2345 Camaleon CMS · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [REBUILD file-editor-save authorization](https://agentprime.io/advisories/CVE-2026-102249.md)
  `CVE-2026-102249` · CVE record: REBUILD · CVSS 6.9 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations](https://agentprime.io/advisories/CVE-2026-97685.md)
  `CVE-2026-97685` · CVE record: LimeSurvey LimeSurvey · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter](https://agentprime.io/advisories/CVE-2026-102373.md)
  `CVE-2026-102373` · CVE record: GestSup GestSup · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch.](https://agentprime.io/advisories/CVE-2026-79537.md)
  `CVE-2026-79537` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle access restrictions via a TOCTOU condition in…](https://agentprime.io/advisories/CVE-2026-79417.md)
  `CVE-2026-79417` · CVE record · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control, Race condition
- [KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API.](https://agentprime.io/advisories/CVE-2026-79348.md)
  `CVE-2026-79348` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [mall4j through 4.0 Missing Authorization in Admin User Address Endpoints](https://agentprime.io/advisories/CVE-2026-102365.md)
  `CVE-2026-102365` · CVE record: gz-yami mall4j · CVSS 7.1 High · Not analysed yet · Published 28 Sept 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTA5LTI4VDIzOjM0OjI5LjkwNTAwMFoiLCJDVkUtMjAyNi0xMDIzNjUiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTA5LTI5VDE3OjMxOjU3LjIzOTAwMFoiLCJDVkUtMjAyNi05NTI5MiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTA5LTI5VDE3OjMxOjU3LjIzOTAwMFoiLCJDVkUtMjAyNi05NTI5MiJd>. Everything for agents: <https://agentprime.io/llms.txt>.