# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Microsoft Bookings Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-94510.md)
  `CVE-2026-94510` · CVE record: Microsoft Microsoft Bookings · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Azure Event Grid Spoofing Vulnerability](https://agentprime.io/advisories/CVE-2026-83947.md)
  `CVE-2026-83947` · CVE record: Microsoft Azure Event Grid System · CVSS 7.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Indico: Missing access check in legacy session export API](https://agentprime.io/advisories/GHSA-6p4f-j8j6-463q.md)
  `GHSA-6p4f-j8j6-463q`, `CVE-2026-107395`, `PYSEC-2026-4226` · PyPI `indico`: affected `<3.3.13`, fixed in `3.3.13` · CVSS 4.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Hazelcast has an authorization bypass in IMap Predicates API](https://agentprime.io/advisories/GHSA-w294-6q5q-53p8.md)
  `GHSA-w294-6q5q-53p8`, `CVE-2026-107725` · Maven `com.hazelcast:hazelcast`: affected `>=5.6.0, <5.7.0 || >=5.5.0, <5.7.0 || <5.7.0`, fixed in `5.7.0` · CVSS 8.7 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure](https://agentprime.io/advisories/GHSA-6wjp-v33h-5cvq.md)
  `GHSA-6wjp-v33h-5cvq`, `CVE-2026-61426` · npm `praisonai`: affected `<1.7.3`, fixed in `1.7.3` · CVSS 8.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Information disclosure, Broken access control, Authentication bypass
- [PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass](https://agentprime.io/advisories/GHSA-c78w-2q4r-68r7.md)
  `GHSA-c78w-2q4r-68r7`, `CVE-2026-61442`, `PYSEC-2026-4262` · PyPI `praisonai-platform`: affected `<0.1.9`, fixed in `0.1.9` · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface](https://agentprime.io/advisories/GHSA-hc5v-gxvj-58wh.md)
  `GHSA-hc5v-gxvj-58wh`, `CVE-2026-61427`, `PYSEC-2026-4257` · PyPI `praisonai`: affected `<4.6.78`, fixed in `4.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass, Broken access control, CWE-20
- [PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization](https://agentprime.io/advisories/GHSA-xxgv-vgvj-qvxh.md)
  `GHSA-xxgv-vgvj-qvxh`, `CVE-2026-61440`, `PYSEC-2026-4264` · PyPI `praisonai-platform`: affected `<0.1.9`, fixed in `0.1.9` · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete](https://agentprime.io/advisories/CVE-2026-107793.md)
  `CVE-2026-107793` · CVE record: banq jivejdon · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move](https://agentprime.io/advisories/CVE-2026-107792.md)
  `CVE-2026-107792` · CVE record: banq jivejdon · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access](https://agentprime.io/advisories/CVE-2026-11930.md)
  `CVE-2026-11930` · CVE record: IBM Security Verify Access and 3 more · CVSS 5.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Missing authorization in Hewlett Packard Enterprise HPE Intelligent Management Center (iMC)](https://agentprime.io/advisories/CVE-2026-79842.md)
  `CVE-2026-79842` · CVE record: Hewlett Packard Enterprise HPE Intelligent Management Center (iMC) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port](https://agentprime.io/advisories/CVE-2026-107782.md)
  `CVE-2026-107782` · CVE record: winsiderss System Informer · CVSS 8.5 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php](https://agentprime.io/advisories/CVE-2026-107706.md)
  `CVE-2026-107706` · CVE record: Dolibarr dolibarr · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking](https://agentprime.io/advisories/CVE-2026-107702.md)
  `CVE-2026-107702` · CVE record: Webkul QloApps · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in OpenStack Mistral](https://agentprime.io/advisories/CVE-2026-97147.md)
  `CVE-2026-97147` · CVE record: OpenStack Mistral · CVSS 7.2 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in OpenStack Mistral](https://agentprime.io/advisories/CVE-2026-93861.md)
  `CVE-2026-93861` · CVE record: OpenStack Mistral · CVSS 6.0 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Missing authorization in OpenStack Mistral](https://agentprime.io/advisories/CVE-2026-93860.md)
  `CVE-2026-93860` · CVE record: OpenStack Mistral · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code](https://agentprime.io/advisories/CVE-2026-107332.md)
  `CVE-2026-107332` · CVE record: aws aws-toolkit-vscode · CVSS 6.8 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control, CWE-459
- [Incorrect Authorization in Malcolm](https://agentprime.io/advisories/CVE-2026-107334.md)
  `CVE-2026-107334` · CVE record: CISA Malcolm · CVSS 5.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in Malcolm](https://agentprime.io/advisories/CVE-2026-107333.md)
  `CVE-2026-107333` · CVE record: CISA Malcolm · CVSS 8.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Authentication Bypass by Spoofing in Malcolm](https://agentprime.io/advisories/CVE-2026-107336.md)
  `CVE-2026-107336` · CVE record: CISA Malcolm · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Authentication bypass, Broken access control, CWE-441
- [AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins](https://agentprime.io/advisories/GHSA-v2j5-22fr-j62r.md)
  `GHSA-v2j5-22fr-j62r`, `CVE-2026-107230` · Maven `org.asynchttpclient:async-http-client`: affected `>=3.0.0, <3.0.14 || >=2.0.0, <=2.16.1`, fixed in `3.0.14` · CVSS 7.4 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control, CWE-346
- [PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments](https://agentprime.io/advisories/GHSA-29r9-67vg-qj56.md)
  `GHSA-29r9-67vg-qj56`, `CVE-2026-60087`, `PYSEC-2026-4265` · PyPI `praisonaiagents`: affected `<1.6.78`, fixed in `1.6.78` · CVSS 6.9 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion](https://agentprime.io/advisories/CVE-2026-50055.md)
  `CVE-2026-50055` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier](https://agentprime.io/advisories/CVE-2026-10631.md)
  `CVE-2026-10631` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation](https://agentprime.io/advisories/CVE-2026-107623.md)
  `CVE-2026-107623` · CVE record: Red Hat Red Hat build of Keycloak 26.6 and 2 more · CVSS 4.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [IDOR in Caz Informatics' Advancity ALMS Cloud](https://agentprime.io/advisories/CVE-2026-12859.md)
  `CVE-2026-12859` · CVE record: Caz Informatics Services Trade Inc. Advancity ALMS Cloud · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action](https://agentprime.io/advisories/CVE-2026-107637.md)
  `CVE-2026-107637` · CVE record: ph7software ph7builder · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [IBM DataPower Gateway Incorrect Authorization](https://agentprime.io/advisories/CVE-2026-14273.md)
  `CVE-2026-14273` · CVE record: IBM DataPower Gateway 10.6CD and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [World-accessible IPC shared memory with predictable name in TightVNC Server](https://agentprime.io/advisories/CVE-2026-107612.md)
  `CVE-2026-107612` · CVE record: GlavSoft TightVNC · CVSS 7.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Weak cryptography or TLS, Broken access control
- [WordPress Creator LMS plugin <= 1.2.21 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62128.md)
  `CVE-2026-62128` · CVE record: Creator LMS Creator LMS · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [IBM DataPower Gateway Improper Authorization](https://agentprime.io/advisories/CVE-2026-16181.md)
  `CVE-2026-16181` · CVE record: IBM DataPower Gateway 10.6CD and 3 more · CVSS 7.4 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-105893.md)
  `CVE-2026-105893` · CVE record: Liquid Web / StellarWP Event Tickets · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-105891.md)
  `CVE-2026-105891` · CVE record: Liquid Web / StellarWP Event Tickets · CVSS 4.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [WordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-103072.md)
  `CVE-2026-103072` · CVE record: VillaTheme VillaTheme Core · CVSS 4.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-105888.md)
  `CVE-2026-105888` · CVE record: Liquid Web / StellarWP Event Tickets · CVSS 5.4 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [WordPress Visual Composer Website Builder plugin <= 45.16.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-106596.md)
  `CVE-2026-106596` · CVE record: Visual Composer Visual Composer Website Builder · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [WordPress Ultimate Post Kit plugin <= 4.5.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-105886.md)
  `CVE-2026-105886` · CVE record: BdThemes Ultimate Post Kit · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-105878.md)
  `CVE-2026-105878` · CVE record: YITH YITH WooCommerce Product Bundles · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-106603.md)
  `CVE-2026-106603` · CVE record: Groundhogg HollerBox · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [WordPress GiveWP plugin <= 4.18.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-106600.md)
  `CVE-2026-106600` · CVE record: Liquid Web / StellarWP GiveWP · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Incorrect Default Permissions in hMailServer](https://agentprime.io/advisories/CVE-2026-107573.md)
  `CVE-2026-107573` · CVE record: Progressive Robot Ltd hMailServer · CVSS 7.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [IDOR in AKIN Software's OctoCloud](https://agentprime.io/advisories/CVE-2026-19083.md)
  `CVE-2026-19083` · CVE record: AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud · CVSS 8.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Missing Authorization in hMailServer](https://agentprime.io/advisories/CVE-2026-104660.md)
  `CVE-2026-104660` · CVE record: Progressive Robot Ltd hMailServer · CVSS 7.8 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Easy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabled](https://agentprime.io/advisories/CVE-2026-105190.md)
  `CVE-2026-105190` · CVE record: Unknown Easy Digital Downloads · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX](https://agentprime.io/advisories/CVE-2026-104671.md)
  `CVE-2026-104671` · CVE record: Unknown TutorStarter · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Authenticated argument injection in NIOS command line leading to privilege escalation](https://agentprime.io/advisories/CVE-2026-107510.md)
  `CVE-2026-107510` · CVE record: Infoblox NIOS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Oct 2026 · Tags: Command injection, Privilege escalation, Broken access control
- [Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information](https://agentprime.io/advisories/CVE-2026-71896.md)
  `CVE-2026-71896` · CVE record: Apache Software Foundation Apache DolphinScheduler · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials](https://agentprime.io/advisories/CVE-2026-71895.md)
  `CVE-2026-71895` · CVE record: Apache Software Foundation Apache DolphinScheduler · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords](https://agentprime.io/advisories/CVE-2026-71183.md)
  `CVE-2026-71183` · CVE record: Apache Software Foundation Apache DolphinScheduler · CVSS 7.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint](https://agentprime.io/advisories/CVE-2026-66087.md)
  `CVE-2026-66087` · CVE record: Apache Software Foundation Apache DolphinScheduler · CVSS 8.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint](https://agentprime.io/advisories/CVE-2026-66084.md)
  `CVE-2026-66084` · CVE record: Apache Software Foundation Apache DolphinScheduler · CVSS 8.1 High · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）](https://agentprime.io/advisories/CVE-2026-66082.md)
  `CVE-2026-66082` · CVE record: Apache Software Foundation Apache DolphinScheduler · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR](https://agentprime.io/advisories/CVE-2026-94246.md)
  `CVE-2026-94246` · CVE record: Unknown Wallet System for WooCommerce · CVSS 6.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR](https://agentprime.io/advisories/CVE-2026-94245.md)
  `CVE-2026-94245` · CVE record: Unknown Wallet System for WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php](https://agentprime.io/advisories/CVE-2026-86827.md)
  `CVE-2026-86827` · CVE record: Unknown BackWPup · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR](https://agentprime.io/advisories/CVE-2026-105198.md)
  `CVE-2026-105198` · CVE record: Unknown Appointment Booking Plugin · CVSS 5.3 Medium · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR](https://agentprime.io/advisories/CVE-2026-105197.md)
  `CVE-2026-105197` · CVE record: Unknown Appointment Booking Plugin · CVSS 2.7 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control
- [LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API](https://agentprime.io/advisories/CVE-2026-105196.md)
  `CVE-2026-105196` · CVE record: Unknown Appointment Booking Plugin · CVSS 3.3 Low · Not analysed yet · Published 8 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTA4VDA2OjAwOjA3LjA4NDAwMFoiLCJDVkUtMjAyNi0xMDUxOTYiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTA5VDA1OjU0OjU4Ljc2OTAwMFoiLCJDVkUtMjAyNi04NzEwOCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTA5VDA1OjU0OjU4Ljc2OTAwMFoiLCJDVkUtMjAyNi04NzEwOCJd>. Everything for agents: <https://agentprime.io/llms.txt>.