# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Plane: Any project member can modify (deactivate) other members' records](https://agentprime.io/advisories/CVE-2026-102985.md)
  `CVE-2026-102985` · CVE record: makeplane plane · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/](https://agentprime.io/advisories/CVE-2026-102986.md)
  `CVE-2026-102986` · CVE record: makeplane plane · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)](https://agentprime.io/advisories/CVE-2026-55382.md)
  `CVE-2026-55382` · CVE record: InvoiceShelf InvoiceShelf · CVSS 7.6 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates](https://agentprime.io/advisories/CVE-2026-55381.md)
  `CVE-2026-55381` · CVE record: InvoiceShelf InvoiceShelf · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure](https://agentprime.io/advisories/CVE-2026-55383.md)
  `CVE-2026-55383` · CVE record: InvoiceShelf InvoiceShelf · CVSS 8.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [InvoiceShelf bulk deletion lacks company scoping](https://agentprime.io/advisories/CVE-2026-55387.md)
  `CVE-2026-55387` · CVE record: InvoiceShelf InvoiceShelf · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [InvoiceShelf trusts client-supplied document totals](https://agentprime.io/advisories/CVE-2026-55384.md)
  `CVE-2026-55384` · CVE record: InvoiceShelf InvoiceShelf · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control, CWE-472
- [Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access](https://agentprime.io/advisories/CVE-2026-110775.md)
  `CVE-2026-110775` · CVE record: ModelEngine-Group nexent · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Blinko through 1.8.8 Private Attachment Read via /api/file Route](https://agentprime.io/advisories/CVE-2026-110774.md)
  `CVE-2026-110774` · CVE record: blinkospace blinko · CVSS 6.0 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint](https://agentprime.io/advisories/CVE-2026-110773.md)
  `CVE-2026-110773` · CVE record: growchief growchief · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update](https://agentprime.io/advisories/CVE-2026-110772.md)
  `CVE-2026-110772` · CVE record: we-promise sure · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Shopizer through 3.2.5 Authorization Bypass via Product Review customerId](https://agentprime.io/advisories/CVE-2026-110771.md)
  `CVE-2026-110771` · CVE record: Shopizer Shopizer · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download](https://agentprime.io/advisories/CVE-2026-110764.md)
  `CVE-2026-110764` · CVE record: iflytek astron-rpa · CVSS 6.0 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany](https://agentprime.io/advisories/CVE-2026-110763.md)
  `CVE-2026-110763` · CVE record: zuihou lamp-boot · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream](https://agentprime.io/advisories/CVE-2026-110762.md)
  `CVE-2026-110762` · CVE record: bbPress bbPress · CVSS 6.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Eclipse Foundation Eclipse Vert.x](https://agentprime.io/advisories/CVE-2026-102460.md)
  `CVE-2026-102460` · CVE record: Eclipse Foundation Eclipse Vert.x · CVSS 8.6 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [WordPress Skydropx plugin <= 2.1.4 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-108480.md)
  `CVE-2026-108480` · CVE record: Skydropx Skydropx · CVSS 8.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access](https://agentprime.io/advisories/CVE-2026-77371.md)
  `CVE-2026-77371` · CVE record: getredash redash · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [ServiceNext Insecure Direct Object Reference via GetUsarios](https://agentprime.io/advisories/CVE-2026-79957.md)
  `CVE-2026-79957` · CVE record: ServiceNext SerTec · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Microsoft Office SharePoint Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-88164.md)
  `CVE-2026-88164` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Zulip: Guests can read new messages in non-subscribed public channels](https://agentprime.io/advisories/CVE-2026-100404.md)
  `CVE-2026-100404` · CVE record: zulip zulip · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Discourse: Media uploads remain publicly accessible after category permissions are restricted](https://agentprime.io/advisories/CVE-2026-91157.md)
  `CVE-2026-91157` · CVE record: discourse discourse · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Broken access control
- [Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users](https://agentprime.io/advisories/CVE-2026-91156.md)
  `CVE-2026-91156` · CVE record: discourse discourse · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [MOVEit Transfer Authorization Flaw in Certificate Management](https://agentprime.io/advisories/CVE-2026-89072.md)
  `CVE-2026-89072` · CVE record: Progress MOVEit Transfer · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation](https://agentprime.io/advisories/CVE-2026-87093.md)
  `CVE-2026-87093` · CVE record: Progress MOVEit Transfer · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea private attachment disclosure through repository mismatch](https://agentprime.io/advisories/CVE-2026-78433.md)
  `CVE-2026-78433` · CVE record: Gitea Gitea · CVSS 5.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control, CWE-1220
- [Gitea API token scope escalation through HTTP signatures](https://agentprime.io/advisories/CVE-2026-73804.md)
  `CVE-2026-73804` · CVE record: Gitea Gitea · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Gitea private workflow badge token scope bypass](https://agentprime.io/advisories/CVE-2026-73126.md)
  `CVE-2026-73126` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea private pull request title disclosure through markup](https://agentprime.io/advisories/CVE-2026-71301.md)
  `CVE-2026-71301` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea fork workflow approval bypass through review events](https://agentprime.io/advisories/CVE-2026-71184.md)
  `CVE-2026-71184` · CVE record: Gitea Gitea · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea organization listing token scope bypass](https://agentprime.io/advisories/CVE-2026-70407.md)
  `CVE-2026-70407` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea private comparison disclosure with public-only tokens](https://agentprime.io/advisories/CVE-2026-70406.md)
  `CVE-2026-70406` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea local code execution through writable Git hooks](https://agentprime.io/advisories/CVE-2026-70402.md)
  `CVE-2026-70402` · CVE record: Gitea Gitea · CVSS 5.8 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea private migration creation with public-only tokens](https://agentprime.io/advisories/CVE-2026-70400.md)
  `CVE-2026-70400` · CVE record: Gitea Gitea · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea organization repository creation token scope bypass](https://agentprime.io/advisories/CVE-2026-70396.md)
  `CVE-2026-70396` · CVE record: Gitea Gitea · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea restricted-user SSH and GPG key metadata disclosure](https://agentprime.io/advisories/CVE-2026-68964.md)
  `CVE-2026-68964` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea restricted-user issue search disclosure](https://agentprime.io/advisories/CVE-2026-68957.md)
  `CVE-2026-68957` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea restricted-user activity and heatmap disclosure](https://agentprime.io/advisories/CVE-2026-67577.md)
  `CVE-2026-67577` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea fork workflow approval bypass through concurrency cancellation](https://agentprime.io/advisories/CVE-2026-66877.md)
  `CVE-2026-66877` · CVE record: Gitea Gitea · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea required Actions check bypass through skipped workflows](https://agentprime.io/advisories/CVE-2026-66874.md)
  `CVE-2026-66874` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control, CWE-345, CWE-693, CWE-807
- [Gitea restricted-user organization metadata disclosure](https://agentprime.io/advisories/CVE-2026-66853.md)
  `CVE-2026-66853` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Broken access control
- [Gitea restricted-user package visibility bypass](https://agentprime.io/advisories/CVE-2026-66849.md)
  `CVE-2026-66849` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Gitea organization team policy bypass through repository API](https://agentprime.io/advisories/CVE-2026-60010.md)
  `CVE-2026-60010` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Privilege escalation, Broken access control
- [VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment](https://agentprime.io/advisories/CVE-2026-110630.md)
  `CVE-2026-110630` · CVE record: venturedrake laravel-crm · CVSS 7.0 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions](https://agentprime.io/advisories/CVE-2026-110629.md)
  `CVE-2026-110629` · CVE record: venturedrake laravel-crm · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all](https://agentprime.io/advisories/CVE-2026-110624.md)
  `CVE-2026-110624` · CVE record: papermerge papermerge-core · CVSS 2.3 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API](https://agentprime.io/advisories/CVE-2026-110623.md)
  `CVE-2026-110623` · CVE record: papermerge papermerge-core · CVSS 7.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints](https://agentprime.io/advisories/CVE-2026-110622.md)
  `CVE-2026-110622` · CVE record: papermerge papermerge-core · CVSS 7.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId](https://agentprime.io/advisories/CVE-2026-110621.md)
  `CVE-2026-110621` · CVE record: Swetrix swetrix · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId](https://agentprime.io/advisories/CVE-2026-110620.md)
  `CVE-2026-110620` · CVE record: formbricks formbricks · CVSS 6.1 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint](https://agentprime.io/advisories/CVE-2026-110617.md)
  `CVE-2026-110617` · CVE record: rachelos we-mp-rss · CVSS 6.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Missing Authorization via /user/batchSetStatus](https://agentprime.io/advisories/CVE-2026-110615.md)
  `CVE-2026-110615` · CVE record: jishenghua jshERP · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List](https://agentprime.io/advisories/CVE-2026-110613.md)
  `CVE-2026-110613` · CVE record: youlaitech youlai-mall · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid](https://agentprime.io/advisories/CVE-2026-110611.md)
  `CVE-2026-110611` · CVE record: getrebuild rebuild · CVSS 6.0 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive](https://agentprime.io/advisories/CVE-2026-110608.md)
  `CVE-2026-110608` · CVE record: BizSpring BizSpring Shop and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access](https://agentprime.io/advisories/CVE-2025-71433.md)
  `CVE-2025-71433` · CVE record: usekaneo kaneo · CVSS 7.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-107417.md)
  `CVE-2026-107417` · CVE record: Muralidharan Ramasamy Push Notification for Post and BuddyPress · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-107426.md)
  `CVE-2026-107426` · CVE record: VideoWhisper.com Paid Videochat Turnkey Site · CVSS 7.3 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Radar < 1.12.2 Missing Authorization via /api/local-terminal](https://agentprime.io/advisories/CVE-2026-82026.md)
  `CVE-2026-82026` · CVE record: skyhook-io radar · CVSS 8.7 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-107425.md)
  `CVE-2026-107425` · CVE record: Magepeople inc. Bus Ticket Booking with Seat Reservation · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTE0VDEyOjA4OjI4LjMyMzAwMFoiLCJDVkUtMjAyNi0xMDc0MjUiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTE0VDE5OjMzOjA3LjkxNjAwMFoiLCJDVkUtMjAyNi0xMDI5ODAiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTE0VDE5OjMzOjA3LjkxNjAwMFoiLCJDVkUtMjAyNi0xMDI5ODAiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.