# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update via IDOR](https://agentprime.io/advisories/CVE-2026-104645.md)
  `CVE-2026-104645` · CVE record: Unknown Image Photo Gallery Final Tiles Grid · CVSS 2.7 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Stump](https://agentprime.io/advisories/CVE-2026-107450.md)
  `CVE-2026-107450` · CVE record: stumpapp Stump · CVSS 5.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Incorrect permission assignment in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87660.md)
  `CVE-2026-87660` · CVE record: Brocade Fabric OS · CVSS 7.0 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass](https://agentprime.io/advisories/CVE-2026-107445.md)
  `CVE-2026-107445` · CVE record: Red Hat Red Hat Hardened Images and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass](https://agentprime.io/advisories/CVE-2026-107444.md)
  `CVE-2026-107444` · CVE record: Red Hat Red Hat Hardened Images and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Missing authorization in Brocade Fabric OS](https://agentprime.io/advisories/CVE-2026-87669.md)
  `CVE-2026-87669` · CVE record: Brocade Fabric OS · CVSS 5.1 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Octopus Deploy Octopus Server](https://agentprime.io/advisories/CVE-2026-102488.md)
  `CVE-2026-102488` · CVE record: Octopus Deploy Octopus Server · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification](https://agentprime.io/advisories/CVE-2026-17538.md)
  `CVE-2026-17538` · CVE record: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress · CVSS 5.4 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities](https://agentprime.io/advisories/CVE-2026-107281.md)
  `CVE-2026-107281` · CVE record: AsyncHttpClient async-http-client · CVSS 7.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control, CWE-346
- [Improper Access Control in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76281.md)
  `CVE-2026-76281` · CVE record: Splunk Splunk Enterprise · No CVSS score · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gateway](https://agentprime.io/advisories/CVE-2026-76280.md)
  `CVE-2026-76280` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76278.md)
  `CVE-2026-76278` · CVE record: Splunk Splunk Enterprise · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76275.md)
  `CVE-2026-76275` · CVE record: Splunk Splunk Enterprise · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Missing Access Control through the REST API in Splunk Secure Gateway](https://agentprime.io/advisories/CVE-2026-76272.md)
  `CVE-2026-76272` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Improper Access Control in Search Job Retrieval through the REST API in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76269.md)
  `CVE-2026-76269` · CVE record: Splunk Splunk Enterprise · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Improper Access Control through REST API Endpoints in Splunk Secure Gateway](https://agentprime.io/advisories/CVE-2026-76265.md)
  `CVE-2026-76265` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Improper Authorization through the REST API in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76264.md)
  `CVE-2026-76264` · CVE record: Splunk Splunk Enterprise · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints](https://agentprime.io/advisories/GHSA-gh98-4phw-6fmw.md)
  `GHSA-gh98-4phw-6fmw`, `CVE-2026-105698`, `PYSEC-2026-4234`, `PYSEC-2026-4238` · PyPI `langflow` and 1 more: affected `>=1.0.0, <1.10.1`, fixed in `1.10.1` · CVSS 5.4 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers](https://agentprime.io/advisories/GHSA-4hmc-cfm3-w43c.md)
  `GHSA-4hmc-cfm3-w43c`, `CVE-2026-105699`, `PYSEC-2026-4230` · PyPI `langflow`: affected `>=1.6.8, <1.9.1`, fixed in `1.9.1` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Payload has a tenant authorization bypass in Multi-Tenant Plugin](https://agentprime.io/advisories/GHSA-p96c-xwx8-3cqj.md)
  `GHSA-p96c-xwx8-3cqj`, `CVE-2026-105860` · npm `@payloadcms/plugin-multi-tenant`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [@payloadcms/plugin-multi-tenant has a cross-tenant create issue](https://agentprime.io/advisories/GHSA-xhm9-gwgw-3q2q.md)
  `GHSA-xhm9-gwgw-3q2q`, `CVE-2026-105864` · npm `@payloadcms/plugin-multi-tenant`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Payload: Client uploads could overwrite S3 objects](https://agentprime.io/advisories/GHSA-7vg8-29qx-jgj8.md)
  `GHSA-7vg8-29qx-jgj8`, `CVE-2026-105867` · npm `@payloadcms/storage-s3`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Payload: Unauthorized update to collection documents](https://agentprime.io/advisories/GHSA-f7hx-52q9-hcrf.md)
  `GHSA-f7hx-52q9-hcrf`, `CVE-2026-105859` · npm `payload`: affected `<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Payload authentication token field handling issue](https://agentprime.io/advisories/GHSA-66wr-7vmr-p5jq.md)
  `GHSA-66wr-7vmr-p5jq`, `CVE-2026-105863` · npm `payload`: affected `>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34`, fixed in `3.90.0`, `4.0.0-canary.34` · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Ghost: Editors Could Promote Staff Users to Their Own Role](https://agentprime.io/advisories/GHSA-4pvx-fwjj-8gpc.md)
  `GHSA-4pvx-fwjj-8gpc`, `BIT-ghost-2026-104412`, `BIT-ghost-2026-105678`, `CVE-2026-104412`, `CVE-2026-105678` · npm `ghost`: affected `>=0.5.0, <6.64.0`, fixed in `6.64.0` · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Backstage: Inconsistent credential enforcement for overlapping proxy routes](https://agentprime.io/advisories/GHSA-472h-9c5j-prrr.md)
  `GHSA-472h-9c5j-prrr`, `CVE-2026-106456` · npm `@backstage/plugin-proxy-backend`: affected `>=0.5.0, <0.6.18`, fixed in `0.6.18` · CVSS 4.8 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates](https://agentprime.io/advisories/GHSA-c36c-cf6r-ghgj.md)
  `GHSA-c36c-cf6r-ghgj`, `CVE-2026-106458` · npm `@backstage/plugin-catalog-backend-module-bitbucket-server`: affected `>=0.4.0, <0.5.15`, fixed in `0.5.15` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Missing authorization checks in Amazon Athena engine version 3 request handling](https://agentprime.io/advisories/CVE-2026-107352.md)
  `CVE-2026-107352` · CVE record: AWS Amazon Athena · CVSS 6.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control, CWE-424
- [Ghost: Authorization Issue Allowed Author Role to Delete any Post](https://agentprime.io/advisories/GHSA-x3mg-q38v-m562.md)
  `GHSA-x3mg-q38v-m562`, `BIT-ghost-2026-105680`, `CVE-2026-105680` · npm `ghost`: affected `>=5.81.0, <6.60.0`, fixed in `6.60.0` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control](https://agentprime.io/advisories/GHSA-jg6q-3qfh-r9f8.md)
  `GHSA-jg6q-3qfh-r9f8`, `CVE-2026-104891` · npm `@insumermodel/mppx-condition-gate` and 1 more: affected `<3.0.0`, fixed in `3.0.0` · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Backstage has incorrect authorization in search engine permission filtering](https://agentprime.io/advisories/GHSA-9325-vq29-gp3v.md)
  `GHSA-9325-vq29-gp3v`, `CVE-2026-106562` · npm `@backstage/plugin-search-backend` and 1 more: affected `<2.1.6`, fixed in `2.1.6` · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control, CWE-754
- [Backstage: Improper entity validation in deprecated Kubernetes services endpoint](https://agentprime.io/advisories/GHSA-r9ph-3637-55px.md)
  `GHSA-r9ph-3637-55px`, `CVE-2026-106563` · npm `@backstage/plugin-kubernetes-backend`: affected `<0.21.8`, fixed in `0.21.8` · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control, CWE-20
- [Backstage has a sensitive information disclosure in Kubernetes resource queries](https://agentprime.io/advisories/GHSA-p795-mqf2-36mf.md)
  `GHSA-p795-mqf2-36mf`, `CVE-2026-106561` · npm `@backstage/plugin-kubernetes-backend`: affected `<0.21.9`, fixed in `0.21.9` · CVSS 5.0 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, Broken access control
- [Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback](https://agentprime.io/advisories/GHSA-29gx-h2m3-xw44.md)
  `GHSA-29gx-h2m3-xw44`, `CVE-2026-106462` · npm `@backstage/plugin-scaffolder-backend` and 5 more: affected `<4.1.0`, fixed in `4.1.0` · CVSS 6.4 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control, CWE-441
- [Backstage has improper authorization in GitLab organizational user ingestion](https://agentprime.io/advisories/GHSA-gp6m-x9vw-5c5x.md)
  `GHSA-gp6m-x9vw-5c5x`, `CVE-2026-106463` · npm `@backstage/plugin-catalog-backend-module-gitlab`: affected `<0.8.7`, fixed in `0.8.7` · CVSS 5.4 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Backstage: Improper authorization enforcement for TechDocs static content](https://agentprime.io/advisories/GHSA-rg9r-hr7g-5gc2.md)
  `GHSA-rg9r-hr7g-5gc2`, `CVE-2026-106489` · npm `@backstage/plugin-techdocs-backend`: affected `<2.2.4`, fixed in `2.2.4` · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, Broken access control
- [Backstage: Improper preservation of access restrictions during service credential delegation](https://agentprime.io/advisories/GHSA-cq7v-rfgc-5c7v.md)
  `GHSA-cq7v-rfgc-5c7v`, `CVE-2026-106492` · npm `@backstage/backend-defaults`: affected `<0.17.8`, fixed in `0.17.8` · CVSS 7.6 High · Not analysed yet · Published 7 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Backstage: Inconsistent enforcement of allowed location types during catalog processing](https://agentprime.io/advisories/GHSA-pcmq-25r3-5w9v.md)
  `GHSA-pcmq-25r3-5w9v`, `CVE-2026-106496` · npm `@backstage/plugin-catalog-backend`: affected `<3.9.1`, fixed in `3.9.1` · CVSS 3.1 Low · Not analysed yet · Published 7 Oct 2026 · Tags: Path traversal, Broken access control
- [Backstage: Improper URL validation in catalog entity placeholder resolution](https://agentprime.io/advisories/GHSA-qgvj-qcf8-xq73.md)
  `GHSA-qgvj-qcf8-xq73`, `CVE-2026-106498` · npm `@backstage/plugin-catalog-backend`: affected `<3.9.1`, fixed in `3.9.1` · CVSS 7.7 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control, Server-side request forgery (SSRF)
- [Backstage: Scaffolder action input authorization bypass](https://agentprime.io/advisories/GHSA-hmp2-4m7g-22cv.md)
  `GHSA-hmp2-4m7g-22cv`, `CVE-2026-106503` · npm `@backstage/plugin-scaffolder-backend`: affected `<3.3.1 || >=3.4.0, <3.4.1 || >=4.0.0, <4.0.3 || >=4.0.4, <4.1.0`, fixed in `3.3.1`, `3.4.1`, `4.0.3`, `4.1.0` · CVSS 8.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control, CWE-178
- [Backstage: Incorrect authorization in scaffolder task listing](https://agentprime.io/advisories/GHSA-7hfw-grcm-cqm6.md)
  `GHSA-7hfw-grcm-cqm6`, `CVE-2026-106461` · npm `@backstage/plugin-scaffolder-backend`: affected `<4.1.0`, fixed in `4.1.0` · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-96335.md)
  `CVE-2026-96335` · CVE record: WPMU DEV Forminator · CVSS 7.5 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Payload: Field-level write access bypass in Payload on MongoDB](https://agentprime.io/advisories/GHSA-4ww4-68q3-h7g5.md)
  `GHSA-4ww4-68q3-h7g5`, `CVE-2026-106100` · npm `@payloadcms/db-mongodb`: affected `<3.87.0 || >=4.0.0-canary.0, <4.0.0-canary.20`, fixed in `3.87.0`, `4.0.0-canary.20` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Cisco Meraki Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76463.md)
  `CVE-2026-76463` · CVE record: Cisco Cisco Campus Gateway Software and 3 more · CVSS 8.8 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Access Control Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76498.md)
  `CVE-2026-76498` · CVE record: Cisco Cisco Application Policy Infrastructure Controller (APIC) · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions](https://agentprime.io/advisories/GHSA-fh39-c73x-5pjv.md)
  `GHSA-fh39-c73x-5pjv`, `CVE-2026-106105` · npm `@quasar/app-vite` and 2 more: affected `<3.3.0`, fixed in `3.3.0` · CVSS 8.4 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76455.md)
  `CVE-2026-76455` · CVE record: Cisco Cisco NX-OS Software and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability](https://agentprime.io/advisories/CVE-2026-20328.md)
  `CVE-2026-20328` · CVE record: Cisco Cisco License On-Prem · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [Cisco Nexus 9000 Series Fabric Switches in ACI Mode Policy-Based Redirect Endpoint Group Contract Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-20038.md)
  `CVE-2026-20038` · CVE record: Cisco Cisco NX-OS System Software in ACI Mode · CVSS 5.8 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [ImageMagick: Policy Bypass in CUT encoder](https://agentprime.io/advisories/CVE-2026-106580.md)
  `CVE-2026-106580` · CVE record: ImageMagick ImageMagick · CVSS 4.0 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control, Denial of service
- [Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints](https://agentprime.io/advisories/CVE-2026-107270.md)
  `CVE-2026-107270` · CVE record: gophish gophish · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues](https://agentprime.io/advisories/GHSA-mxmx-rh57-jx58.md)
  `GHSA-mxmx-rh57-jx58`, `CVE-2026-61441`, `CVE-2026-62179`, `PYSEC-2026-4263` · PyPI `praisonai-platform`: affected `<0.1.9`, fixed in `0.1.9` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing](https://agentprime.io/advisories/GHSA-qj9c-59p6-8cgx.md)
  `GHSA-qj9c-59p6-8cgx`, `CVE-2026-61428`, `PYSEC-2026-4259` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Authentication bypass, Broken access control, CWE-345
- [Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token](https://agentprime.io/advisories/GHSA-m62c-5q34-f3cf.md)
  `GHSA-m62c-5q34-f3cf`, `CVE-2026-57449` · npm `@actual-app/sync-server`: affected `<26.7.0`, fixed in `26.7.0` · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Information disclosure, Broken access control
- [wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry](https://agentprime.io/advisories/GHSA-rjpf-7pf5-q54x.md)
  `GHSA-rjpf-7pf5-q54x`, `CVE-2026-46438`, `PYSEC-2026-4314` · PyPI `wger`: affected `<=2.1`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)](https://agentprime.io/advisories/GHSA-c72h-82w6-rqfp.md)
  `GHSA-c72h-82w6-rqfp`, `CVE-2026-43976`, `PYSEC-2026-4313` · PyPI `wger`: affected `<=2.1`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes](https://agentprime.io/advisories/CVE-2026-107175.md)
  `CVE-2026-107175` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control, CWE-665
- [Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources](https://agentprime.io/advisories/CVE-2026-105139.md)
  `CVE-2026-105139` · CVE record: obot-platform obot · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [WordPress WP Rentals theme <= 3.14.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-27434.md)
  `CVE-2026-27434` · CVE record: sc Internet Vivoo WP Rentals · CVSS 5.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control
- [WordPress Booktics plugin <= 1.0.27 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-104390.md)
  `CVE-2026-104390` · CVE record: Arraytics Booktics · CVSS 4.3 Medium · Not analysed yet · Published 7 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTA3VDA5OjE3OjMxLjQzMjAwMFoiLCJDVkUtMjAyNi0xMDQzOTAiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTA4VDA2OjAwOjA3LjA4NDAwMFoiLCJDVkUtMjAyNi0xMDUxOTYiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTA4VDA2OjAwOjA3LjA4NDAwMFoiLCJDVkUtMjAyNi0xMDUxOTYiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.