# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-109897.md)
  `CVE-2026-109897` · CVE record: WP Chill Strong Testimonials · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [WordPress Ninja Forms Signature Contract Add-On plugin <= 3.2.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110378.md)
  `CVE-2026-110378` · CVE record: WP E-Signature Ninja Forms Signature Contract Add-On · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [WordPress WP EasyPay plugin <= 4.5.4 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-96449.md)
  `CVE-2026-96449` · CVE record: WPExperts WP EasyPay · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [WordPress ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes plugin <= 1.5.3 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-103083.md)
  `CVE-2026-103083` · CVE record: ELEXtensions ELEX WooCommerce Advanced Bulk Edit Products, Prices & Attributes · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [WordPress Simply Schedule Appointments plugin <= 1.6.12.35 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-110381.md)
  `CVE-2026-110381` · CVE record: NSquared Simply Schedule Appointments · CVSS 6.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [WordPress AI Engine plugin <= 3.8.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110888.md)
  `CVE-2026-110888` · CVE record: Meow Apps AI Engine · CVSS 4.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [WordPress WordLift plugin <= 3.54.15 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110891.md)
  `CVE-2026-110891` · CVE record: WordLift Srl WordLift · CVSS 5.4 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110367.md)
  `CVE-2026-110367` · CVE record: WPExperts APIExperts Square for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [WordPress Strong Testimonials plugin <= 3.3.12 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110371.md)
  `CVE-2026-110371` · CVE record: WP Chill Strong Testimonials · CVSS 4.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [AsyncHttpClient: Resumable download index store is created world-readable and follows a planted symlink](https://agentprime.io/advisories/CVE-2026-102740.md)
  `CVE-2026-102740` · CVE record: AsyncHttpClient async-http-client · CVSS 5.8 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control, CWE-61, CWE-379
- [Discourse ActivityPub: Fix inbound actor validation and apply outbound request SSRF hardening](https://agentprime.io/advisories/CVE-2026-55103.md)
  `CVE-2026-55103` · CVE record: discourse discourse-activity-pub · CVSS 8.6 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control, CWE-345
- [Lychee: Webshop checkout lets the client override the payment \`amount\` sent to the gateway via malicious crafted POST request](https://agentprime.io/advisories/CVE-2026-77470.md)
  `CVE-2026-77470` · CVE record: LycheeOrg Lychee · CVSS 8.3 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control, CWE-20, CWE-472
- [Lychee: Album password bypass in ZIP downloads](https://agentprime.io/advisories/CVE-2026-61838.md)
  `CVE-2026-61838` · CVE record: LycheeOrg Lychee · CVSS 8.2 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Lychee: unauthenticated photo starring reveals existence of private photos when photos_star_visibility=anonymous](https://agentprime.io/advisories/CVE-2026-61610.md)
  `CVE-2026-61610` · CVE record: LycheeOrg Lychee · CVSS 2.3 Low · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Nexus Repository 3 - Privilege Escalation via Role Management](https://agentprime.io/advisories/CVE-2026-97712.md)
  `CVE-2026-97712` · CVE record: Sonatype Nexus Repository 3 · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Nexus Repository 3 - Missing Authorization on NuGet Symbol Package Upload](https://agentprime.io/advisories/CVE-2026-97665.md)
  `CVE-2026-97665` · CVE record: Sonatype Nexus Repository 3 · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Missing authorization in JetBrains YouTrack](https://agentprime.io/advisories/CVE-2026-111092.md)
  `CVE-2026-111092` · CVE record: JetBrains YouTrack · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [OPNsense: Direct comma-separated user privileges bypass OPNsense MVC read-only write protection](https://agentprime.io/advisories/CVE-2026-71490.md)
  `CVE-2026-71490` · CVE record: opnsense core · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [EspoCRM: Access control bypass in Mass Update letting regular user with Mass Update permission read any attachment](https://agentprime.io/advisories/CVE-2026-75505.md)
  `CVE-2026-75505` · CVE record: espocrm espocrm · CVSS 6.0 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [EspoCRM: Mass email template renderer leaks restricted record fields](https://agentprime.io/advisories/CVE-2026-77460.md)
  `CVE-2026-77460` · CVE record: espocrm espocrm · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [EspoCRM: IDOR in Import exportErrors Endpoint Leaks CSV Data of Other Users](https://agentprime.io/advisories/CVE-2026-46691.md)
  `CVE-2026-46691` · CVE record: espocrm espocrm · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [EspoCRM: Target list Opt-Out actions allows opting out record without access Target List and access to record](https://agentprime.io/advisories/CVE-2026-46708.md)
  `CVE-2026-46708` · CVE record: espocrm espocrm · CVSS 4.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [EspoCRM: Portal User ACL Bypass Exposes Internal Stream Notes](https://agentprime.io/advisories/CVE-2026-46694.md)
  `CVE-2026-46694` · CVE record: espocrm espocrm · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Viewer role can create, modify and delete Loki alerting rules](https://agentprime.io/advisories/CVE-2026-9703.md)
  `CVE-2026-9703` · CVE record: Grafana Grafana Enterprise and 1 more · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [WordPress Webba Booking plugin <= 6.5.2 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-107416.md)
  `CVE-2026-107416` · CVE record: Webba Plugins Webba Booking · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Improper privilege management in Eclipse Foundation Eclipse Connected Services Platform](https://agentprime.io/advisories/CVE-2026-110724.md)
  `CVE-2026-110724` · CVE record: Eclipse Foundation Eclipse Connected Services Platform · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Privilege escalation, Broken access control
- [WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-109692.md)
  `CVE-2026-109692` · CVE record: ThemeGrill User Registration · CVSS 7.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Duplicate http-method-omission constraint mappings can remove servlet authorization constraints](https://agentprime.io/advisories/GHSA-phjh-v7c6-g7mv.md)
  `GHSA-phjh-v7c6-g7mv`, `CVE-2026-18662` · Maven `org.eclipse.jetty.ee10:jetty-ee10-servlet` and 4 more: affected `>=12.0.0, <=12.0.38 || >=12.1.0, <=12.1.11`, fixed in `12.0.39`, `12.1.12` · CVSS 6.9 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Constraint bypass when using http method name that is a substring of a http-method-omission](https://agentprime.io/advisories/GHSA-53x7-f9fc-h7qr.md)
  `GHSA-53x7-f9fc-h7qr`, `CVE-2026-18659` · Maven `org.eclipse.jetty.ee10:jetty-ee10-servlet` and 4 more: affected `>=12.0.0, <=12.0.38 || >=12.1.0, <=12.1.11`, fixed in `12.0.39`, `12.1.12` · CVSS 6.9 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Jetty suppresses ServletSecurity annotations for all servlet mappings when only one mapping is constrained by a descriptor](https://agentprime.io/advisories/GHSA-v6xf-996f-c35f.md)
  `GHSA-v6xf-996f-c35f`, `CVE-2026-18661` · Maven `org.eclipse.jetty.ee10:jetty-ee10-annotations` and 4 more: affected `>=12.1.0, <=12.1.11 || >=12.0.0, <=12.0.38`, fixed in `12.0.39`, `12.1.12` · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Jetty EthereumAuthenticator unanchored login-path matching bypasses authentication and role constraints](https://agentprime.io/advisories/GHSA-6m7j-pjmp-crgq.md)
  `GHSA-6m7j-pjmp-crgq`, `CVE-2026-19863` · Maven `org.eclipse.jetty:jetty-ethereum` and 1 more: affected `>=12.1.0, <=12.1.12`, fixed in `12.1.13` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 15 Oct 2026 · Tags: Authentication bypass, Broken access control
- [\*\*Privilege Escalation\*\* World-writable crontab path monitored and executed by root-owned process](https://agentprime.io/advisories/CVE-2026-34008.md)
  `CVE-2026-34008` · CVE record: QNAP Systems Inc. Notes Station 3 · CVSS 8.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Access Code Forgery in Video Station leading to unauthorized media access](https://agentprime.io/advisories/CVE-2026-44084.md)
  `CVE-2026-44084` · CVE record: QNAP Systems Inc. Video Station · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [ds-move-files.sh is writable and executed as root](https://agentprime.io/advisories/CVE-2026-34014.md)
  `CVE-2026-34014` · CVE record: QNAP Systems Inc. Download Station · CVSS 8.4 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [sdbootutil: world-readable debug log](https://agentprime.io/advisories/CVE-2026-104618.md)
  `CVE-2026-104618` · CVE record: SUSE SUSE Linux Enterprise Server 16.1 and 3 more · CVSS 6.9 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Social Media Auto Post & Scheduler <= 9.1.4 - Authenticated (Contributor+) Insecure Direct Object Reference to Sensitive Information Exposure](https://agentprime.io/advisories/CVE-2026-108092.md)
  `CVE-2026-108092` · CVE record: pr-gateway Blog2Social: Social Media Auto Post & Scheduler · CVSS 4.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Elementor Website Builder <= 4.2.3 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'is_public' and 'keys_conversion_map' Parameters](https://agentprime.io/advisories/CVE-2026-11905.md)
  `CVE-2026-11905` · CVE record: elemntor Elementor Website Builder – more than just a page builder · CVSS 4.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Tutor LMS < 4.1.1 - Unauthenticated Tutor Page Force-Publish and Content Overwrite](https://agentprime.io/advisories/CVE-2026-96537.md)
  `CVE-2026-96537` · CVE record: Unknown Tutor LMS · CVSS 7.5 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Spin Wheel < 2.2.1 - Unauthenticated Coupon Code Disclosure via Forged Spin Result](https://agentprime.io/advisories/CVE-2026-106031.md)
  `CVE-2026-106031` · CVE record: Unknown Spin Wheel · CVSS 6.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Easy HTTPS Redirection (SSL) < 2.0.2 - Subscriber+ Scan Result Disclosure and Site-Wide URL Rewrite](https://agentprime.io/advisories/CVE-2026-104643.md)
  `CVE-2026-104643` · CVE record: Unknown Easy HTTPS Redirection (SSL) · CVSS 4.2 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [eaSYNC < 1.3.31 - Unauthenticated Cancellation Request Creation and Email Template Update](https://agentprime.io/advisories/CVE-2026-103304.md)
  `CVE-2026-103304` · CVE record: Unknown eaSYNC Booking · CVSS 5.3 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Checkout Field Manager (Checkout Manager) for WooCommerce <= 7.9.6 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Media Deletion via Checkout File Field Attachment ID](https://agentprime.io/advisories/CVE-2026-17031.md)
  `CVE-2026-17031` · CVE record: quadlayers Checkout Field Manager (Checkout Manager) for WooCommerce · CVSS 8.1 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [IntentKit 2.6.3 Executor Tool Authorization Bypass via ToolNode](https://agentprime.io/advisories/CVE-2026-76066.md)
  `CVE-2026-76066` · CVE record: crestalnetwork intentkit · CVSS 8.7 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [An issue in Justson agentweb-core v5.1.6-androidx and earlier allows a local attacker to obtain sensitive information and launch non-exported host application components via incorrect access control…](https://agentprime.io/advisories/CVE-2026-95180.md)
  `CVE-2026-95180` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [ELADMIN v2.7 and earlier contains an improper access control vulnerability in the user-management endpoint PUT /api/users/resetPwd of me.zhengjie.modules.system.rest.UserController.](https://agentprime.io/advisories/CVE-2026-106700.md)
  `CVE-2026-106700` · CVE record · CVSS 8.8 High · Not analysed yet · Published 15 Oct 2026 · Tags: Broken access control
- [Heym 0.0.55 before 0.0.121 Credential Theft via error_workflow_id Field](https://agentprime.io/advisories/CVE-2026-110873.md)
  `CVE-2026-110873` · CVE record: heymrun heym · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Renovate before 44.60.1 allowedEnv Allowlist Bypass via Shared Preset](https://agentprime.io/advisories/CVE-2026-110867.md)
  `CVE-2026-110867` · CVE record: renovatebot renovate and 4 more · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [n8n before 1.123.83 Authorization Bypass via Execute Sub-workflow Inline JSON](https://agentprime.io/advisories/CVE-2026-110853.md)
  `CVE-2026-110853` · CVE record: n8n-io n8n · CVSS 7.1 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [n8n before 2.41.4 and 2.42.1 Cross-Project Agent Ownership Transfer via Agents Create Endpoint](https://agentprime.io/advisories/CVE-2026-110851.md)
  `CVE-2026-110851` · CVE record: n8n-io n8n · CVSS 6.1 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [n8n before 2.41.4 and 2.42.1 Credential Check Bypass via Agent Node Parameters](https://agentprime.io/advisories/CVE-2026-110850.md)
  `CVE-2026-110850` · CVE record: n8n-io n8n · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [n8n before 1.123.83 Credential Authorization Bypass via Nested Inline Sub-Workflows](https://agentprime.io/advisories/CVE-2026-110844.md)
  `CVE-2026-110844` · CVE record: n8n-io n8n · CVSS 7.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [n8n before 2.41.4 and 2.42.0 Authorization Bypass in Agent Chat Resume Tool Approval](https://agentprime.io/advisories/CVE-2026-110841.md)
  `CVE-2026-110841` · CVE record: n8n-io n8n · CVSS 6.1 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Improper Authorization in TP-Link Omada Controller TLS Certificate and Private Key Management API](https://agentprime.io/advisories/CVE-2026-107795.md)
  `CVE-2026-107795` · CVE record: TP-Link Systems Inc. Omada Software Controller · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Insufficient Authorization and User Boundary Validation in Omada Controller MSP](https://agentprime.io/advisories/CVE-2026-102298.md)
  `CVE-2026-102298` · CVE record: TP-Link System Inc. Omada Software Controller (Windows) · CVSS 7.5 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [itsmeravitejak Online-Examination-System dbtables.sql information disclosure](https://agentprime.io/advisories/CVE-2026-110696.md)
  `CVE-2026-110696` · CVE record: itsmeravitejak Online-Examination-System · CVSS 6.9 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Information disclosure, Broken access control
- [FileRise renameFolder omits destination-parent authorization](https://agentprime.io/advisories/CVE-2026-103988.md)
  `CVE-2026-103988` · CVE record: error311 FileRise · CVSS 5.4 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [FileRise: Unauthenticated File Overwrite Through Upload-Enabled Folder Shares](https://agentprime.io/advisories/CVE-2026-61843.md)
  `CVE-2026-61843` · CVE record: error311 FileRise · CVSS 8.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in SonicWall Network Security Manager (NSM)](https://agentprime.io/advisories/CVE-2026-96540.md)
  `CVE-2026-96540` · CVE record: SonicWall Network Security Manager (NSM) · CVSS 8.8 High · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control
- [OpenAEV has unauthenticated access and missing object-level authorization on player lessons API](https://agentprime.io/advisories/CVE-2026-71854.md)
  `CVE-2026-71854` · CVE record: OpenAEV-Platform openaev · CVSS 8.2 High · Not analysed yet · Published 14 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Plane: Cross-Project Page Content Disclosure via PageVersionEndpoint Missing Project Scope](https://agentprime.io/advisories/CVE-2026-102980.md)
  `CVE-2026-102980` · CVE record: makeplane plane · CVSS 6.5 Medium · Not analysed yet · Published 14 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTE0VDE5OjMzOjA3LjkxNjAwMFoiLCJDVkUtMjAyNi0xMDI5ODAiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTE1VDE4OjEyOjIzLjU2MTAwMFoiLCJDVkUtMjAyNi0xMTAzNjAiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTE1VDE4OjEyOjIzLjU2MTAwMFoiLCJDVkUtMjAyNi0xMTAzNjAiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.