# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [infiniflow ragflow 0.25.3 contains improper access control in resume (api/apps/connector_app.py).](https://agentprime.io/advisories/CVE-2026-51896.md)
  `CVE-2026-51896` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Ragflow 0.24.0 and prior contains improper access control in update_metadata_setting (api/apps/kb_app.py).](https://agentprime.io/advisories/CVE-2026-51895.md)
  `CVE-2026-51895` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via run_mindmap.](https://agentprime.io/advisories/CVE-2026-51894.md)
  `CVE-2026-51894` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via trace_mindmap.](https://agentprime.io/advisories/CVE-2026-51893.md)
  `CVE-2026-51893` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [infiniflow ragflow 0.24.0 is vulnerable to Incorrect Access Control via /v1/document/get/\<doc_id>.](https://agentprime.io/advisories/CVE-2026-51892.md)
  `CVE-2026-51892` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TutorBotManager.write_bot_file.](https://agentprime.io/advisories/CVE-2026-51879.md)
  `CVE-2026-51879` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [deeptutor 1.4.0 contains an authorization bypass through a user-controlled object identifier in TurnRuntimeManager.regenerate_last_turn.](https://agentprime.io/advisories/CVE-2026-51878.md)
  `CVE-2026-51878` · CVE record · CVSS 4.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [DeepTutor 1.4.0 contains an authorization bypass vulnerability in the book confirmation flow.](https://agentprime.io/advisories/CVE-2026-51876.md)
  `CVE-2026-51876` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Kiteworks Core user impersonation in a file-request feature](https://agentprime.io/advisories/CVE-2026-102107.md)
  `CVE-2026-102107` · CVE record: Kiteworks Core · CVSS 4.6 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Kiteworks Core Incorrect Authorization](https://agentprime.io/advisories/CVE-2026-102122.md)
  `CVE-2026-102122` · CVE record: Kiteworks Core · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Kiteworks Core Privilege Escalation through Improper Access Control](https://agentprime.io/advisories/CVE-2026-102132.md)
  `CVE-2026-102132` · CVE record: Kiteworks Core · CVSS 7.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Kiteworks Email Protection Gateway Incorrect Authorization](https://agentprime.io/advisories/CVE-2026-102139.md)
  `CVE-2026-102139` · CVE record: Kiteworks Email Protection Gateway · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in OpenBSD](https://agentprime.io/advisories/CVE-2026-103547.md)
  `CVE-2026-103547` · CVE record: OpenBSD OpenBSD · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [OpenClaw Windows Node before 2026.7.1 Authorization Bypass](https://agentprime.io/advisories/CVE-2026-101880.md)
  `CVE-2026-101880` · CVE record: OpenClaw OpenClaw Windows Node · CVSS 8.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [OpenClaw Windows Node before 2026.7.1-3 Missing Authorization](https://agentprime.io/advisories/CVE-2026-101879.md)
  `CVE-2026-101879` · CVE record: OpenClaw OpenClaw Windows Node · CVSS 7.1 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Optimole plugin <= 4.2.14 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-102375.md)
  `CVE-2026-102375` · CVE record: Optimole Optimole · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Ultimate Maps by Supsystic plugin <= 1.5.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-102397.md)
  `CVE-2026-102397` · CVE record: supsystic Ultimate Maps by Supsystic · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [yii2-starter-kit through 4.2.0 Unauthorized File Download via attachment-download](https://agentprime.io/advisories/CVE-2026-103476.md)
  `CVE-2026-103476` · CVE record: yii2-starter-kit yii2-starter-kit · CVSS 6.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WikiLambda exposes anonymous execution of unsaved Abstract Wikipedia fragments](https://agentprime.io/advisories/CVE-2026-103446.md)
  `CVE-2026-103446` · CVE record: The Wikimedia Foundation MediaWiki WikiLambda extension · CVSS 7.4 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Tugtainer: Unauthenticated access to Tugtainer Agent Docker management APIs when AGENT_SECRET is unset](https://agentprime.io/advisories/CVE-2026-55494.md)
  `CVE-2026-55494` · CVE record: Quenary tugtainer · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Tugtainer: OIDC login remains accessible when OIDC_ENABLED is false](https://agentprime.io/advisories/CVE-2026-55181.md)
  `CVE-2026-55181` · CVE record: Quenary tugtainer · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Soft Machine: Cross-tenant workspace API auth bypass via shared \`CONTAINER_SHARED_SECRET\` bearer token](https://agentprime.io/advisories/CVE-2026-55176.md)
  `CVE-2026-55176` · CVE record: Soft-Machine-io security · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [AdithyaYelloju Restaurant-Management-System Admin Area admin authorization](https://agentprime.io/advisories/CVE-2026-103233.md)
  `CVE-2026-103233` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Missing authorization in NVIDIA Virtual GPU Manager](https://agentprime.io/advisories/CVE-2026-47493.md)
  `CVE-2026-47493` · CVE record: NVIDIA Virtual GPU Manager · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Missing authorization in NVIDIA GeForce and others](https://agentprime.io/advisories/CVE-2026-47604.md)
  `CVE-2026-47604` · CVE record: NVIDIA GeForce and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Missing authorization in NVIDIA GeForce and others](https://agentprime.io/advisories/CVE-2026-47603.md)
  `CVE-2026-47603` · CVE record: NVIDIA GeForce and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Missing authorization in NVIDIA GeForce and others](https://agentprime.io/advisories/CVE-2026-47492.md)
  `CVE-2026-47492` · CVE record: NVIDIA GeForce and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Incorrect permission assignment in NVIDIA GeForce and others](https://agentprime.io/advisories/CVE-2026-47518.md)
  `CVE-2026-47518` · CVE record: NVIDIA GeForce and 2 more · CVSS 6.0 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Missing authorization in NVIDIA GeForce and others](https://agentprime.io/advisories/CVE-2026-47580.md)
  `CVE-2026-47580` · CVE record: NVIDIA GeForce and 2 more · CVSS 7.3 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in NVIDIA GeForce and others](https://agentprime.io/advisories/CVE-2026-47591.md)
  `CVE-2026-47591` · CVE record: NVIDIA GeForce and 3 more · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in NVIDIA GeForce and others](https://agentprime.io/advisories/CVE-2026-47571.md)
  `CVE-2026-47571` · CVE record: NVIDIA GeForce and 4 more · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Missing authorization in NVIDIA GeForce and others](https://agentprime.io/advisories/CVE-2026-47559.md)
  `CVE-2026-47559` · CVE record: NVIDIA GeForce and 3 more · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Missing authorization in NVIDIA GeForce and others](https://agentprime.io/advisories/CVE-2026-47552.md)
  `CVE-2026-47552` · CVE record: NVIDIA GeForce and 4 more · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100280.md)
  `CVE-2026-100280` · CVE record: JetBrains YouTrack · CVSS 3.1 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100278.md)
  `CVE-2026-100278` · CVE record: JetBrains YouTrack · CVSS 4.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100277.md)
  `CVE-2026-100277` · CVE record: JetBrains YouTrack · CVSS 8.9 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100276.md)
  `CVE-2026-100276` · CVE record: JetBrains YouTrack · CVSS 5.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100273.md)
  `CVE-2026-100273` · CVE record: JetBrains YouTrack · CVSS 8.2 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Insecure direct object reference in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100272.md)
  `CVE-2026-100272` · CVE record: JetBrains YouTrack · CVSS 4.9 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100271.md)
  `CVE-2026-100271` · CVE record: JetBrains YouTrack · CVSS 2.7 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100270.md)
  `CVE-2026-100270` · CVE record: JetBrains YouTrack · CVSS 3.3 Low · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100269.md)
  `CVE-2026-100269` · CVE record: JetBrains YouTrack · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Insecure direct object reference in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100268.md)
  `CVE-2026-100268` · CVE record: JetBrains YouTrack · CVSS 7.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Missing authorization in JetBrains Hub](https://agentprime.io/advisories/CVE-2026-100266.md)
  `CVE-2026-100266` · CVE record: JetBrains Hub · CVSS 7.7 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100262.md)
  `CVE-2026-100262` · CVE record: JetBrains YouTrack · CVSS 7.6 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-100259.md)
  `CVE-2026-100259` · CVE record: JetBrains YouTrack · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [bbs-go through 4.4.6 Incorrect Authorization via /api/admin/user/synccount](https://agentprime.io/advisories/CVE-2026-103396.md)
  `CVE-2026-103396` · CVE record: mlogclub bbs-go · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Pay with Vipps for WooCommerce plugin <= 6.2.4 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-97259.md)
  `CVE-2026-97259` · CVE record: WP Hosting AS Pay with Vipps for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [Missing Authorization Check in Vaadin Spreadsheet Allows Cell Comments to Be Written to Protected Sheets and Locked Cells](https://agentprime.io/advisories/CVE-2026-93547.md)
  `CVE-2026-93547` · CVE record: vaadin vaadin and 2 more · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress The Events Calendar plugin <= 6.17.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97285.md)
  `CVE-2026-97285` · CVE record: Nexcess The Events Calendar · CVSS 5.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Review Schema plugin <= 3.1.0 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-97282.md)
  `CVE-2026-97282` · CVE record: RadiusTheme Review Schema · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Prevent files / folders access plugin <= 2.6.7 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97267.md)
  `CVE-2026-97267` · CVE record: miniOrange Prevent files / folders access · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Blocksy Companion plugin <= 2.1.55 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97247.md)
  `CVE-2026-97247` · CVE record: Creative Themes Blocksy Companion · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress AllAble Connector plugin <= 0.13.4 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97243.md)
  `CVE-2026-97243` · CVE record: flexyma AllAble Connector · CVSS 5.4 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress MCP Content Manager Lite plugin <= 1.1.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97239.md)
  `CVE-2026-97239` · CVE record: Jose Conti MCP Content Manager Lite · CVSS 6.5 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress WordPress Backup & Migration plugin <= 1.6.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97197.md)
  `CVE-2026-97197` · CVE record: WebToffee WordPress Backup & Migration · CVSS 7.5 High · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Webba Booking plugin <= 6.5.0 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-97079.md)
  `CVE-2026-97079` · CVE record: Webba Appointment Booking Webba Booking · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Client Invoicing by Sprout Invoices plugin <= 20.8.17 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-97078.md)
  `CVE-2026-97078` · CVE record: BoldGrid Client Invoicing by Sprout Invoices · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress Newsletters, Email Marketing, SMS and Popups by Omnisend plugin <= 1.9.0 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-97074.md)
  `CVE-2026-97074` · CVE record: Omnisend Newsletters, Email Marketing, SMS and Popups by Omnisend · CVSS 4.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control
- [WordPress GiveWP plugin <= 4.16.9 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-97066.md)
  `CVE-2026-97066` · CVE record: Nexcess GiveWP · CVSS 5.3 Medium · Not analysed yet · Published 30 Sept 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTA5LTMwVDEyOjI3OjQ5Ljk4NTAwMFoiLCJDVkUtMjAyNi05NzA2NiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTAxVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi01MTg5NyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTAxVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi01MTg5NyJd>. Everything for agents: <https://agentprime.io/llms.txt>.