# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress WP OAuth Server plugin <= 6.4.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-107433.md)
  `CVE-2026-107433` · CVE record: miniOrange WP OAuth Server · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Improper Authorization in Google Cloud Application Integration Leads to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-85298.md)
  `CVE-2026-85298` · CVE record: Google Cloud Application Integration · CVSS 7.3 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Insecure Permissions on Shared Startup Scripts Allow Cross-User Code Execution and Potential Privilege Escalation](https://agentprime.io/advisories/CVE-2026-108072.md)
  `CVE-2026-108072` · CVE record: TSplus TSplus Remote Access · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [WordPress JetFormBuilder plugin <= 3.6.6 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-107431.md)
  `CVE-2026-107431` · CVE record: Crocoblock JetFormBuilder · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [WPCode 2.0.0 - 2.3.9 - Unauthenticated Snippet Suppression via Safe Mode Bypass](https://agentprime.io/advisories/CVE-2026-101301.md)
  `CVE-2026-101301` · CVE record: Unknown WPCode · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Jeg Kit for Elementor <= 3.2.19 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via 'jeg_find_author' AJAX Action](https://agentprime.io/advisories/CVE-2026-103907.md)
  `CVE-2026-103907` · CVE record: jegtheme Jeg Kit for Elementor – Powerful Addons for Elementor, Widgets & Templates for WordPress · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking\[id\]' and 'cart\[id\]' Parameters](https://agentprime.io/advisories/CVE-2026-103366.md)
  `CVE-2026-103366` · CVE record: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [WordPress Restricted Site Access plugin <= 7.6.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110227.md)
  `CVE-2026-110227` · CVE record: 10up Restricted Site Access · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [WisdomGarden｜Tronclass - Insecure Direct Object Reference](https://agentprime.io/advisories/CVE-2026-110467.md)
  `CVE-2026-110467` · CVE record: WisdomGarden Tronclass · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [WisdomGarden｜Tronclass - Insecure Direct Object Reference](https://agentprime.io/advisories/CVE-2026-110465.md)
  `CVE-2026-110465` · CVE record: WisdomGarden Tronclass · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Cart Abandonment Recovery for WooCommerce < 2.1.4 - Unauthenticated Abandoned Cart Record Deletion and Modification via IDOR](https://agentprime.io/advisories/CVE-2026-96900.md)
  `CVE-2026-96900` · CVE record: Unknown Cart Abandonment Recovery for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Paymentfor Gateway for WooCommerce < 1.0.6 - Unauthenticated Order Payment Forgery via Unverified Card Callbacks](https://agentprime.io/advisories/CVE-2026-94360.md)
  `CVE-2026-94360` · CVE record: Unknown Paymentfor Gateway for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Payment Confirmation Forgery via an Unbound Transaction Id](https://agentprime.io/advisories/CVE-2026-94261.md)
  `CVE-2026-94261` · CVE record: Unknown Sifalo Pay · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Sifalo Pay 2.0 - 2.5.2 - Unauthenticated Order Payment Metadata Modification and Forced Order Failure](https://agentprime.io/advisories/CVE-2026-94260.md)
  `CVE-2026-94260` · CVE record: Unknown Sifalo Pay · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [SellKit 2.3.5 - 2.7.0 - Unauthenticated Arbitrary Price Manipulation via 'sellkit_product_prices' Parameter](https://agentprime.io/advisories/CVE-2026-94254.md)
  `CVE-2026-94254` · CVE record: Unknown SellKit · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [YITH WooCommerce Popup < 1.60.0 - Contributor+ Arbitrary Post Meta Deletion](https://agentprime.io/advisories/CVE-2026-92426.md)
  `CVE-2026-92426` · CVE record: Unknown YITH WooCommerce Popup · CVSS 4.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Robokassa payment for WooCommerce < 1.9.0 - Unauthenticated Arbitrary Order Status Change to Failed](https://agentprime.io/advisories/CVE-2026-91076.md)
  `CVE-2026-91076` · CVE record: Unknown Robokassa payment gateway for Woocommerce · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [rtMedia for WordPress, BuddyPress and bbPress < 4.7.14 - Subscriber+ Arbitrary Album Media Injection via IDOR](https://agentprime.io/advisories/CVE-2026-88927.md)
  `CVE-2026-88927` · CVE record: Unknown rtMedia for WordPress, BuddyPress and bbPress · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Product Feed for Google Shopping < 5.3.2 - Unauthenticated Forced Store Registration](https://agentprime.io/advisories/CVE-2026-87968.md)
  `CVE-2026-87968` · CVE record: Unknown Product Feed for Google Shopping, Microsoft Advertising and 40+ Channels for WooCommerce Merchant · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Trust Payments Gateway for WooCommerce < 3.1.0 - Unauthenticated Order Payment Completion via Payment Return Page](https://agentprime.io/advisories/CVE-2026-87843.md)
  `CVE-2026-87843` · CVE record: Unknown Trust Payments Gateway for WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [EmbedPress < 4.6.8 - Unauthenticated YouTube API Quota Consumption and Database Bloating](https://agentprime.io/advisories/CVE-2026-85000.md)
  `CVE-2026-85000` · CVE record: Unknown EmbedPress · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [WP 2FA < 4.2.0 - Admin+ Arbitrary User 2FA Removal via IDOR](https://agentprime.io/advisories/CVE-2026-108066.md)
  `CVE-2026-108066` · CVE record: Unknown WP 2FA · CVSS 2.7 Low · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [WP Encryption < 7.8.8.2 - Unauthenticated Certificate Private Key and ACME Order Replacement via wple_auto_handler](https://agentprime.io/advisories/CVE-2026-108064.md)
  `CVE-2026-108064` · CVE record: Unknown WP Encryption · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [GamiPress < 8.0.6 - Subscriber+ Activity Log Disclosure](https://agentprime.io/advisories/CVE-2026-107319.md)
  `CVE-2026-107319` · CVE record: Unknown GamiPress · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [LTL Freight Quotes – Old Dominion Edition < 4.2.19 - Unauthenticated FreightDesk Integration Option Update via REST Route](https://agentprime.io/advisories/CVE-2026-107158.md)
  `CVE-2026-107158` · CVE record: Unknown LTL Freight Quotes · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Classified Listing < 6.1.1 - Subscriber+ Unattached Media Deletion and Modification via Gallery AJAX Handlers](https://agentprime.io/advisories/CVE-2026-106646.md)
  `CVE-2026-106646` · CVE record: Unknown Classified Listing · CVSS 5.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [NEX-Forms 9.2.1 - 9.2.5 - Unauthenticated Arbitrary Form Entry Modification via 'nf_set_entry_update_id' Parameter](https://agentprime.io/advisories/CVE-2026-106166.md)
  `CVE-2026-106166` · CVE record: Unknown NEX-Forms · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [WP Data Access < 5.5.77 - Unauthenticated Incorrect Authorization via Inline App Update](https://agentprime.io/advisories/CVE-2026-106098.md)
  `CVE-2026-106098` · CVE record: Unknown WP Data Access · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [CamPay Shortcode Payment Gateway < 1.7 - Unauthenticated Payment Status Forgery via external_reference](https://agentprime.io/advisories/CVE-2026-105975.md)
  `CVE-2026-105975` · CVE record: Unknown CamPay Shortcode Payment Gateway · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Rank Math SEO < 1.0.280 - Unauthenticated SEO Analyzer Results Deletion](https://agentprime.io/advisories/CVE-2026-104751.md)
  `CVE-2026-104751` · CVE record: Unknown Rank Math SEO · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Improper access control in Ubiquiti Inc UniFi Protect AI Key](https://agentprime.io/advisories/CVE-2026-110459.md)
  `CVE-2026-110459` · CVE record: Ubiquiti Inc UniFi Protect AI Key · CVSS 8.6 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Improper access control in Ubiquiti Inc UniFi Protect AI Key](https://agentprime.io/advisories/CVE-2026-110456.md)
  `CVE-2026-110456` · CVE record: Ubiquiti Inc UniFi Protect AI Key · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Improper access control in Ubiquiti Inc UniFi Protect AI Key](https://agentprime.io/advisories/CVE-2026-110454.md)
  `CVE-2026-110454` · CVE record: Ubiquiti Inc UniFi Protect AI Key · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Nix](https://agentprime.io/advisories/CVE-2026-110453.md)
  `CVE-2026-110453` · CVE record: NixOS Nix · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Nix](https://agentprime.io/advisories/CVE-2026-110451.md)
  `CVE-2026-110451` · CVE record: NixOS Nix · CVSS 4.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Abandoned Cart Pro for WooCommerce <= 10.8.0 - Unauthenticated Authentication Bypass via Malleable Encryption and Bypassable HMAC via Recovery Link 'validate' Parameter](https://agentprime.io/advisories/CVE-2026-97657.md)
  `CVE-2026-97657` · CVE record: Tyche Softwares Abandoned Cart Pro for WooCommerce · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Directorist: AI-Powered Business Directory, Listings & Classified Ads <= 8.10.2.1 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Listing Deletion via 'listing_id' Parameter](https://agentprime.io/advisories/CVE-2026-17092.md)
  `CVE-2026-17092` · CVE record: wpwax Directorist: AI-Powered Business Directory, Listings & Classified Ads · CVSS 8.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Database Addon for Contact Form 7 <= 1.4.1 - Unauthenticated Limited File Deletion via Injected 'attackcfdb7_file' Submission Field](https://agentprime.io/advisories/CVE-2026-107652.md)
  `CVE-2026-107652` · CVE record: arshidkv12 Database Addon for Contact Form 7 – CFDB7 · CVSS 5.3 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Booking Package <= 1.7.29 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'mode=sendBooking' with nonexistent 'timeKey' and 'public=0'](https://agentprime.io/advisories/CVE-2026-103423.md)
  `CVE-2026-103423` · CVE record: masaakitanaka Booking Package · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Incorrect default permissions in Hyland Desktop Host](https://agentprime.io/advisories/CVE-2026-110359.md)
  `CVE-2026-110359` · CVE record: Hyland Desktop Host · CVSS 7.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Inductive Automation Ignition Software Incorrect Authorization](https://agentprime.io/advisories/CVE-2026-92817.md)
  `CVE-2026-92817` · CVE record: Inductive Automation Ignition · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Insecure direct object reference in HYPR Passwordless](https://agentprime.io/advisories/CVE-2026-15468.md)
  `CVE-2026-15468` · CVE record: HYPR Passwordless · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [CAI Content Credentials | Improper Access Control (CWE-284)](https://agentprime.io/advisories/CVE-2026-100114.md)
  `CVE-2026-100114` · CVE record: Adobe Content Credentials Rust SDK and 2 more · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [CAI Content Credentials | Improper Access Control (CWE-284)](https://agentprime.io/advisories/CVE-2026-100115.md)
  `CVE-2026-100115` · CVE record: Adobe Content Credentials Rust SDK and 2 more · CVSS 7.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-110144.md)
  `CVE-2026-110144` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-110159.md)
  `CVE-2026-110159` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-110160.md)
  `CVE-2026-110160` · CVE record: Google Chrome · CVSS 4.2 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Photoshop Desktop | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-95639.md)
  `CVE-2026-95639` · CVE record: Adobe Photoshop · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Indico legacy contribution export cache poisoning discloses restricted metadata](https://agentprime.io/advisories/CVE-2026-108388.md)
  `CVE-2026-108388` · CVE record: indico indico · CVSS 3.5 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-106618.md)
  `CVE-2026-106618` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-105994.md)
  `CVE-2026-105994` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-106089.md)
  `CVE-2026-106089` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-106614.md)
  `CVE-2026-106614` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-105898.md)
  `CVE-2026-105898` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 8.2 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-75994.md)
  `CVE-2026-75994` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-106090.md)
  `CVE-2026-106090` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-106620.md)
  `CVE-2026-106620` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-106612.md)
  `CVE-2026-106612` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-106615.md)
  `CVE-2026-106615` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ColdFusion | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-105901.md)
  `CVE-2026-105901` · CVE record: Adobe ColdFusion 2025 and 1 more · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTEzVDIwOjIxOjI1LjgwODAwMFoiLCJDVkUtMjAyNi0xMDU5MDEiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTE0VDEyOjA4OjI4LjMyMzAwMFoiLCJDVkUtMjAyNi0xMDc0MjUiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTE0VDEyOjA4OjI4LjMyMzAwMFoiLCJDVkUtMjAyNi0xMDc0MjUiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.