# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress Kit (formerly ConvertKit) for WooCommerce plugin <= 2.2.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-105421.md)
  `CVE-2026-105421` · CVE record: Kit Kit (formerly ConvertKit) for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress Polylang plugin <= 3.8.7 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-39783.md)
  `CVE-2026-39783` · CVE record: WP SYNTEX Polylang · CVSS 4.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-103684.md)
  `CVE-2026-103684` · CVE record: Arraytics WP Event Solution · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress Fluent Forms Pro Add On Pack plugin <= 6.2.13 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-94669.md)
  `CVE-2026-94669` · CVE record: WP ManageNinja LLC Fluent Forms Pro Add On Pack · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress WP Dummy Content Generator plugin <= 4.0.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39763.md)
  `CVE-2026-39763` · CVE record: Deepak Anand WP Dummy Content Generator · CVSS 4.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress Starter Templates plugin <= 4.7.7 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39721.md)
  `CVE-2026-39721` · CVE record: Brainstorm Force Starter Templates · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Totolink A3002MU Authentication Check boa sub_40FCFC improper authorization](https://agentprime.io/advisories/CVE-2026-105284.md)
  `CVE-2026-105284` · CVE record: Totolink A3002MU · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation, Broken access control
- [WordPress PowerPress Podcasting plugin <= 11.17.9 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-104388.md)
  `CVE-2026-104388` · CVE record: Blubrry Podcasting PowerPress Podcasting · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-103079.md)
  `CVE-2026-103079` · CVE record: Ahmad JS Help Desk · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress Event Tickets plugin <= 5.30.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-104675.md)
  `CVE-2026-104675` · CVE record: Liquid Web / StellarWP Event Tickets · CVSS 4.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress Name Directory plugin <= 1.34.2 - Arbitrary Shortcode Execution vulnerability](https://agentprime.io/advisories/CVE-2026-104397.md)
  `CVE-2026-104397` · CVE record: Jeroen Peters Name Directory · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress WP Mailster plugin <= 1.9.0.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-105055.md)
  `CVE-2026-105055` · CVE record: WP Mailster WP Mailster · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress WP Admin Audit plugin <= 1.2.17 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-105062.md)
  `CVE-2026-105062` · CVE record: Brandtoss WP Admin Audit · CVSS 4.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress JS Help Desk plugin <= 4.0.0 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-103078.md)
  `CVE-2026-103078` · CVE record: Ahmad JS Help Desk · CVSS 4.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress WP VR plugin <= 9.1.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-104386.md)
  `CVE-2026-104386` · CVE record: WPFunnels Team WP VR · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [File Uploads Addon for WooCommerce 1.7.2 - 1.7.5 - Unauthenticated Customer Uploaded File Disclosure](https://agentprime.io/advisories/CVE-2026-78371.md)
  `CVE-2026-78371` · CVE record: Unknown File Uploads Addon for WooCommerce · CVSS 5.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [File Uploads Addon for WooCommerce <= 1.7.6 - Unauthenticated Direct File Access](https://agentprime.io/advisories/CVE-2026-13607.md)
  `CVE-2026-13607` · CVE record: Unknown File Uploads Addon for WooCommerce · CVSS 5.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [UPI QR Code Payment Gateway <= 1.4.3 - Unauthenticated Cross-Order Payment-Status Forgery](https://agentprime.io/advisories/CVE-2026-84169.md)
  `CVE-2026-84169` · CVE record: Unknown UPI QR Code Payment Gateway · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: token introspection audience bypass via dynamic client registration](https://agentprime.io/advisories/CVE-2026-105306.md)
  `CVE-2026-105306` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Jeebase UserService info updateUser dynamically-determined object attributes](https://agentprime.io/advisories/CVE-2026-105180.md)
  `CVE-2026-105180` · CVE record: Jeebase · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control, CWE-913
- [Missing authorization in MediaTek, Inc. MediaTek chipset](https://agentprime.io/advisories/CVE-2026-20535.md)
  `CVE-2026-20535` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 6.7 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Feehi CMS 2.1.1 is vulnerable to Incorrect Access Control.](https://agentprime.io/advisories/CVE-2026-95263.md)
  `CVE-2026-95263` · CVE record · CVSS 7.2 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [kishor-23 food-waste-management-system Role Attribute admin.php authorization](https://agentprime.io/advisories/CVE-2026-105171.md)
  `CVE-2026-105171` · CVE record: kishor-23 food-waste-management-system · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Broken access control
- [devopspolis secrets-replicator AssumeRole handler.py process_single_secret permission assignment](https://agentprime.io/advisories/CVE-2026-105165.md)
  `CVE-2026-105165` · CVE record: devopspolis secrets-replicator · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Broken access control, CWE-275
- [ZITADEL before 3.4.15 and 4.17.1 Cross-Organization Account Takeover via Passkey Enrollment](https://agentprime.io/advisories/CVE-2026-105209.md)
  `CVE-2026-105209` · CVE record: zitadel zitadel · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 4 Oct 2026 · Tags: Broken access control
- [ZITADEL before 4.17.3 Cross-Organization Authentication Method Enumeration via User Service](https://agentprime.io/advisories/CVE-2026-105206.md)
  `CVE-2026-105206` · CVE record: zitadel zitadel · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Broken access control
- [Weaviate Verba generate_stream Endpoint util.py get_environment information disclosure](https://agentprime.io/advisories/CVE-2026-105145.md)
  `CVE-2026-105145` · CVE record: Weaviate Verba · CVSS 6.9 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Information disclosure, Broken access control
- [User Private Files < 2.2.0 - Unauthenticated Private File Disclosure via .htaccess Rewrite Rule Bypass (Multisite)](https://agentprime.io/advisories/CVE-2026-97332.md)
  `CVE-2026-97332` · CVE record: Unknown User Private Files · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Broken access control
- [Razorpay for WooCommerce < 4.8.8 - Unauthenticated Order Shipping Modification via IDOR](https://agentprime.io/advisories/CVE-2026-104118.md)
  `CVE-2026-104118` · CVE record: Unknown Razorpay for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Broken access control
- [Omega Solution CoinEx Crypto Support Ticket API customer information disclosure](https://agentprime.io/advisories/CVE-2026-105098.md)
  `CVE-2026-105098` · CVE record: Omega Solution CoinEx Crypto · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Information disclosure, Broken access control
- [Omega Solution CoinEx Crypto Customer Information API customer-currency authorization](https://agentprime.io/advisories/CVE-2026-105097.md)
  `CVE-2026-105097` · CVE record: Omega Solution CoinEx Crypto · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Broken access control
- [mayswind ezBookkeeping 1.2.0 before 2.0.1 Privilege Escalation via Token Refresh Endpoint](https://agentprime.io/advisories/CVE-2026-105131.md)
  `CVE-2026-105131` · CVE record: mayswind ezBookkeeping · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Broken access control
- [Omega Solution CoinEx Crypto Customer Profile API customer authorization](https://agentprime.io/advisories/CVE-2026-105096.md)
  `CVE-2026-105096` · CVE record: Omega Solution CoinEx Crypto · CVSS 5.3 Medium · Not analysed yet · Published 4 Oct 2026 · Tags: Broken access control
- [LaraDashboard before 1.4.8 Incorrect Authorization Exposes Secrets via Settings API](https://agentprime.io/advisories/CVE-2026-105129.md)
  `CVE-2026-105129` · CVE record: laradashboard laradashboard · CVSS 7.1 High · Not analysed yet · Published 3 Oct 2026 · Tags: Broken access control
- [WordPress Ultimate Member plugin <= 2.13.1 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-96451.md)
  `CVE-2026-96451` · CVE record: Ultimate Member Ultimate Member · CVSS 8.8 High · Not analysed yet · Published 3 Oct 2026 · Tags: Broken access control
- [OpenAM before 16.1.3 Improper Authorization in Delegated Session-Destroy Realm Scoping](https://agentprime.io/advisories/CVE-2026-105121.md)
  `CVE-2026-105121` · CVE record: OpenIdentityPlatform OpenAM · CVSS 6.9 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Broken access control
- [OpenAM before 16.1.3 PKCE Enforcement Bypass via OAuth 2.0 Hybrid Flows](https://agentprime.io/advisories/CVE-2026-105119.md)
  `CVE-2026-105119` · CVE record: OpenIdentityPlatform OpenAM · CVSS 7.6 High · Not analysed yet · Published 3 Oct 2026 · Tags: Broken access control
- [MLS external commit can remove an arbitrary group member](https://agentprime.io/advisories/CVE-2026-71890.md)
  `CVE-2026-71890` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA · CVSS 8.7 High · Not analysed yet · Published 3 Oct 2026 · Tags: Broken access control
- [OpenPGP certification accepted from a subkey without certification authority](https://agentprime.io/advisories/CVE-2026-71886.md)
  `CVE-2026-71886` · CVE record: Legion of the Bouncy Castle Inc. BC-JAVA · CVSS 8.2 High · Not analysed yet · Published 3 Oct 2026 · Tags: Broken access control
- [WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete](https://agentprime.io/advisories/CVE-2026-11601.md)
  `CVE-2026-11601` · CVE record: arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System · CVSS 5.3 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Broken access control
- [Nelio Content <= 4.5.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Reusable Message Deletion via 'id' Parameter](https://agentprime.io/advisories/CVE-2026-94505.md)
  `CVE-2026-94505` · CVE record: nelio Nelio Content – Editorial Calendar & Social Media Auto-Posting · CVSS 8.1 High · Not analysed yet · Published 3 Oct 2026 · Tags: Broken access control
- [Mailchimp for WooCommerce < 6.3 - Unauthenticated Abandoned Cart Modification and Deletion](https://agentprime.io/advisories/CVE-2026-92437.md)
  `CVE-2026-92437` · CVE record: Unknown Mailchimp for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Broken access control
- [Photo Reviews for WooCommerce <= 1.2.30 - Missing Authorization to Unauthenticated Arbitrary Post Deletion via 'wcpr_image_upload_id' Parameter](https://agentprime.io/advisories/CVE-2026-101923.md)
  `CVE-2026-101923` · CVE record: villatheme Photo Reviews for WooCommerce · CVSS 8.1 High · Not analysed yet · Published 3 Oct 2026 · Tags: Broken access control
- [Simple Membership <= 4.8.3 - Missing Authorization to Unauthenticated Account Takeover and Sensitive Information Disclosure via 'email' Parameter on Activation Endpoints](https://agentprime.io/advisories/CVE-2026-97337.md)
  `CVE-2026-97337` · CVE record: wpinsider-1 Simple Membership · CVSS 7.5 High · Not analysed yet · Published 3 Oct 2026 · Tags: Broken access control
- [Alt Text AI <= 1.10.41 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Post Content Modification via atai_enrich_post_content AJAX Action](https://agentprime.io/advisories/CVE-2026-91108.md)
  `CVE-2026-91108` · CVE record: alttextai Alt Text AI – Automatically generate image alt text for SEO and accessibility · CVSS 4.3 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Broken access control
- [Helpdesk Support Ticket System for WooCommerce <= 2.1.6 - Insecure Direct Object Reference to Authenticated (Subscriber+) Arbitrary Ticket Response Deletion via 'id' Parameter](https://agentprime.io/advisories/CVE-2026-11399.md)
  `CVE-2026-11399` · CVE record: wpcodefactory Helpdesk Support Ticket System for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Broken access control
- [Ultimate Member <= 2.13.1 - Missing Authorization to Unauthenticated Sensitive Profile Field Disclosure via Member Directory Field Privacy Bypass](https://agentprime.io/advisories/CVE-2026-93428.md)
  `CVE-2026-93428` · CVE record: ultimatemember Ultimate Member – User Profile, Registration, Login, Member Directory, Content Restriction & Membership Plugin · CVSS 7.5 High · Not analysed yet · Published 3 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Formbricks](https://agentprime.io/advisories/CVE-2026-105090.md)
  `CVE-2026-105090` · CVE record: Formbricks Formbricks · CVSS 5.1 Medium · Not analysed yet · Published 3 Oct 2026 · Tags: Broken access control
- [UVdesk support-center-bundle before 1.1.3.3 IDOR via rateTicket Ticket Rating Endpoint](https://agentprime.io/advisories/CVE-2026-105029.md)
  `CVE-2026-105029` · CVE record: uvdesk support-center-bundle and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [SiYuan: 17 block metadata/content endpoints in kernel/api/block.go have zero publish-access filtering, reachable by anonymous publish-mode readers](https://agentprime.io/advisories/GHSA-4vpg-gwqq-w44c.md)
  `GHSA-4vpg-gwqq-w44c`, `CVE-2026-74904`, `GO-2026-6654` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260804015139-bd067a4fe9b2`, fixed in `0.0.0-20260804015139-bd067a4fe9b2` · CVSS 8.7 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control, CWE-204
- [Vibe-Trading FastAPI endpoints permit unauthenticated access, file upload, and an RCE chain](https://agentprime.io/advisories/GHSA-v2f8-6655-7grj.md)
  `GHSA-v2f8-6655-7grj`, `CVE-2026-114108` · PyPI `vibe-trading-ai`: affected `>=0.1.0, <0.1.7`, fixed in `0.1.7` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure, Authentication bypass, Unrestricted file upload, Broken access control
- [Trigger.dev: Cross-environment deployment cancel](https://agentprime.io/advisories/GHSA-4672-hwv6-gq62.md)
  `GHSA-4672-hwv6-gq62`, `CVE-2026-114079` · npm `trigger.dev`: affected `<4.5.6`, fixed in `4.5.6` · CVSS 5.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Trigger.dev: Cross-tenant SQL injection in the TSQL query compiler (POST /api/v1/query) via unsanitized window-function name](https://agentprime.io/advisories/GHSA-9q4r-4842-93vw.md)
  `GHSA-9q4r-4842-93vw`, `CVE-2026-114081` · npm `trigger.dev`: affected `<4.5.6`, fixed in `4.5.6` · CVSS 8.3 High · Not analysed yet · Published 2 Oct 2026 · Tags: SQL injection, Broken access control
- [Trigger.dev: V1 coordinator default-secret unauth Socket.IO](https://agentprime.io/advisories/GHSA-gg6r-gp4c-89hp.md)
  `GHSA-gg6r-gp4c-89hp`, `CVE-2026-114088` · npm `trigger.dev`: affected `<4.5.4`, fixed in `4.5.4` · CVSS 8.3 High · Not analysed yet · Published 2 Oct 2026 · Tags: Information disclosure, Hard-coded credentials, Broken access control
- [Trigger.dev: Missing Authentication in Run Replay Action Allows Cross-Organization Task Execution (IDOR)](https://agentprime.io/advisories/GHSA-pp95-gc86-jq6q.md)
  `GHSA-pp95-gc86-jq6q` · npm `trigger.dev`: affected `<4.5.2`, fixed in `4.5.2` · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Forced browsing in Kentico Xperience](https://agentprime.io/advisories/CVE-2026-105046.md)
  `CVE-2026-105046` · CVE record: Kentico Xperience · CVSS 4.3 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [UTMStack < 11.2.16 Missing Authorization via Command WebSocket](https://agentprime.io/advisories/CVE-2026-82041.md)
  `CVE-2026-82041` · CVE record: UTMStack UTMStack · CVSS 6.5 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [@orpc/json-schema: Prototype injection in smart coercion](https://agentprime.io/advisories/CVE-2026-103036.md)
  `CVE-2026-103036` · CVE record: middleapi orpc · CVSS 6.5 Medium · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control, Prototype pollution
- [Phproject < 1.8.7 Missing Authorization via Issues REST API](https://agentprime.io/advisories/CVE-2026-104991.md)
  `CVE-2026-104991` · CVE record: Alanaktion phproject · CVSS 7.1 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control
- [Trigger.dev: Run replay injects a task run into an attacker-chosen environment (cross-tenant write)](https://agentprime.io/advisories/GHSA-qxpp-qjg8-x4jv.md)
  `GHSA-qxpp-qjg8-x4jv`, `CVE-2026-85651` · npm `trigger.dev`: affected `<4.5.2`, fixed in `4.5.2` · CVSS 8.4 High · Not analysed yet · Published 2 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTAyVDE5OjMxOjE3LjAwMDAwMFoiLCJHSFNBLXF4cHAtcWpnOC14NGp2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTA1VDE2OjA2OjUxLjIyODAwMFoiLCJDVkUtMjAyNi0xMDI3NzUiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTA1VDE2OjA2OjUxLjIyODAwMFoiLCJDVkUtMjAyNi0xMDI3NzUiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.