# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed](https://agentprime.io/advisories/GHSA-hjx8-qv73-f7cm.md)
  `GHSA-hjx8-qv73-f7cm`, `CVE-2026-111919`, `GO-2026-6733` · Go `code.vikunja.io/api`: affected `>=0.22.0, <=2.6.0`, no fixed version yet · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants](https://agentprime.io/advisories/GHSA-fprf-r6rv-xg99.md)
  `GHSA-fprf-r6rv-xg99`, `CVE-2026-111918`, `GO-2026-6731` · Go `code.vikunja.io/api`: affected `>=1.0.0-rc0, <2.7.0`, fixed in `2.7.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal](https://agentprime.io/advisories/GHSA-w2ch-4xgr-22ww.md)
  `GHSA-w2ch-4xgr-22ww`, `GO-2026-6754` · Go `code.vikunja.io/api`: affected `>=0.9, <2.6.0`, fixed in `2.6.0` · CVSS 4.0, no score published · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Vikunja: Cross-project task disclosure through subtask expansion](https://agentprime.io/advisories/GHSA-3hc7-r24j-rpwc.md)
  `GHSA-3hc7-r24j-rpwc`, `GO-2026-6714` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 4.0, no score published · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Broken access control
- [Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID](https://agentprime.io/advisories/GHSA-g38j-7v97-x298.md)
  `GHSA-g38j-7v97-x298`, `GO-2026-6732` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 4.0, no score published · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Contao: Improper access control in the preview links module](https://agentprime.io/advisories/GHSA-q6wp-fr43-gm9v.md)
  `GHSA-q6wp-fr43-gm9v`, `CVE-2026-107850`, `PKSA-7n2q-445d-xssj` · Packagist `contao/core-bundle`: affected `>=5.7.1, <5.7.12`, fixed in `5.7.12` · CVSS 4.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Contao: Improper access control in the table access voter](https://agentprime.io/advisories/GHSA-5974-gfqc-wrcm.md)
  `GHSA-5974-gfqc-wrcm`, `CVE-2026-107851`, `PKSA-b5qj-hq3z-3ry8` · Packagist `contao/core-bundle`: affected `>=5.7.0, <5.7.12`, fixed in `5.7.12` · CVSS 4.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control, CWE-524
- [Vikunja: Link-share token can enumerate users through the v2 API](https://agentprime.io/advisories/GHSA-vfxw-3x8p-2vjr.md)
  `GHSA-vfxw-3x8p-2vjr`, `CVE-2026-91981`, `GO-2026-6752` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Broken access control
- [Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project](https://agentprime.io/advisories/GHSA-39p5-2wrr-xh29.md)
  `GHSA-39p5-2wrr-xh29`, `CVE-2026-91980`, `GO-2026-6713` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Broken access control
- [Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)](https://agentprime.io/advisories/GHSA-9rg3-v78m-26q8.md)
  `GHSA-9rg3-v78m-26q8`, `CVE-2026-91983`, `GO-2026-6726` · Go `code.vikunja.io/api`: affected `>=1.0.0, <2.6.0`, fixed in `2.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)](https://agentprime.io/advisories/GHSA-w39f-h553-h2mx.md)
  `GHSA-w39f-h553-h2mx`, `CVE-2026-91984`, `GO-2026-6755` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level](https://agentprime.io/advisories/GHSA-qfwc-vx6f-3g6g.md)
  `GHSA-qfwc-vx6f-3g6g`, `CVE-2026-91985`, `GO-2026-6747` · Go `code.vikunja.io/api`: affected `<2.6.0`, fixed in `2.6.0` · CVSS 8.7 High · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Broken access control
- [Astron Agent: Unsandboxed code-node leads to cross-tenant RCE](https://agentprime.io/advisories/CVE-2026-108263.md)
  `CVE-2026-108263` · CVE record: iflytek astron-agent · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Code injection, Authentication bypass, Broken access control, CWE-653
- [Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure](https://agentprime.io/advisories/GHSA-32r8-5843-4qw2.md)
  `GHSA-32r8-5843-4qw2`, `CVE-2026-76216`, `GO-2026-6711` · Go `code.vikunja.io/api`: affected `<2.5.0`, fixed in `2.5.0` · CVSS 7.7 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control, Memory corruption
- [pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents](https://agentprime.io/advisories/GHSA-3hj7-6vmj-h8v4.md)
  `GHSA-3hj7-6vmj-h8v4`, `CVE-2026-107841`, `PYSEC-2026-4246` · PyPI `pacioli-guard`: affected `>=0.9.6, <0.10.0`, fixed in `0.10.0` · CVSS 5.7 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)](https://agentprime.io/advisories/GHSA-rj9j-8772-4h6c.md)
  `GHSA-rj9j-8772-4h6c`, `CVE-2026-68582`, `GO-2026-6749` · Go `code.vikunja.io/api`: affected `>=0.24.0, <2.4.0`, fixed in `2.4.0` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Vikunja: Link-share principal ID collision allows cross-account API token issuance and management](https://agentprime.io/advisories/GHSA-vvcv-vpph-h844.md)
  `GHSA-vvcv-vpph-h844`, `CVE-2026-68581`, `GO-2026-6753` · Go `code.vikunja.io/api`: affected `>=0.22.0, <2.4.0`, fixed in `2.4.0` · CVSS 8.6 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email](https://agentprime.io/advisories/CVE-2026-107856.md)
  `CVE-2026-107856` · CVE record: civiform civiform · CVSS 4.5 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)](https://agentprime.io/advisories/CVE-2026-107854.md)
  `CVE-2026-107854` · CVE record: Jexactyl Jexactyl · CVSS 5.4 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category](https://agentprime.io/advisories/CVE-2026-108096.md)
  `CVE-2026-108096` · CVE record: AWS aws-amplify/graphql-index-transformer and 2 more · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [MariaDB: database privilege escalation via user / role name collision in the acl cache](https://agentprime.io/advisories/CVE-2026-107822.md)
  `CVE-2026-107822` · CVE record: MariaDB server · CVSS 6.4 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control, CWE-706
- [Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up](https://agentprime.io/advisories/GHSA-h246-wpgf-vmq5.md)
  `GHSA-h246-wpgf-vmq5`, `CVE-2026-107813`, `GO-2026-6706` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b`, fixed in `1.9.10-0.20260728074433-a3999bd78a3b` · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser](https://agentprime.io/advisories/GHSA-32gc-wf3m-78w9.md)
  `GHSA-32gc-wf3m-78w9`, `CVE-2026-107811`, `GO-2026-6702` · Go `github.com/0xJacky/Nginx-UI`: affected `>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728091109-0ecbd106c37b`, fixed in `1.9.10-0.20260728091109-0ecbd106c37b` · CVSS 8.8 High · Not analysed yet · Published 9 Oct 2026 · Tags: Information disclosure, Broken access control
- [MariaDB: Insecure $HOME in MariaDB rpm packages](https://agentprime.io/advisories/CVE-2026-107814.md)
  `CVE-2026-107814` · CVE record: MariaDB server · CVSS 8.4 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint](https://agentprime.io/advisories/CVE-2026-108112.md)
  `CVE-2026-108112` · CVE record: ageerle ruoyi-ai · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search](https://agentprime.io/advisories/CVE-2026-108111.md)
  `CVE-2026-108111` · CVE record: ageerle ruoyi-ai · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [MOVO through 0.2.3 Authorization Bypass via Document Endpoints](https://agentprime.io/advisories/CVE-2026-108110.md)
  `CVE-2026-108110` · CVE record: himovo MOVO · CVSS 7.6 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones](https://agentprime.io/advisories/CVE-2026-104116.md)
  `CVE-2026-104116` · CVE record: illumos illumos-gate and 1 more · CVSS 1.9 Low · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership](https://agentprime.io/advisories/CVE-2026-104117.md)
  `CVE-2026-104117` · CVE record: illumos illumos-gate and 1 more · CVSS 1.9 Low · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy](https://agentprime.io/advisories/GHSA-pfvf-fwfp-25mp.md)
  `GHSA-pfvf-fwfp-25mp`, `CVE-2026-107728`, `PYSEC-2026-4303` · PyPI `strawberry-graphql`: affected `>=0.217.0, <0.326.1`, fixed in `0.326.1` · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62028.md)
  `CVE-2026-62028` · CVE record: bPlugins Before After Image Comparison – Image comparison for WP · CVSS 5.4 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-105883.md)
  `CVE-2026-105883` · CVE record: ThemeHunk Th Shop Mania · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint](https://agentprime.io/advisories/CVE-2026-104079.md)
  `CVE-2026-104079` · CVE record: Syed Balkhi Envira Gallery · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [WordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39779.md)
  `CVE-2026-39779` · CVE record: Asgaros Asgaros Forum · CVSS 4.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.8.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62040.md)
  `CVE-2026-62040` · CVE record: DEV Institute Restrict User Access – Membership Plugin with Force · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [WordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62041.md)
  `CVE-2026-62041` · CVE record: Ashok Dudhat WP Event Manager · CVSS 5.4 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [WordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62042.md)
  `CVE-2026-62042` · CVE record: unFocus Projects Scripts n Styles · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [WordPress AI Translation for Polylang plugin <= 1.6.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-107419.md)
  `CVE-2026-107419` · CVE record: Cool Plugins AI Translation for Polylang · CVSS 5.4 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Livees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure](https://agentprime.io/advisories/CVE-2026-86851.md)
  `CVE-2026-86851` · CVE record: Unknown Livees Checkout · CVSS 6.5 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion](https://agentprime.io/advisories/CVE-2026-87846.md)
  `CVE-2026-87846` · CVE record: Unknown Shipping for Nova Poshta · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-96334.md)
  `CVE-2026-96334` · CVE record: ThemeGrill User Registration · CVSS 5.6 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [WordPress Deposits and Partial Payments for WooCommerce plugin <= 4.0.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-95589.md)
  `CVE-2026-95589` · CVE record: Magepeople inc. Deposits and Partial Payments for WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability](https://agentprime.io/advisories/CVE-2026-95597.md)
  `CVE-2026-95597` · CVE record: codemstory 워드프레스 결제 심플페이 · CVSS 6.5 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-96461.md)
  `CVE-2026-96461` · CVE record: TMS Amelia · CVSS 7.5 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-96337.md)
  `CVE-2026-96337` · CVE record: properfraction ProfilePress · CVSS 6.5 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-96518.md)
  `CVE-2026-96518` · CVE record: properfraction ProfilePress · CVSS 5.9 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2026-78341.md)
  `CVE-2026-78341` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 6.5 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Incorrect permission assignment in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2026-78339.md)
  `CVE-2026-78339` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 6.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Insecure direct object reference in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2026-78026.md)
  `CVE-2026-78026` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 4.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Insecure direct object reference in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2026-78023.md)
  `CVE-2026-78023` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 7.1 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Missing authorization in Dell Secure Connect Gateway (SCG) Policy Manager](https://agentprime.io/advisories/CVE-2026-76769.md)
  `CVE-2026-76769` · CVE record: Dell Secure Connect Gateway (SCG) Policy Manager · CVSS 4.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [WordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97075.md)
  `CVE-2026-97075` · CVE record: WP Media WP Rocket · CVSS 6.5 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation](https://agentprime.io/advisories/CVE-2026-19574.md)
  `CVE-2026-19574` · CVE record: zephyrproject zephyr · CVSS 7.0 High · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts](https://agentprime.io/advisories/GHSA-xj24-8f5c-pp5p.md)
  `GHSA-xj24-8f5c-pp5p`, `CVE-2026-101028`, `EEF-CVE-2026-101028` · Hex `ash`: affected `>=2.6.0, <3.34.6`, fixed in `3.34.6` · CVSS 6.0 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Code Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet](https://agentprime.io/advisories/CVE-2026-106095.md)
  `CVE-2026-106095` · CVE record: Unknown Code Snippets · CVSS 3.3 Low · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [UnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned Webhook](https://agentprime.io/advisories/CVE-2026-87841.md)
  `CVE-2026-87841` · CVE record: Unknown UnitechPay · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update](https://agentprime.io/advisories/CVE-2026-88931.md)
  `CVE-2026-88931` · CVE record: Unknown Social Web Suite · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deletion](https://agentprime.io/advisories/CVE-2026-86850.md)
  `CVE-2026-86850` · CVE record: Unknown SKU Error Fixer for WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing](https://agentprime.io/advisories/CVE-2026-92989.md)
  `CVE-2026-92989` · CVE record: Unknown SendPress Newsletters · CVSS 4.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Ops Manager Improper Authorization in Daily Host Monitoring Retrieval](https://agentprime.io/advisories/CVE-2026-87108.md)
  `CVE-2026-87108` · CVE record: MongoDB Ops Manager · CVSS 2.3 Low · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTA5VDA1OjU0OjU4Ljc2OTAwMFoiLCJDVkUtMjAyNi04NzEwOCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTA5VDIwOjU3OjQ0LjAwMDAwMFoiLCJHSFNBLXBqcjMtODZ2NC01cDd3Il0>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTA5VDIwOjU3OjQ0LjAwMDAwMFoiLCJHSFNBLXBqcjMtODZ2NC01cDd3Il0>. Everything for agents: <https://agentprime.io/llms.txt>.