# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations](https://agentprime.io/advisories/CVE-2026-111630.md)
  `CVE-2026-111630` · CVE record: colinin abp-next-admin · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs](https://agentprime.io/advisories/CVE-2026-111629.md)
  `CVE-2026-111629` · CVE record: IoTSharp IoTSharp · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation](https://agentprime.io/advisories/CVE-2026-111627.md)
  `CVE-2026-111627` · CVE record: hestiacp hestiacp · CVSS 8.6 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action](https://agentprime.io/advisories/CVE-2026-111625.md)
  `CVE-2026-111625` · CVE record: 10up Distributor · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}](https://agentprime.io/advisories/CVE-2026-111621.md)
  `CVE-2026-111621` · CVE record: TDuckCloud tduck-survey-form · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint](https://agentprime.io/advisories/CVE-2026-111620.md)
  `CVE-2026-111620` · CVE record: O2OA O2OA · CVSS 6.0 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API](https://agentprime.io/advisories/CVE-2026-111616.md)
  `CVE-2026-111616` · CVE record: Oqtane Oqtane Framework · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint](https://agentprime.io/advisories/CVE-2026-111615.md)
  `CVE-2026-111615` · CVE record: gz-yami mall4cloud · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials](https://agentprime.io/advisories/CVE-2026-111614.md)
  `CVE-2026-111614` · CVE record: devlive-community DataCap · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints](https://agentprime.io/advisories/CVE-2026-111611.md)
  `CVE-2026-111611` · CVE record: roncoo roncoo-education · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [B3log Solo through 4.4.0 Missing Authorization in ArticleConsole](https://agentprime.io/advisories/CVE-2026-111610.md)
  `CVE-2026-111610` · CVE record: b3log Solo · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription](https://agentprime.io/advisories/CVE-2026-111609.md)
  `CVE-2026-111609` · CVE record: PKP Open Journal Systems · CVSS 5.1 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}](https://agentprime.io/advisories/CVE-2026-111608.md)
  `CVE-2026-111608` · CVE record: jeequan jeepay · CVSS 2.3 Low · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs](https://agentprime.io/advisories/CVE-2026-111607.md)
  `CVE-2026-111607` · CVE record: jeequan jeepay · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC](https://agentprime.io/advisories/CVE-2026-111606.md)
  `CVE-2026-111606` · CVE record: hcengineering Huly Platform · CVSS 8.6 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController](https://agentprime.io/advisories/CVE-2026-111605.md)
  `CVE-2026-111605` · CVE record: dromara Jpom · CVSS 8.6 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [eladmin through 2.7 Broken Access Control via /api/users Update and Delete](https://agentprime.io/advisories/CVE-2026-111604.md)
  `CVE-2026-111604` · CVE record: elunez eladmin · CVSS 5.1 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints](https://agentprime.io/advisories/CVE-2026-111603.md)
  `CVE-2026-111603` · CVE record: PlayEdu PlayEdu · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel](https://agentprime.io/advisories/CVE-2026-109587.md)
  `CVE-2026-109587` · CVE record: FreeRTOS FreeRTOS-Kernel · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport](https://agentprime.io/advisories/CVE-2026-59967.md)
  `CVE-2026-59967` · CVE record: TandoorRecipes recipes · CVSS 5.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges](https://agentprime.io/advisories/CVE-2026-97380.md)
  `CVE-2026-97380` · CVE record: MariaDB server · CVSS 8.8 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control, CWE-620
- [MariaDB: Unauthorized file access via CONNECT engine UDFs](https://agentprime.io/advisories/CVE-2026-85985.md)
  `CVE-2026-85985` · CVE record: MariaDB server · CVSS 5.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control](https://agentprime.io/advisories/CVE-2026-86009.md)
  `CVE-2026-86009` · CVE record: Mailu Mailu · CVSS 8.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Mailu domain managers can take over higher-privileged accounts](https://agentprime.io/advisories/CVE-2026-86008.md)
  `CVE-2026-86008` · CVE record: Mailu Mailu · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Dockhand: Unauthenticated container exec via WebSocket upgrade](https://agentprime.io/advisories/CVE-2026-57169.md)
  `CVE-2026-57169` · CVE record: Finsys dockhand · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Incorrect Permission Assignment for Critical Resource in lomiri-download-manager](https://agentprime.io/advisories/CVE-2026-96425.md)
  `CVE-2026-96425` · CVE record: UBports lomiri-download-manager · CVSS 5.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Incorrect Permission Assignment for Critical Resource in lomiri-download-manager](https://agentprime.io/advisories/CVE-2026-96424.md)
  `CVE-2026-96424` · CVE record: UBports lomiri-download-manager · CVSS 7.8 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Open Zaak: /zaken/\_zoek and /enkelvoudiginformatieobjecten/\_zoek endpoints do not filter result lists based on authorizations linked to token](https://agentprime.io/advisories/CVE-2026-54657.md)
  `CVE-2026-54657` · CVE record: open-zaak open-zaak · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [J4Care dcm4che Missing Authorization](https://agentprime.io/advisories/CVE-2026-97851.md)
  `CVE-2026-97851` · CVE record: J4Care dcm4chee-arc-light · CVSS 8.8 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes](https://agentprime.io/advisories/CVE-2026-97858.md)
  `CVE-2026-97858` · CVE record: Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Mass assignment in Devolutions Server](https://agentprime.io/advisories/CVE-2026-110804.md)
  `CVE-2026-110804` · CVE record: Devolutions Server · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2026-110806.md)
  `CVE-2026-110806` · CVE record: Devolutions Server · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2026-110287.md)
  `CVE-2026-110287` · CVE record: Devolutions Server · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110896.md)
  `CVE-2026-110896` · CVE record: WP Chill Passster · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-111396.md)
  `CVE-2026-111396` · CVE record: Liquid Web / StellarWP Advanced Post Manager · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-111409.md)
  `CVE-2026-111409` · CVE record: YITH YITH PayPal Express Checkout for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110900.md)
  `CVE-2026-110900` · CVE record: Liquid Web / StellarWP BookIt · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-110901.md)
  `CVE-2026-110901` · CVE record: WPMU DEV SmartCrawl · CVSS 5.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110380.md)
  `CVE-2026-110380` · CVE record: Arraytics WP Event Solution · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-111397.md)
  `CVE-2026-111397` · CVE record: PT Norther Lights Production MapSVG · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Apache Kylin: Missing authorization and path-confinement on system meta dump](https://agentprime.io/advisories/CVE-2026-63619.md)
  `CVE-2026-63619` · CVE record: Apache Software Foundation Apache Kylin · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment](https://agentprime.io/advisories/CVE-2026-110029.md)
  `CVE-2026-110029` · CVE record: Unknown Squeeze · CVSS 5.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Missing Authorization in rdiffweb](https://agentprime.io/advisories/CVE-2026-109119.md)
  `CVE-2026-109119` · CVE record: ikus-soft rdiffweb · CVSS 8.8 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Missing Authorization in NordVPN for Windows](https://agentprime.io/advisories/CVE-2026-106030.md)
  `CVE-2026-106030` · CVE record: Nord Security NordVPN · CVSS 6.8 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [IDOR in SFM Software's Costifier](https://agentprime.io/advisories/CVE-2026-15219.md)
  `CVE-2026-15219` · CVE record: SFM Software Technologies Inc. Costifier · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret](https://agentprime.io/advisories/GHSA-28hp-c82p-8vqj.md)
  `GHSA-28hp-c82p-8vqj` · Go `github.com/traefik/traefik/v3`: affected `>=v3.7.11, <=v3.7.14`, fixed in `v3.7.15` · CVSS 2.1 Low · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users](https://agentprime.io/advisories/CVE-2026-18799.md)
  `CVE-2026-18799` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Private team metadata disclosure via the team search API](https://agentprime.io/advisories/CVE-2026-18256.md)
  `CVE-2026-18256` · CVE record: Mattermost Mattermost · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access](https://agentprime.io/advisories/CVE-2026-18223.md)
  `CVE-2026-18223` · CVE record: Mattermost Mattermost · CVSS 5.0 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token](https://agentprime.io/advisories/CVE-2026-19076.md)
  `CVE-2026-19076` · CVE record: Mattermost Mattermost · CVSS 4.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Missing server side validation allowed user to quarantine a DM and GM post](https://agentprime.io/advisories/CVE-2026-18795.md)
  `CVE-2026-18795` · CVE record: Mattermost Mattermost · CVSS 6.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Mattermost guest account privilege escalation via member roles API](https://agentprime.io/advisories/CVE-2026-18551.md)
  `CVE-2026-18551` · CVE record: Mattermost Mattermost · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110366.md)
  `CVE-2026-110366` · CVE record: Gemini Labs Site Reviews · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints](https://agentprime.io/advisories/CVE-2026-19798.md)
  `CVE-2026-19798` · CVE record: tusharimran WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool](https://agentprime.io/advisories/CVE-2026-109382.md)
  `CVE-2026-109382` · CVE record: bilalnaseer WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action](https://agentprime.io/advisories/CVE-2026-107770.md)
  `CVE-2026-107770` · CVE record: tigroumeow Photo Engine (Media Organizer & Lightroom) · CVSS 6.8 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite](https://agentprime.io/advisories/CVE-2026-110039.md)
  `CVE-2026-110039` · CVE record: Unknown Smush · CVSS 2.7 Low · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status](https://agentprime.io/advisories/CVE-2026-110014.md)
  `CVE-2026-110014` · CVE record: Unknown Salon Booking System · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration](https://agentprime.io/advisories/CVE-2026-109982.md)
  `CVE-2026-109982` · CVE record: Unknown MB Custom Post Types & Custom Taxonomies · CVSS 4.2 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization](https://agentprime.io/advisories/CVE-2026-105973.md)
  `CVE-2026-105973` · CVE record: Unknown Visual Form Builder · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTE2VDA2OjAwOjEzLjc0MjAwMFoiLCJDVkUtMjAyNi0xMDU5NzMiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTE2VDE3OjM5OjA0Ljg2MTAwMFoiLCJDVkUtMjAyNi0xMTE2MzEiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTE2VDE3OjM5OjA0Ljg2MTAwMFoiLCJDVkUtMjAyNi0xMTE2MzEiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.