# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97280.md)
  `CVE-2026-97280` · CVE record: Mamunur Rashid Review Schema · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [SiYuan discloses an administrator's open documents and search terms to anonymous readers](https://agentprime.io/advisories/GHSA-hgfg-j9pg-43xw.md)
  `GHSA-hgfg-j9pg-43xw`, `CVE-2026-72788`, `GO-2026-6622` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260812083335-251596fc0de2`, fixed in `0.0.0-20260812083335-251596fc0de2` · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-100517.md)
  `CVE-2026-100517` · CVE record: VillaTheme Photo Reviews for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-100514.md)
  `CVE-2026-100514` · CVE record: Pete Nelson REST API Log · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97297.md)
  `CVE-2026-97297` · CVE record: Apps Mav Gratisfaction · CVSS 7.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97281.md)
  `CVE-2026-97281` · CVE record: weDevs WP Project Manager · CVSS 6.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress Social Boost plugin <= 3.6.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97277.md)
  `CVE-2026-97277` · CVE record: Apps Mav Social Boost · CVSS 7.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-97269.md)
  `CVE-2026-97269` · CVE record: WPFunnels WPFunnels · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress Aruba Migration Tool plugin <= 1.0.4 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97258.md)
  `CVE-2026-97258` · CVE record: Aruba.it Aruba Migration Tool · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.3 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-97251.md)
  `CVE-2026-97251` · CVE record: magepeopleteam Bus Ticket Booking with Seat Reservation · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62073.md)
  `CVE-2026-62073` · CVE record: Themeisle WP Full Stripe Free · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-62061.md)
  `CVE-2026-62061` · CVE record: Metagauss ProfileGrid · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress WpTravelly plugin <= 2.3.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62063.md)
  `CVE-2026-62063` · CVE record: Magepeople inc. WpTravelly · CVSS 5.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-102390.md)
  `CVE-2026-102390` · CVE record: VillaTheme AFFI – Affiliate Marketing for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature](https://agentprime.io/advisories/GHSA-wj4w-mc24-pcfm.md)
  `GHSA-wj4w-mc24-pcfm` · npm `ghost`: affected `>=5.9.0, <6.44.1`, fixed in `6.44.1` · CVSS 6.5 Medium · Withdrawn · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-102382.md)
  `CVE-2026-102382` · CVE record: Ahmad Majestic Support · CVSS 4.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress Majestic Support plugin <= 1.2.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-102381.md)
  `CVE-2026-102381` · CVE record: Ahmad Majestic Support · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-103341.md)
  `CVE-2026-103341` · CVE record: Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-103340.md)
  `CVE-2026-103340` · CVE record: Gemini Labs Site Reviews · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions](https://agentprime.io/advisories/CVE-2026-103858.md)
  `CVE-2026-103858` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route](https://agentprime.io/advisories/CVE-2026-103758.md)
  `CVE-2026-103758` · CVE record: obot-platform obot · CVSS 8.6 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback](https://agentprime.io/advisories/CVE-2026-103284.md)
  `CVE-2026-103284` · CVE record: TryGhost Ghost · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read](https://agentprime.io/advisories/CVE-2026-103274.md)
  `CVE-2026-103274` · CVE record: TryGhost Ghost · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token](https://agentprime.io/advisories/CVE-2026-103273.md)
  `CVE-2026-103273` · CVE record: TryGhost Ghost · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Ghost 4.0.0 before 6.63.0 Restricted Content Bypass](https://agentprime.io/advisories/CVE-2026-103271.md)
  `CVE-2026-103271` · CVE record: TryGhost Ghost · CVSS 8.7 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts](https://agentprime.io/advisories/CVE-2026-103269.md)
  `CVE-2026-103269` · CVE record: TryGhost Ghost · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset](https://agentprime.io/advisories/CVE-2026-103268.md)
  `CVE-2026-103268` · CVE record: TryGhost Ghost · CVSS 8.7 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification](https://agentprime.io/advisories/CVE-2026-103266.md)
  `CVE-2026-103266` · CVE record: TryGhost Ghost · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Fleet before 4.89.0 Information Disclosure via MDM Command Results](https://agentprime.io/advisories/CVE-2026-103265.md)
  `CVE-2026-103265` · CVE record: fleetdm fleet · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node](https://agentprime.io/advisories/CVE-2026-103260.md)
  `CVE-2026-103260` · CVE record: n8n-io n8n · CVSS 6.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials](https://agentprime.io/advisories/CVE-2026-103259.md)
  `CVE-2026-103259` · CVE record: n8n-io n8n · CVSS 8.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint](https://agentprime.io/advisories/CVE-2026-103252.md)
  `CVE-2026-103252` · CVE record: n8n-io n8n · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub](https://agentprime.io/advisories/CVE-2026-103251.md)
  `CVE-2026-103251` · CVE record: n8n-io n8n · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [n8n before 1.123.80 Credential Tampering via Duplicate Node IDs](https://agentprime.io/advisories/CVE-2026-103247.md)
  `CVE-2026-103247` · CVE record: n8n-io n8n · CVSS 5.8 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection](https://agentprime.io/advisories/CVE-2026-103246.md)
  `CVE-2026-103246` · CVE record: n8n-io n8n · CVSS 8.3 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure](https://agentprime.io/advisories/CVE-2026-64948.md)
  `CVE-2026-64948` · CVE record: Pandora FMS Pandora FMS · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Insecure direct object reference in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103496.md)
  `CVE-2026-103496` · CVE record: JetBrains YouTrack · CVSS 5.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103495.md)
  `CVE-2026-103495` · CVE record: JetBrains YouTrack · CVSS 4.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Insecure direct object reference in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103491.md)
  `CVE-2026-103491` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103490.md)
  `CVE-2026-103490` · CVE record: JetBrains YouTrack · CVSS 7.2 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-103488.md)
  `CVE-2026-103488` · CVE record: JetBrains YouTrack · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes](https://agentprime.io/advisories/CVE-2026-103659.md)
  `CVE-2026-103659` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter](https://agentprime.io/advisories/CVE-2026-93882.md)
  `CVE-2026-93882` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback](https://agentprime.io/advisories/CVE-2026-96200.md)
  `CVE-2026-96200` · CVE record: Unknown Payments for Hubtel · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR](https://agentprime.io/advisories/CVE-2026-96173.md)
  `CVE-2026-96173` · CVE record: Unknown Payments for Hubtel · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update](https://agentprime.io/advisories/CVE-2026-90974.md)
  `CVE-2026-90974` · CVE record: Unknown WP Fusion Lite · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion](https://agentprime.io/advisories/CVE-2026-90972.md)
  `CVE-2026-90972` · CVE record: Unknown WP Fusion Lite · CVSS 5.4 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint](https://agentprime.io/advisories/CVE-2026-80275.md)
  `CVE-2026-80275` · CVE record: Comelit Group S.p.A. 1456B Multi-User Gateway · CVSS 8.8 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter](https://agentprime.io/advisories/CVE-2026-88999.md)
  `CVE-2026-88999` · CVE record: davidanderson Redux Framework · CVSS 4.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload](https://agentprime.io/advisories/CVE-2026-103541.md)
  `CVE-2026-103541` · CVE record: formtools.org Form Tools · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [Improper authorization may allow a general user to perform operations equivalent to those available with administrator privileges](https://agentprime.io/advisories/CVE-2026-82828.md)
  `CVE-2026-82828` · CVE record: Hitachi Industrial Equipment Systems Hitachi Coding Software Suite · CVSS 8.7 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Genians, Inc Genian NAC/ZTNA Remote Code Execution](https://agentprime.io/advisories/CVE-2026-76147.md)
  `CVE-2026-76147` · CVE record: Genians, Inc Genian NAC 4.0.175 Release and 4 more · CVSS 5.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Path traversal, Broken access control, CWE-807
- [Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass](https://agentprime.io/advisories/CVE-2026-76143.md)
  `CVE-2026-76143` · CVE record: Genians, Inc Genian SSL PNS (frodo-core) · CVSS 7.3 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface](https://agentprime.io/advisories/CVE-2026-76142.md)
  `CVE-2026-76142` · CVE record: Genians, Inc Genian NAC 5.0.75 LTS Release and 4 more · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control, Authentication bypass
- [Incorrect authorization in Octopus Deploy Octopus Server](https://agentprime.io/advisories/CVE-2026-78210.md)
  `CVE-2026-78210` · CVE record: Octopus Deploy Octopus Server · CVSS 7.1 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control](https://agentprime.io/advisories/CVE-2026-103534.md)
  `CVE-2026-103534` · CVE record: David-Crty databasement · CVSS 5.3 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter](https://agentprime.io/advisories/CVE-2026-91109.md)
  `CVE-2026-91109` · CVE record: croixhaug Simply Schedule Appointments · CVSS 6.5 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_typ…](https://agentprime.io/advisories/CVE-2026-92245.md)
  `CVE-2026-92245` · CVE record: croixhaug Simply Schedule Appointments · CVSS 7.5 High · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control
- [immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization](https://agentprime.io/advisories/CVE-2026-103532.md)
  `CVE-2026-103532` · CVE record: immich-app Immich · CVSS 6.9 Medium · Not analysed yet · Published 1 Oct 2026 · Tags: Privilege escalation, Broken access control
- [RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app).](https://agentprime.io/advisories/CVE-2026-51897.md)
  `CVE-2026-51897` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTAxVDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyNi01MTg5NyJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTAxVDE1OjA4OjUyLjcyMTAwMFoiLCJDVkUtMjAyNi0xNzA1MyJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTAxVDE1OjA4OjUyLjcyMTAwMFoiLCJDVkUtMjAyNi0xNzA1MyJd>. Everything for agents: <https://agentprime.io/llms.txt>.