# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress GiveWP plugin <= 4.16.9 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-96834.md)
  `CVE-2026-96834` · CVE record: Liquid Web / StellarWP GiveWP · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Customer Reviews for WooCommerce plugin <= 5.120.0 - Arbitrary Content Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-96823.md)
  `CVE-2026-96823` · CVE record: CusRev Customer Reviews for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress WP Express Checkout (Accept PayPal Payments) plugin <= 2.4.9 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-96818.md)
  `CVE-2026-96818` · CVE record: mra13 / Team Tips and Tricks HQ WP Express Checkout (Accept PayPal Payments) · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress MakeCommerce for WooCommerce plugin <= 4.1.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-96817.md)
  `CVE-2026-96817` · CVE record: MakeCommerce.net MakeCommerce for WooCommerce · CVSS 8.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Bookly plugin <= 28.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-96348.md)
  `CVE-2026-96348` · CVE record: Bookly Bookly · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Bookly plugin <= 28.2 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-96347.md)
  `CVE-2026-96347` · CVE record: Bookly Bookly · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Hostinger Migrator plugin <= 1.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-95587.md)
  `CVE-2026-95587` · CVE record: Hostinger Hostinger Migrator · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Simply Schedule Appointments plugin <= 1.6.12.31 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-94673.md)
  `CVE-2026-94673` · CVE record: NSquared Simply Schedule Appointments · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Safe SVG plugin <= 2.5.0 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-94672.md)
  `CVE-2026-94672` · CVE record: 10up Safe SVG · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress FormGent plugin <= 1.12.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-94499.md)
  `CVE-2026-94499` · CVE record: wpWax FormGent · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Business Directory plugin <= 6.4.27 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-94173.md)
  `CVE-2026-94173` · CVE record: Strategy11 Team Business Directory · CVSS 5.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress GravityExport Lite for Gravity Forms plugin <= 2.7.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-94120.md)
  `CVE-2026-94120` · CVE record: GravityKit GravityExport Lite for Gravity Forms · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Simply Schedule Appointments plugin <= 1.6.12.29 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-94074.md)
  `CVE-2026-94074` · CVE record: NSquared Simply Schedule Appointments · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Flexible PDF Coupons plugin <= 1.14.11 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-62081.md)
  `CVE-2026-62081` · CVE record: wpdesk Flexible PDF Coupons · CVSS 5.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Authentication Bypass in sogo_yhn](https://agentprime.io/advisories/CVE-2026-74865.md)
  `CVE-2026-74865` · CVE record: YunoHost-Apps sogo_yhn · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Authentication Bypass in sogo_yhn](https://agentprime.io/advisories/CVE-2026-74864.md)
  `CVE-2026-74864` · CVE record: YunoHost-Apps sogo_yhn · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Editor can forge file-provisioning provenance on dashboards via the dashboard API](https://agentprime.io/advisories/CVE-2026-13720.md)
  `CVE-2026-13720` · CVE record: Grafana Grafana OSS and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control, CWE-345
- [Alert rules in restricted folders disclosed via the alert rules list API](https://agentprime.io/advisories/CVE-2026-13719.md)
  `CVE-2026-13719` · CVE record: Grafana Grafana Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure, Broken access control
- [WordPress WPMobile.App plugin <= 11.83 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-96342.md)
  `CVE-2026-96342` · CVE record: Amauri.IO WPMobile.App · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [MISP Tag Collection Save Allows Privilege Escalation via Sibling Model Injection](https://agentprime.io/advisories/CVE-2026-103239.md)
  `CVE-2026-103239` · CVE record: MISP MISP · CVSS 8.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [MISP: Nested Model Alias Key Bypasses Sanitization to Modify Cross-Tenant Rows](https://agentprime.io/advisories/CVE-2026-103237.md)
  `CVE-2026-103237` · CVE record: MISP MISP · CVSS 8.3 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control, CWE-20
- [MISP Event Delegation Mass Assignment Allows Retargeting Delegation to Arbitrary Events](https://agentprime.io/advisories/CVE-2026-103235.md)
  `CVE-2026-103235` · CVE record: MISP MISP · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Moodle: missing capability check allows unauthorised grade penalty recalculation](https://agentprime.io/advisories/CVE-2026-102584.md)
  `CVE-2026-102584` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Moodle: incorrect capability check in ai generate image web service](https://agentprime.io/advisories/CVE-2026-102583.md)
  `CVE-2026-102583` · CVE record · CVSS 2.7 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Moodle: manual enrolment page accessible when plugin disabled](https://agentprime.io/advisories/CVE-2026-102582.md)
  `CVE-2026-102582` · CVE record · CVSS 2.2 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Media Library Organizer 2.0.4 - 2.1.3 - Contributor+ Arbitrary Taxonomy Term Creation](https://agentprime.io/advisories/CVE-2026-94297.md)
  `CVE-2026-94297` · CVE record: Unknown Media Library Organizer · CVSS 2.7 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [InPost for WooCommerce 1.7.5 - 1.9.7 - Unauthenticated Order Status Forgery via Shipment Webhook](https://agentprime.io/advisories/CVE-2026-93580.md)
  `CVE-2026-93580` · CVE record: Unknown InPost PL · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Robin Image Optimizer < 2.0.8 - Subscriber+ Plugin Settings Disclosure via fy_ajax](https://agentprime.io/advisories/CVE-2026-89190.md)
  `CVE-2026-89190` · CVE record: Unknown Robin Image Optimizer · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Vayu X < 1.0.6 - Subscriber+ Arbitrary WordPress.org Plugin Installation and Activation](https://agentprime.io/advisories/CVE-2026-88797.md)
  `CVE-2026-88797` · CVE record: Unknown Vayu X · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [All in One Files Upload for WooCommerce < 2.0.17 - Subscriber+ Arbitrary Plugin Settings Update](https://agentprime.io/advisories/CVE-2026-85576.md)
  `CVE-2026-85576` · CVE record: Unknown All in One Files Upload · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WP User Frontend 2.5.8 - 4.3.11 - Unauthenticated Account Creation with Registration Disabled](https://agentprime.io/advisories/CVE-2026-75824.md)
  `CVE-2026-75824` · CVE record: Unknown User Frontend · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in Pexip Infinity](https://agentprime.io/advisories/CVE-2026-103105.md)
  `CVE-2026-103105` · CVE record: Pexip Infinity · CVSS 8.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [gedelumbung HospitalManagement Configuration sistem.php simpan improper authorization](https://agentprime.io/advisories/CVE-2026-102846.md)
  `CVE-2026-102846` · CVE record: gedelumbung HospitalManagement · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Privilege escalation, Broken access control
- [gedelumbung HospitalManagement HTTP Response index.php error_reporting information disclosure](https://agentprime.io/advisories/CVE-2026-102845.md)
  `CVE-2026-102845` · CVE record: gedelumbung HospitalManagement · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Information disclosure, Broken access control
- [gedelumbung HospitalManagement laporan_data_pasien.php detail authorization](https://agentprime.io/advisories/CVE-2026-102844.md)
  `CVE-2026-102844` · CVE record: gedelumbung HospitalManagement · CVSS 5.1 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [gedelumbung HospitalManagement KCFinder File Manager app_user_login_model.php cekUserLogin unrestricted upload](https://agentprime.io/advisories/CVE-2026-102842.md)
  `CVE-2026-102842` · CVE record: gedelumbung HospitalManagement · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control, Unrestricted file upload
- [AiSOC 10.0.0 before 12.0.0 Unauthorized Tenant Access via MSSP](https://agentprime.io/advisories/CVE-2026-103054.md)
  `CVE-2026-103054` · CVE record: beenuar AiSOC · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [DB-GPT v0.8.0 sandbox API silently falls back to LocalRuntime and executes code on host.](https://agentprime.io/advisories/CVE-2026-51869.md)
  `CVE-2026-51869` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [agentgpt v.1.0.0 is vulnerable to Incorrect Access Control in next/src/server/api/routers/agentRouter.ts.](https://agentprime.io/advisories/CVE-2026-51867.md)
  `CVE-2026-51867` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Fireware OS Authorization Bypass in SAML Login Allows Unauthorized SSLVPN Access](https://agentprime.io/advisories/CVE-2026-86101.md)
  `CVE-2026-86101` · CVE record: WatchGuard Fireware OS · CVSS 7.2 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant B](https://agentprime.io/advisories/CVE-2026-90441.md)
  `CVE-2026-90441` · CVE record: WatchGuard Fireware OS · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Information disclosure, Denial of service, Broken access control
- [Fireware OS Improper Authorization in Access Portal Reverse Proxy](https://agentprime.io/advisories/CVE-2026-86105.md)
  `CVE-2026-86105` · CVE record: WatchGuard Fireware OS · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal, Broken access control, CWE-176
- [Fireware OS Missing Authorization in wgagent Management API Allows Denial of Service - Variant A](https://agentprime.io/advisories/CVE-2026-86136.md)
  `CVE-2026-86136` · CVE record: WatchGuard Fireware OS · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Path traversal, Memory corruption, Broken access control
- [Library panel can be moved into a folder without library panel create permission](https://agentprime.io/advisories/CVE-2026-81842.md)
  `CVE-2026-81842` · CVE record: Grafana Grafana Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect Permission Assignment for Critical Resource in Viidure Dashcam Android Application](https://agentprime.io/advisories/CVE-2026-94204.md)
  `CVE-2026-94204` · CVE record: Viidure Dashcam Android Application · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Paused shared dashboard access tokens still expose data source configuration](https://agentprime.io/advisories/CVE-2026-81841.md)
  `CVE-2026-81841` · CVE record: Grafana Grafana Enterprise and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [SurrealDB before 3.3.0 Cross-Tenant Access via Headers](https://agentprime.io/advisories/CVE-2026-102876.md)
  `CVE-2026-102876` · CVE record: surrealdb surrealdb · CVSS 8.6 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-102330.md)
  `CVE-2026-102330` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-102327.md)
  `CVE-2026-102327` · CVE record: Google Chrome · CVSS 7.5 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-102310.md)
  `CVE-2026-102310` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-102320.md)
  `CVE-2026-102320` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Liberu CRM 0.9.1 < 10.0.0 Broken Access Control via TeamPolicy::addTeamMember()](https://agentprime.io/advisories/CVE-2026-61519.md)
  `CVE-2026-61519` · CVE record: Liberu Software Liberu CRM · CVSS 8.7 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [adm-zip extraction preserves SUID/SGID bits from untrusted ZIPs -> local privilege escalation](https://agentprime.io/advisories/GHSA-j5f4-cc29-5x44.md)
  `GHSA-j5f4-cc29-5x44`, `CVE-2026-102282` · npm `adm-zip`: affected `<0.6.1`, fixed in `0.6.1` · CVSS 7.1 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [IBM i is Affected By An Incorrect Permission Assignment Vulnerability in Network Authentication Service \[\]](https://agentprime.io/advisories/CVE-2026-84414.md)
  `CVE-2026-84414` · CVE record: IBM i · CVSS 7.8 High · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95340.md)
  `CVE-2026-95340` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95296.md)
  `CVE-2026-95296` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95342.md)
  `CVE-2026-95342` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95368.md)
  `CVE-2026-95368` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95352.md)
  `CVE-2026-95352` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-95292.md)
  `CVE-2026-95292` · CVE record: Google Chrome · CVSS 4.8 Medium · Not analysed yet · Published 29 Sept 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTA5LTI5VDE3OjMxOjU3LjIzOTAwMFoiLCJDVkUtMjAyNi05NTI5MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTA5LTMwVDEyOjI3OjQ5Ljk4NTAwMFoiLCJDVkUtMjAyNi05NzA2NiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTA5LTMwVDEyOjI3OjQ5Ljk4NTAwMFoiLCJDVkUtMjAyNi05NzA2NiJd>. Everything for agents: <https://agentprime.io/llms.txt>.