# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-56952.md)
  `CVE-2026-56952` · CVE record: Google Android · CVSS 6.7 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-0198.md)
  `CVE-2026-0198` · CVE record: Google Android · CVSS 4.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Missing authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2026-105488.md)
  `CVE-2026-105488` · CVE record: Devolutions Server · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Payload didn't enforce field-level password update restrictions](https://agentprime.io/advisories/GHSA-fx49-4h83-wjv9.md)
  `GHSA-fx49-4h83-wjv9`, `CVE-2026-105855` · npm `payload`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 7.6 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Payload vulnerable to API key disclosure through ordinary document reads](https://agentprime.io/advisories/GHSA-238x-w2j9-gwwr.md)
  `GHSA-238x-w2j9-gwwr`, `CVE-2026-105849` · npm `payload`: affected `>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 7.7 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure, Broken access control
- [Payload relationship-query authorization bypass](https://agentprime.io/advisories/GHSA-7c34-32v3-j575.md)
  `GHSA-7c34-32v3-j575`, `CVE-2026-105852` · npm `payload`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [SPIP Crayons Plugin < 3.5.0 Authorization Bypass RCE](https://agentprime.io/advisories/CVE-2026-104070.md)
  `CVE-2026-104070` · CVE record: SPIP SPIP Crayons Plugin · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Payload: Field access control bypass on auth collections](https://agentprime.io/advisories/CVE-2026-105851.md)
  `CVE-2026-105851` · CVE record: payloadcms payload · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Payload: Insufficient Access Control in Stripe REST Proxy](https://agentprime.io/advisories/GHSA-r9v2-gg2j-22q5.md)
  `GHSA-r9v2-gg2j-22q5`, `CVE-2026-105848` · npm `@payloadcms/plugin-stripe`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 6.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control, CWE-749
- [Payload: Improper access control for MCP API keys](https://agentprime.io/advisories/GHSA-2q76-m6w6-qgc6.md)
  `GHSA-2q76-m6w6-qgc6`, `CVE-2026-105806` · npm `@payloadcms/plugin-mcp`: affected `>=3.61.0, <3.88.0`, fixed in `3.88.0` · CVSS 8.6 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Payload: Polymorphic join queries could disclose hidden fields](https://agentprime.io/advisories/GHSA-fpww-c55p-cjv6.md)
  `GHSA-fpww-c55p-cjv6`, `CVE-2026-105847` · npm `payload`: affected `>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure, Broken access control
- [Payload: Sort queries could expose protected field information](https://agentprime.io/advisories/GHSA-9g87-32v6-3c2r.md)
  `GHSA-9g87-32v6-3c2r`, `CVE-2026-105805` · npm `payload`: affected `<3.88.0 || >=4.0.0-canary.0, <4.0.0-canary.27`, fixed in `3.88.0`, `4.0.0-canary.27` · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure, Broken access control
- [Missing authorization in Dell Container Storage Modules](https://agentprime.io/advisories/CVE-2026-63691.md)
  `CVE-2026-63691` · CVE record: Dell Container Storage Modules · CVSS 6.1 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [SimpleChat: Command injection via authorization-gate ordering flaw (arbitrary process spawn through MCP stdio transport)](https://agentprime.io/advisories/CVE-2026-105797.md)
  `CVE-2026-105797` · CVE record: microsoft simplechat · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Command injection, Broken access control
- [Mooncake Store through 0.3.13.post1 Missing Authorization via NotifyOffloadSuccess RPC](https://agentprime.io/advisories/CVE-2026-106041.md)
  `CVE-2026-106041` · CVE record: kvcache-ai Mooncake · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Mooncake Store through 0.3.13.post1 Missing Authorization via EvictDiskReplica RPC](https://agentprime.io/advisories/CVE-2026-106040.md)
  `CVE-2026-106040` · CVE record: kvcache-ai Mooncake · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Mooncake Store through 0.3.13.post1 Missing Authorization in Replication Task RPC](https://agentprime.io/advisories/CVE-2026-106039.md)
  `CVE-2026-106039` · CVE record: kvcache-ai Mooncake · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Privilege abuse in model formsets with editable primary keys](https://agentprime.io/advisories/CVE-2026-87975.md)
  `CVE-2026-87975` · CVE record: djangoproject Django · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [QloApps through 1.7.0 Authorization Bypass via ajaxProcessBulkUpdateRooms](https://agentprime.io/advisories/CVE-2026-105836.md)
  `CVE-2026-105836` · CVE record: Webkul QloApps · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress Delete All Comments of wordpress plugin <= 7.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-105059.md)
  `CVE-2026-105059` · CVE record: royalnavneet Delete All Comments of wordpress · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress picu plugin <= 3.10.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-104406.md)
  `CVE-2026-104406` · CVE record: picu picu · CVSS 7.3 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress PowerPress Podcasting plugin <= 11.17.9 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-104387.md)
  `CVE-2026-104387` · CVE record: blubrry PowerPress Podcasting · CVSS 7.2 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress WPO365 plugin <= 44.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-102915.md)
  `CVE-2026-102915` · CVE record: Marco van Wieren WPO365 · CVSS 8.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress BEAR plugin <= 1.2.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-95526.md)
  `CVE-2026-95526` · CVE record: RealMag777 BEAR · CVSS 7.3 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress Progress Planner plugin <= 1.10.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62072.md)
  `CVE-2026-62072` · CVE record: Progress Planner Progress Planner · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress Sermon'e plugin <= 1.0.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-48199.md)
  `CVE-2026-48199` · CVE record: Beplusthemes Sermon'e · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress Easy Digital Downloads plugin <= 3.7.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-42638.md)
  `CVE-2026-42638` · CVE record: Awesomemotive Easy Digital Downloads · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Settings Change vulnerability](https://agentprime.io/advisories/CVE-2026-42637.md)
  `CVE-2026-42637` · CVE record: Payplug PayPlug for WooCommerce (Official) · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress WXD Backup Lite plugin <= 1.0.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-41560.md)
  `CVE-2026-41560` · CVE record: wxdlabs WXD Backup Lite · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress TrueBooker plugin <= 1.2.9 - Settings Change vulnerability](https://agentprime.io/advisories/CVE-2026-39798.md)
  `CVE-2026-39798` · CVE record: ThemetechMount TrueBooker · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress Advanced Posts Listing – Show Post List Easily plugin <= 1.0.8 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39796.md)
  `CVE-2026-39796` · CVE record: Flipper Code – WordPress Development Company Advanced Posts Listing – Show Post List Easily · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress WooCommerce Multivendor Marketplace – REST API plugin <= 1.6.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39794.md)
  `CVE-2026-39794` · CVE record: WC Lovers WooCommerce Multivendor Marketplace – REST API · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress 10Web Social Photo Feed plugin <= 1.4.35 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39787.md)
  `CVE-2026-39787` · CVE record: 10Web 10Web Social Photo Feed · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress Autoship Cloud for WooCommerce Subscription Products plugin <= 2.17.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39762.md)
  `CVE-2026-39762` · CVE record: Patterns In The Cloud Autoship Cloud for WooCommerce Subscription Products · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress Wappointment plugin <= 2.7.7 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-39756.md)
  `CVE-2026-39756` · CVE record: Wappointment team Wappointment · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress PayPlug for WooCommerce (Official) plugin <= 3.1.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39751.md)
  `CVE-2026-39751` · CVE record: Payplug PayPlug for WooCommerce (Official) · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress App for Cloudflare® plugin <= 1.10.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39749.md)
  `CVE-2026-39749` · CVE record: digitalpoint App for Cloudflare® · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress Wise Chat plugin <= 3.4.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39730.md)
  `CVE-2026-39730` · CVE record: Marcin Wise Chat · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress ECPay Ecommerce for WooCommerce plugin <= 1.1.2606090 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-32578.md)
  `CVE-2026-32578` · CVE record: techsupport ECPay Ecommerce for WooCommerce · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress WP2LEADS plugin <= 3.5.7 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-25433.md)
  `CVE-2026-25433` · CVE record: Tobias @Saleswonder.biz WP2LEADS · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Missing Authorization in Core](https://agentprime.io/advisories/CVE-2026-25267.md)
  `CVE-2026-25267` · CVE record: Qualcomm, Inc. Snapdragon · CVSS 7.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [File Media Renamer <= 1.3 - Author+ Arbitrary File Rename via save-attachment-compat](https://agentprime.io/advisories/CVE-2026-94278.md)
  `CVE-2026-94278` · CVE record: Unknown File Media Renamer · CVSS 5.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Fast Courier <= 5.2.3 - Unauthenticated Order Fulfillment Update via order-status-update REST Endpoint](https://agentprime.io/advisories/CVE-2026-89289.md)
  `CVE-2026-89289` · CVE record: Unknown Fast Courier · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [elegro Crypto Payment <= 1.0.1 - Unauthenticated Arbitrary Order Status Change via IPN Callback](https://agentprime.io/advisories/CVE-2026-94299.md)
  `CVE-2026-94299` · CVE record: Unknown elegro Crypto Payment · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress Fluent Affiliate Pro plugin <= 1.6.4 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39789.md)
  `CVE-2026-39789` · CVE record: WP Manage Ninja Fluent Affiliate Pro · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress Morning for WooCommerce plugin <= 2.4.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39723.md)
  `CVE-2026-39723` · CVE record: Green Invoice Morning for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress WDS MCP Content Manager plugin <= 3.10.4 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39599.md)
  `CVE-2026-39599` · CVE record: wallstrdev WDS MCP Content Manager · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress IATO MCP plugin <= 1.12.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-32582.md)
  `CVE-2026-32582` · CVE record: iatoai IATO MCP · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress Faktur Pro for WooCommerce plugin <= 3.2.2 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-32576.md)
  `CVE-2026-32576` · CVE record: ZWEISCHNEIDER Faktur Pro for WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [WordPress FluentBooking Pro plugin < 2.5.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-105072.md)
  `CVE-2026-105072` · CVE record: WP Manage Ninja FluentBooking Pro · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [SourceCodester Drug Recommendation System cross-site request forgery](https://agentprime.io/advisories/CVE-2026-105706.md)
  `CVE-2026-105706` · CVE record: SourceCodester Drug Recommendation System · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [PHPGurukul User Registration & Login and User Management System Change Password change-password.php authorization](https://agentprime.io/advisories/CVE-2026-105703.md)
  `CVE-2026-105703` · CVE record: PHPGurukul User Registration & Login and User Management System · CVSS 5.1 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [jishenghua jshERP Financial Receipt Update AccountHeadService.java updateAccountHeadAndDetail improper authorization](https://agentprime.io/advisories/CVE-2026-105621.md)
  `CVE-2026-105621` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation, Broken access control
- [chillzhuang SpringBlade User Detail Endpoint RoleController.java improper authorization](https://agentprime.io/advisories/CVE-2026-105611.md)
  `CVE-2026-105611` · CVE record: chillzhuang SpringBlade · CVSS 5.1 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation, Broken access control
- [chillzhuang SpringBlade Parameter Submit Management ParamController.java improper authorization](https://agentprime.io/advisories/CVE-2026-105610.md)
  `CVE-2026-105610` · CVE record: chillzhuang SpringBlade · CVSS 5.1 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation, Broken access control
- [PickMall Lilishop Buyer Invoice List receipt authorization](https://agentprime.io/advisories/CVE-2026-105572.md)
  `CVE-2026-105572` · CVE record: PickMall Lilishop · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [PickMall Lilishop Mobile Binding bindMobile improper authorization](https://agentprime.io/advisories/CVE-2026-105571.md)
  `CVE-2026-105571` · CVE record: PickMall Lilishop · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Docling: \`enable_local_fetch\` is not enforced in HTML browser-rendering mode](https://agentprime.io/advisories/GHSA-q43m-vhcp-mhvm.md)
  `GHSA-q43m-vhcp-mhvm`, `CVE-2026-105750`, `PYSEC-2026-4196`, `PYSEC-2026-4215` · PyPI `docling` and 1 more: affected `>=2.82.0, <2.118.1`, fixed in `2.118.1` · CVSS 5.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure, Broken access control
- [vLLM: Scale-out disaggregated multimodal transport trusts caller-supplied features](https://agentprime.io/advisories/GHSA-ph72-cqr5-qpp7.md)
  `GHSA-ph72-cqr5-qpp7`, `CVE-2026-105754`, `PYSEC-2026-4309` · PyPI `vllm`: affected `<0.30.0`, fixed in `0.30.0` · CVSS 6.5 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Denial of service, Broken access control, Information disclosure, CWE-20
- [vLLM: Flash late-interaction scoring caches query embeddings under a caller-controlled request id — cross-request integrity break and induced errors on \`/score\` and \`/rerank\`](https://agentprime.io/advisories/GHSA-2phq-3phc-84px.md)
  `GHSA-2phq-3phc-84px`, `CVE-2026-105755`, `PYSEC-2026-4198` · PyPI `vllm`: affected `<0.30.0`, fixed in `0.30.0` · CVSS 4.2 Medium · Not analysed yet · Published 5 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTA1VDIzOjQyOjM5LjAwMDAwMFoiLCJHSFNBLTJwaHEtM3BoYy04NHB4Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTA2VDE4OjIxOjExLjM2NDAwMFoiLCJDVkUtMjAyNi04NjM2MSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTA2VDE4OjIxOjExLjM2NDAwMFoiLCJDVkUtMjAyNi04NjM2MSJd>. Everything for agents: <https://agentprime.io/llms.txt>.