# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress Modula Image Gallery plugin <= 3.0.11 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-105876.md)
  `CVE-2026-105876` · CVE record: WP Chill Modula Image Gallery · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Apache YuniKorn: Admission control bypass via workload UPDATE operation](https://agentprime.io/advisories/CVE-2026-92393.md)
  `CVE-2026-92393` · CVE record: Apache Software Foundation Apache YuniKorn · CVSS 2.0 Low · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [WordPress Hustle plugin <= 7.8.14.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-103075.md)
  `CVE-2026-103075` · CVE record: WPMU DEV Hustle · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Missing authorization in Veeam Backup and Replication](https://agentprime.io/advisories/CVE-2026-93026.md)
  `CVE-2026-93026` · CVE record: Veeam Backup and Replication · CVSS 6.1 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Missing authorization in Veeam Agent for Windows](https://agentprime.io/advisories/CVE-2026-58068.md)
  `CVE-2026-58068` · CVE record: Veeam Agent for Windows · CVSS 6.8 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Joomla Extension - ordasoft.com - Unauthenticated Destructive CRUD in OrdaSoft Touch Slider < 5.4.6](https://agentprime.io/advisories/CVE-2026-102781.md)
  `CVE-2026-102781` · CVE record: ordasoft.com Touch Slider extension for Joomla · CVSS 6.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Nexi XPay Build <= 7.6.2 - Unauthenticated Payment Completion and Order Key Disclosure](https://agentprime.io/advisories/CVE-2026-82211.md)
  `CVE-2026-82211` · CVE record: Unknown Nexi XPay Build · CVSS 8.2 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [CP Media Player < 1.3.4 - Contributor+ Media Player Settings Update](https://agentprime.io/advisories/CVE-2026-104678.md)
  `CVE-2026-104678` · CVE record: Unknown CP Media Player · CVSS 2.7 Low · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Yaad Sarig Payment Gateway For WC < 2.2.13 - Subscriber+ Arbitrary Order Payment Manipulation via IDOR](https://agentprime.io/advisories/CVE-2026-104651.md)
  `CVE-2026-104651` · CVE record: Unknown Yaad Sarig Payment Gateway For WC · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Academy LMS < 4.0.0 - Subscriber+ Cross-Course Quiz Answer Disclosure via render_quiz_answers](https://agentprime.io/advisories/CVE-2026-104050.md)
  `CVE-2026-104050` · CVE record: Unknown Academy LMS · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Academy LMS < 4.0.0 - Subscriber+ Arbitrary Lesson Content Disclosure via Topic REST Endpoint](https://agentprime.io/advisories/CVE-2026-104049.md)
  `CVE-2026-104049` · CVE record: Unknown Academy LMS · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Frontend Dashboard < 3.0.0 - Subscriber+ Profile and Post Field Deletion via fed_user_profile_delete](https://agentprime.io/advisories/CVE-2026-103681.md)
  `CVE-2026-103681` · CVE record: Unknown Frontend Dashboard · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Integration for Epos Now and WooCommerce 4.6.0 - 4.11.1 - Unauthenticated Action Scheduler Queue Disclosure](https://agentprime.io/advisories/CVE-2026-103323.md)
  `CVE-2026-103323` · CVE record: Unknown Integration for Epos Now and WooCommerce · CVSS 5.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [wolfSSH SSH client accepts unsolicited forwarded-tcpip channel opens without an authorization check](https://agentprime.io/advisories/CVE-2026-81535.md)
  `CVE-2026-81535` · CVE record: wolfSSL Inc. wolfSSH · CVSS 6.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Candlepin: candlepin: broken object-level authorization via verifyauthorizationfilter multi-@verify hasaccess latching](https://agentprime.io/advisories/CVE-2026-106471.md)
  `CVE-2026-106471` · CVE record: Red Hat Red Hat Satellite 6.16 for RHEL 8 and 4 more · CVSS 8.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-93678.md)
  `CVE-2026-93678` · CVE record: IBM Langflow OSS · CVSS 7.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-97680.md)
  `CVE-2026-97680` · CVE record: IBM Langflow OSS · CVSS 8.3 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-101329.md)
  `CVE-2026-101329` · CVE record: IBM Langflow OSS · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-104335.md)
  `CVE-2026-104335` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Gitea profile feed disclosure bypassing user visibility](https://agentprime.io/advisories/CVE-2026-97626.md)
  `CVE-2026-97626` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Information disclosure, Broken access control
- [Gitea push-to-create bypass of FORCE_PRIVATE policy](https://agentprime.io/advisories/CVE-2026-89182.md)
  `CVE-2026-89182` · CVE record: Gitea Gitea · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Gitea issue attachment API allows changing comment attachments](https://agentprime.io/advisories/CVE-2026-105268.md)
  `CVE-2026-105268` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Gitea tag delete route deletes releases without release permission](https://agentprime.io/advisories/CVE-2026-105267.md)
  `CVE-2026-105267` · CVE record: Gitea Gitea · CVSS 8.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Backstage: Inconsistent catalog property permission evaluation](https://agentprime.io/advisories/CVE-2026-106497.md)
  `CVE-2026-106497` · CVE record: backstage backstage and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control, CWE-178
- [Gitea push mirror API bypass of DISABLE_NEW_PUSH policy](https://agentprime.io/advisories/CVE-2026-97208.md)
  `CVE-2026-97208` · CVE record: Gitea Gitea · CVSS 4.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Gitea push mirror local path check uses the repository owner](https://agentprime.io/advisories/CVE-2026-86684.md)
  `CVE-2026-86684` · CVE record: Gitea Gitea · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [CVE-2026-106550](https://agentprime.io/advisories/CVE-2026-106550.md)
  `CVE-2026-106550` · CVE record: Mozilla Node-convict · CVSS 7.5 High · Not analysed yet · Published 6 Oct 2026 · Tags: Denial of service, Broken access control, Prototype pollution
- [Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS](https://agentprime.io/advisories/CVE-2026-105811.md)
  `CVE-2026-105811` · CVE record: aws qnabot-on-aws · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Security Advisory 0190](https://agentprime.io/advisories/CVE-2026-102157.md)
  `CVE-2026-102157` · CVE record: Arista Networks CloudVision CUE · CVSS 6.8 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Authorization Bypass Through User-Controlled Key in Elasticsearch Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-103009.md)
  `CVE-2026-103009` · CVE record: Elastic Elasticsearch · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in Elasticsearch Leading to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-103007.md)
  `CVE-2026-103007` · CVE record: Elastic Elasticsearch · CVSS 7.2 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in Kibana Leading to Sensitive Information Disclosure](https://agentprime.io/advisories/CVE-2026-102412.md)
  `CVE-2026-102412` · CVE record: Elastic Kibana · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Missing Authorization in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-102410.md)
  `CVE-2026-102410` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in Elasticsearch Leading to Unauthorized Data Stream Modification](https://agentprime.io/advisories/CVE-2026-102407.md)
  `CVE-2026-102407` · CVE record: Elastic Elasticsearch · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Authorization Bypass Through User-Controlled Key in Kibana Leading to Cross-Tenant Data Interception](https://agentprime.io/advisories/CVE-2026-102406.md)
  `CVE-2026-102406` · CVE record: Elastic Kibana · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Gitea private repository access retained after rejected transfer](https://agentprime.io/advisories/CVE-2026-96589.md)
  `CVE-2026-96589` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control, CWE-672
- [Gitea fork workflow approval bypass through maintainer-triggered events](https://agentprime.io/advisories/CVE-2026-94205.md)
  `CVE-2026-94205` · CVE record: Gitea Gitea · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control, CWE-441
- [Gitea deploy key pushes acting as the repository owner](https://agentprime.io/advisories/CVE-2026-79960.md)
  `CVE-2026-79960` · CVE record: Gitea Gitea · CVSS 7.1 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Gitea fork workflow approval bypass through cancel and rerun](https://agentprime.io/advisories/CVE-2026-104632.md)
  `CVE-2026-104632` · CVE record: Gitea Gitea · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Improper Access Control in HPE Networking ClearPass Android Client Application](https://agentprime.io/advisories/CVE-2026-79797.md)
  `CVE-2026-79797` · CVE record: Hewlett Packard Enterprise (HPE) ClearPass Policy Manager (CPPM) · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [MISP: Site-Admin Can Repoint Redis Workers to Attacker-Controlled Server via UI/API Configuration Change](https://agentprime.io/advisories/CVE-2026-106513.md)
  `CVE-2026-106513` · CVE record: MISP MISP · CVSS 6.9 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control, CWE-749
- [Missing authorization in GitHub Enterprise Server allowed repository writers to replace default branches via GraphQL](https://agentprime.io/advisories/CVE-2026-103620.md)
  `CVE-2026-103620` · CVE record: GitHub Enterprise Server · CVSS 6.0 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [CVE-2026-106511](https://agentprime.io/advisories/CVE-2026-106511.md)
  `CVE-2026-106511` · CVE record: MultiversX Labs S.R.L. multisig-improved · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106355.md)
  `CVE-2026-106355` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106195.md)
  `CVE-2026-106195` · CVE record: Google Chrome · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106371.md)
  `CVE-2026-106371` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106418.md)
  `CVE-2026-106418` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106288.md)
  `CVE-2026-106288` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106350.md)
  `CVE-2026-106350` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106270.md)
  `CVE-2026-106270` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106249.md)
  `CVE-2026-106249` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106259.md)
  `CVE-2026-106259` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106264.md)
  `CVE-2026-106264` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106422.md)
  `CVE-2026-106422` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106199.md)
  `CVE-2026-106199` · CVE record: Google Chrome · CVSS 8.2 High · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106362.md)
  `CVE-2026-106362` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106260.md)
  `CVE-2026-106260` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106297.md)
  `CVE-2026-106297` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106306.md)
  `CVE-2026-106306` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-106187.md)
  `CVE-2026-106187` · CVE record: Google Chrome · CVSS 4.2 Medium · Not analysed yet · Published 6 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTA2VDE4OjQxOjM1LjMzNjAwMFoiLCJDVkUtMjAyNi0xMDYxODciXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTA3VDA5OjE3OjMxLjQzMjAwMFoiLCJDVkUtMjAyNi0xMDQzOTAiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTA3VDA5OjE3OjMxLjQzMjAwMFoiLCJDVkUtMjAyNi0xMDQzOTAiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.