# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Nx daemon and plugin worker sockets are accessible to other local users](https://agentprime.io/advisories/GHSA-w3vv-58gj-gw77.md)
  `GHSA-w3vv-58gj-gw77`, `CVE-2026-104854` · npm `nx`: affected `>=14.6.0, <22.7.9 || >=23.0.0, <23.1.2`, fixed in `22.7.9`, `23.1.2` · CVSS 8.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation, Broken access control
- [OpenClaw: Channel read actions could skip target allowlists](https://agentprime.io/advisories/GHSA-g7fw-3gjp-g5hf.md)
  `GHSA-g7fw-3gjp-g5hf`, `CVE-2026-100582` · npm `@openclaw/feishu` and 3 more: affected `<2026.8.1`, fixed in `2026.8.1` · CVSS 7.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [vm2: NodeVM custom resolution bypasses external path boundaries](https://agentprime.io/advisories/GHSA-5h3f-q97h-ccvc.md)
  `GHSA-5h3f-q97h-ccvc`, `CVE-2026-100721` · npm `vm2`: affected `<3.12.2`, fixed in `3.12.2` · CVSS 9.5 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier](https://agentprime.io/advisories/CVE-2026-105786.md)
  `CVE-2026-105786` · CVE record: laurent22 joplin · CVSS 8.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Authentication bypass, Weak cryptography or TLS, Broken access control
- [Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers](https://agentprime.io/advisories/CVE-2026-105761.md)
  `CVE-2026-105761` · CVE record: langgenius dify · CVSS 7.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [LangGraph SDK custom auth silently ignores actions= on resource decorators](https://agentprime.io/advisories/GHSA-fvww-7h3r-vfhp.md)
  `GHSA-fvww-7h3r-vfhp`, `CVE-2026-104873`, `PYSEC-2026-4240` · PyPI `langgraph-sdk`: affected `>=0.1.45, <0.4.4`, fixed in `0.4.4` · CVSS 7.6 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions](https://agentprime.io/advisories/CVE-2026-103433.md)
  `CVE-2026-103433` · CVE record: Docker Docker Buildx · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)](https://agentprime.io/advisories/CVE-2026-91107.md)
  `CVE-2026-91107` · CVE record: OS4ED openSIS-Classic · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Quay: quay: global read-only superuser can access build trigger write credentials](https://agentprime.io/advisories/CVE-2026-105447.md)
  `CVE-2026-105447` · CVE record: Red Hat Red Hat Quay 3 · CVSS 5.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint](https://agentprime.io/advisories/CVE-2026-77226.md)
  `CVE-2026-77226` · CVE record: Camunda Camunda 7 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command](https://agentprime.io/advisories/CVE-2026-105696.md)
  `CVE-2026-105696` · CVE record: penpot penpot · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session](https://agentprime.io/advisories/CVE-2026-105695.md)
  `CVE-2026-105695` · CVE record: penpot penpot · CVSS 5.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle](https://agentprime.io/advisories/CVE-2026-105693.md)
  `CVE-2026-105693` · CVE record: penpot penpot · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create](https://agentprime.io/advisories/CVE-2026-105692.md)
  `CVE-2026-105692` · CVE record: penpot penpot · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection](https://agentprime.io/advisories/CVE-2026-105687.md)
  `CVE-2026-105687` · CVE record: penpot penpot · CVSS 4.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope](https://agentprime.io/advisories/CVE-2026-105684.md)
  `CVE-2026-105684` · CVE record: penpot penpot · CVSS 4.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Broken access control
- [feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-105389.md)
  `CVE-2026-105389` · CVE record: feelec-yishu feelcrm-os · CVSS 5.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [WordPress WC Ukraine Shipping plugin <= 1.23.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-103337.md)
  `CVE-2026-103337` · CVE record: Kirillbdev WC Ukraine Shipping · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-45524.md)
  `CVE-2026-45524` · CVE record: Google Android · CVSS 8.8 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane](https://agentprime.io/advisories/CVE-2026-105639.md)
  `CVE-2026-105639` · CVE record: makeplane plane · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Authentication bypass, Broken access control
- [WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97303.md)
  `CVE-2026-97303` · CVE record: Apps Mav Scratch & Win – Giveaways and Contests · CVSS 7.6 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-97309.md)
  `CVE-2026-97309` · CVE record: Webful Creations RepairBuddy · CVSS 7.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-97070.md)
  `CVE-2026-97070` · CVE record: CozyThemes Cozy Blocks · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-97305.md)
  `CVE-2026-97305` · CVE record: Themeisle AI Chatbot for WordPress – Hyve Lite · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97304.md)
  `CVE-2026-97304` · CVE record: Arraytics Timetics · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability](https://agentprime.io/advisories/CVE-2026-103085.md)
  `CVE-2026-103085` · CVE record: WP User Manager WP User Manager · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-103086.md)
  `CVE-2026-103086` · CVE record: Stiofan UsersWP · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-102383.md)
  `CVE-2026-102383` · CVE record: VillaTheme Lookzy · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)](https://agentprime.io/advisories/CVE-2026-105637.md)
  `CVE-2026-105637` · CVE record: makeplane plane · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token](https://agentprime.io/advisories/CVE-2026-105635.md)
  `CVE-2026-105635` · CVE record: makeplane plane · CVSS 7.4 High · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Broken access control
- [Plane: Issue Attachment Ownership Hijacking via Missing \`issue_id\` Scope](https://agentprime.io/advisories/CVE-2026-105633.md)
  `CVE-2026-105633` · CVE record: makeplane plane · CVSS 7.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects](https://agentprime.io/advisories/CVE-2026-105632.md)
  `CVE-2026-105632` · CVE record: makeplane plane · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure](https://agentprime.io/advisories/CVE-2026-105631.md)
  `CVE-2026-105631` · CVE record: makeplane plane · CVSS 7.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup](https://agentprime.io/advisories/CVE-2026-105629.md)
  `CVE-2026-105629` · CVE record: makeplane plane · CVSS 7.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-tenant stored XSS in intake enables account takeover](https://agentprime.io/advisories/CVE-2026-104979.md)
  `CVE-2026-104979` · CVE record: makeplane plane · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Cross-site scripting (XSS), Broken access control
- [Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance](https://agentprime.io/advisories/CVE-2026-104978.md)
  `CVE-2026-104978` · CVE record: makeplane plane · CVSS 8.2 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Velociraptor privilege escalation via SysmonLogForward client monitoring artifact](https://agentprime.io/advisories/CVE-2026-78413.md)
  `CVE-2026-78413` · CVE record: Rapid7 Velociraptor · CVSS 5.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints](https://agentprime.io/advisories/CVE-2026-104975.md)
  `CVE-2026-104975` · CVE record: makeplane plane · CVSS 7.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Disabled User Auto-Reactivation on Login](https://agentprime.io/advisories/CVE-2026-104974.md)
  `CVE-2026-104974` · CVE record: makeplane plane · CVSS 8.1 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [SiYuan: /history/\*path and /repo/diff/\*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/\*](https://agentprime.io/advisories/GHSA-3cm4-ccvw-6xr6.md)
  `GHSA-3cm4-ccvw-6xr6`, `CVE-2026-82651`, `GO-2026-6662` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260816034002-035bf9a8c311`, fixed in `0.0.0-20260816034002-035bf9a8c311` · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Broken access control
- [@orpc/zod: Prototype injection in smart coercion](https://agentprime.io/advisories/GHSA-gcgf-fh7c-8gf2.md)
  `GHSA-gcgf-fh7c-8gf2`, `CVE-2026-103918` · npm `@orpc/zod`: affected `<1.14.10`, fixed in `1.14.10` · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control, Prototype pollution
- [Velociraptor Server Metadata update with Insufficient Permission Check](https://agentprime.io/advisories/CVE-2026-78411.md)
  `CVE-2026-78411` · CVE record: Rapid7 Velociraptor · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization](https://agentprime.io/advisories/CVE-2026-104971.md)
  `CVE-2026-104971` · CVE record: makeplane plane · CVSS 8.5 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-Tenant Cycle Issue Hijack via IDOR](https://agentprime.io/advisories/CVE-2026-104969.md)
  `CVE-2026-104969` · CVE record: makeplane plane · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/](https://agentprime.io/advisories/CVE-2026-104968.md)
  `CVE-2026-104968` · CVE record: makeplane plane · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint](https://agentprime.io/advisories/CVE-2026-104967.md)
  `CVE-2026-104967` · CVE record: makeplane plane · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces](https://agentprime.io/advisories/CVE-2026-104966.md)
  `CVE-2026-104966` · CVE record: makeplane plane · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-Tenant Issue Relation Creation via IDOR](https://agentprime.io/advisories/CVE-2026-104965.md)
  `CVE-2026-104965` · CVE record: makeplane plane · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Cross-Workspace Project Modification via Unscoped Project Lookup](https://agentprime.io/advisories/CVE-2026-104964.md)
  `CVE-2026-104964` · CVE record: makeplane plane · CVSS 6.8 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [WatchEvent API streams another organization's live events](https://agentprime.io/advisories/CVE-2026-78412.md)
  `CVE-2026-78412` · CVE record: Rapid7 Velociraptor · CVSS 4.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member](https://agentprime.io/advisories/CVE-2026-104963.md)
  `CVE-2026-104963` · CVE record: makeplane plane · CVSS 4.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Information disclosure, Broken access control
- [Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)](https://agentprime.io/advisories/CVE-2026-104962.md)
  `CVE-2026-104962` · CVE record: makeplane plane · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access](https://agentprime.io/advisories/CVE-2026-104961.md)
  `CVE-2026-104961` · CVE record: makeplane plane · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users](https://agentprime.io/advisories/CVE-2026-104960.md)
  `CVE-2026-104960` · CVE record: makeplane plane · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [onetwothreeneth HospitalManagementSystem Account Administration controller.php update_subaccount improper authorization](https://agentprime.io/advisories/CVE-2026-105382.md)
  `CVE-2026-105382` · CVE record: onetwothreeneth HospitalManagementSystem · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)](https://agentprime.io/advisories/CVE-2026-104955.md)
  `CVE-2026-104955` · CVE record: makeplane plane · CVSS 5.4 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Plane: Cross-Tenant Module Issue Linking via IDOR](https://agentprime.io/advisories/CVE-2026-104894.md)
  `CVE-2026-104894` · CVE record: makeplane plane · CVSS 4.3 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4](https://agentprime.io/advisories/CVE-2026-102779.md)
  `CVE-2026-102779` · CVE record: joomlafry.com TF Content for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4](https://agentprime.io/advisories/CVE-2026-102780.md)
  `CVE-2026-102780` · CVE record: joomlafry.com TF Content for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control
- [Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8](https://agentprime.io/advisories/CVE-2026-102775.md)
  `CVE-2026-102775` · CVE record: phoca.cz Phoca Cart extension for Joomla · CVSS 8.7 High · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTA1VDE2OjA2OjUxLjIyODAwMFoiLCJDVkUtMjAyNi0xMDI3NzUiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTA1VDIzOjQyOjM5LjAwMDAwMFoiLCJHSFNBLTJwaHEtM3BoYy04NHB4Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTA1VDIzOjQyOjM5LjAwMDAwMFoiLCJHSFNBLTJwaHEtM3BoYy04NHB4Il0>. Everything for agents: <https://agentprime.io/llms.txt>.