# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Fastcache by Host.it <= 1.7.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary .htaccess Page-Cache Block Modification via updateSettings() admin_action_update Hook](https://agentprime.io/advisories/CVE-2026-107763.md)
  `CVE-2026-107763` · CVE record: hostspa Fastcache by Host.it · CVSS 4.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [Disabled Sunshine clients can bypass revocation with a derived client certificate](https://agentprime.io/advisories/CVE-2026-111044.md)
  `CVE-2026-111044` · CVE record: LizardByte Sunshine · CVSS 7.6 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Arcane: Environment access token bypasses the admin-required authorization gate on \`/api/debug/pprof\`](https://agentprime.io/advisories/GHSA-mp22-58ff-6fhr.md)
  `GHSA-mp22-58ff-6fhr`, `CVE-2026-96628`, `GO-2026-6806` · Go `github.com/getarcaneapp/arcane/backend/v2`: affected `<2.11.0`, fixed in `2.11.0` · CVSS 4.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [EA Javelin Anticheat Installer Local Privilege Escalation](https://agentprime.io/advisories/CVE-2026-96542.md)
  `CVE-2026-96542` · CVE record: Electronic Arts EA Javelin Anticheat (EA Javelin Anticheat Installer) · CVSS 5.0 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Frappe HR: Missing Authorization on PWA API Endpoints enables Cross-Employee Data access in HRMS](https://agentprime.io/advisories/CVE-2026-64862.md)
  `CVE-2026-64862` · CVE record: frappe hrms · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [ERPNext: Unauthorised access to financial data due to missing validation](https://agentprime.io/advisories/CVE-2026-108373.md)
  `CVE-2026-108373` · CVE record: frappe erpnext · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [ERPNext: Unauthorised status modification due to missing validation](https://agentprime.io/advisories/CVE-2026-108374.md)
  `CVE-2026-108374` · CVE record: frappe erpnext · CVSS 7.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Wasmtime: WASI hard links bypass wasmtime-wasi's FilePerms for destination](https://agentprime.io/advisories/GHSA-4ch3-9j33-3pmj.md)
  `GHSA-4ch3-9j33-3pmj`, `CVE-2026-58494`, `RUSTSEC-2026-0188` · crates.io `wasmtime-wasi`: affected `<24.0.11 || >=25.0.0, <36.0.12 || >=37.0.0, <45.0.3 || >=46.0.0, <46.0.1`, fixed in `24.0.11`, `36.0.12`, `45.0.3`, `46.0.1` · CVSS 6.5 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control, CWE-281
- [Tandoor Recipes: Private recipe authorization bypass via /api/step/ - read and modify another Space member's private recipe content](https://agentprime.io/advisories/CVE-2026-61726.md)
  `CVE-2026-61726` · CVE record: TandoorRecipes recipes · CVSS 8.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Tandoor Recipes: Private recipe file and share-link authorization bypass in recipe utility API endpoints](https://agentprime.io/advisories/CVE-2026-59963.md)
  `CVE-2026-59963` · CVE record: TandoorRecipes recipes · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System](https://agentprime.io/advisories/CVE-2026-17068.md)
  `CVE-2026-17068` · CVE record: IBM i · CVSS 5.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [IBM i is Affected By Improper Authorization and Access Control Vulnerabilities in Network File System](https://agentprime.io/advisories/CVE-2026-17073.md)
  `CVE-2026-17073` · CVE record: IBM i · CVSS 5.4 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [IBM i is Affected by an Improper Validation Vulnerability](https://agentprime.io/advisories/CVE-2026-17275.md)
  `CVE-2026-17275` · CVE record: IBM i · CVSS 3.7 Low · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [LingGuo-Drama through commit 8a6924a Broken Access Control via /admin/v1/admins API](https://agentprime.io/advisories/CVE-2026-111723.md)
  `CVE-2026-111723` · CVE record: LingGuoAI LingGuo-Drama · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [LingGuo-Drama through commit 8a6924a IDOR via /admin/v1/projects/:id API](https://agentprime.io/advisories/CVE-2026-111722.md)
  `CVE-2026-111722` · CVE record: LingGuoAI LingGuo-Drama · CVSS 8.6 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Open WES through 1.0.0 Broken Access Control via GlobalGatewayFilter Warehouse Scoping](https://agentprime.io/advisories/CVE-2026-111721.md)
  `CVE-2026-111721` · CVE record: jingsewu open-wes · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Arkon through 0.9.2 Missing Authorization via Skills Versions API](https://agentprime.io/advisories/CVE-2026-111717.md)
  `CVE-2026-111717` · CVE record: nduckmink arkon · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Arkon through 0.9.2 Broken Access Control via Sources By-ID Routes](https://agentprime.io/advisories/CVE-2026-111716.md)
  `CVE-2026-111716` · CVE record: nduckmink arkon · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Arkon through 0.9.2 Missing Authorization via Wiki Graph Neighborhood API](https://agentprime.io/advisories/CVE-2026-111715.md)
  `CVE-2026-111715` · CVE record: nduckmink arkon · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [WhaTicket Community through commit cf04795 IDOR via /tickets/:ticketId and /messages/:ticketId](https://agentprime.io/advisories/CVE-2026-111709.md)
  `CVE-2026-111709` · CVE record: canove whaticket-community · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [99AI through 4.3.0 IDOR via /api/chatLog/querySingleChat Chat Message Disclosure](https://agentprime.io/advisories/CVE-2026-111707.md)
  `CVE-2026-111707` · CVE record: vastxie 99AI · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Fuint through commit 57ec018 IDOR via bookId in myBookDetail](https://agentprime.io/advisories/CVE-2026-111705.md)
  `CVE-2026-111705` · CVE record: fushengqian fuint · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [yshop-crm through 2.1.3 IDOR via CRM customer by-id endpoints](https://agentprime.io/advisories/CVE-2026-111703.md)
  `CVE-2026-111703` · CVE record: guchengwuyue yshop-crm · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [ChatOllama through commit 96c3ce5 IDOR Exposes Private Knowledge Bases](https://agentprime.io/advisories/CVE-2026-111702.md)
  `CVE-2026-111702` · CVE record: sugarforever chat-ollama · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [HUIZHI ChargeOS cloud through 3.0.9 Unpaid Wallet Credit via /pay/xcxRecharge](https://agentprime.io/advisories/CVE-2026-111698.md)
  `CVE-2026-111698` · CVE record: roinli HUIZHI-ChargeOS-cloud · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [HUIZHI ChargeOS cloud through 3.0.9 IDOR via hcp-mp Member and Order APIs](https://agentprime.io/advisories/CVE-2026-111697.md)
  `CVE-2026-111697` · CVE record: roinli HUIZHI-ChargeOS-cloud · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Shaiwz data-platform-open through commit efeacd3 IDOR in Datasource API](https://agentprime.io/advisories/CVE-2026-111695.md)
  `CVE-2026-111695` · CVE record: shaiwz data-platform-open · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [XBoot through 3.3.4 Authorization Bypass via getByDepartmentId Endpoint](https://agentprime.io/advisories/CVE-2026-111689.md)
  `CVE-2026-111689` · CVE record: Exrick xboot · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Exrick XBoot through 3.3.4 Data-Scope Bypass via openDataFilter Parameter](https://agentprime.io/advisories/CVE-2026-111688.md)
  `CVE-2026-111688` · CVE record: Exrick xboot · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Magistrala through 1.0.0 Cross-Tenant Authorization Bypass in Certs Service](https://agentprime.io/advisories/CVE-2026-111684.md)
  `CVE-2026-111684` · CVE record: absmach magistrala · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Allegro Ralph through 20260902.1 Missing Authorization in Data Center Rack API](https://agentprime.io/advisories/CVE-2026-111683.md)
  `CVE-2026-111683` · CVE record: allegro ralph · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [EFAK 5.0.0 through 5.1.0 Missing Authorization via /api/model-config Exposes API Keys](https://agentprime.io/advisories/CVE-2026-111682.md)
  `CVE-2026-111682` · CVE record: smartloli EFAK · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [EFAK through 5.1.0 Privilege Escalation via /api/users REST API](https://agentprime.io/advisories/CVE-2026-111681.md)
  `CVE-2026-111681` · CVE record: smartloli EFAK · CVSS 8.7 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [APIPark through 1.9.7-beta Cross-Team Authorization Bypass via Team Query Parameter](https://agentprime.io/advisories/CVE-2026-111680.md)
  `CVE-2026-111680` · CVE record: APIParkLab APIPark · CVSS 7.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Ekko Studio through 0.7.36 Missing Authorization via /api/auth/locked-ips](https://agentprime.io/advisories/CVE-2026-111679.md)
  `CVE-2026-111679` · CVE record: EKKOLearnAI ekko-studio · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Faveo Helpdesk through 2.0.3 Broken Access Control via /ticket/tooltip Endpoint](https://agentprime.io/advisories/CVE-2026-111676.md)
  `CVE-2026-111676` · CVE record: faveosuite faveo-helpdesk · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Tbed through 20240319 Missing Authorization via setImgFileName Endpoint](https://agentprime.io/advisories/CVE-2026-111674.md)
  `CVE-2026-111674` · CVE record: Hello-hao Tbed · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Cube-studio through 2026.09.01 IDOR via Pipeline View and Copy Endpoints](https://agentprime.io/advisories/CVE-2026-111672.md)
  `CVE-2026-111672` · CVE record: data-infra cube-studio · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Cube-studio through 2026.09.01 IDOR via Notebook and Serving Lifecycle Endpoints](https://agentprime.io/advisories/CVE-2026-111671.md)
  `CVE-2026-111671` · CVE record: data-infra cube-studio · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [ClickVisual through 1.1.2 Missing Authorization in apiv2 Report Module](https://agentprime.io/advisories/CVE-2026-111670.md)
  `CVE-2026-111670` · CVE record: clickvisual clickvisual · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [AIHelms through 0.1.25 Missing Authorization in Efficiency Analytics API](https://agentprime.io/advisories/CVE-2026-111668.md)
  `CVE-2026-111668` · CVE record: beizhu-1209 AIHelms · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [REBUILD through 4.5.0 Missing Authorization via /project/comments/list Endpoint](https://agentprime.io/advisories/CVE-2026-111667.md)
  `CVE-2026-111667` · CVE record: getrebuild rebuild · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Steedos Platform through 3.0.15-beta.51 Cross-Tenant Information Disclosure via Reports API](https://agentprime.io/advisories/CVE-2026-111666.md)
  `CVE-2026-111666` · CVE record: steedos steedos-platform · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Piranha CMS through 12.2 Missing Authorization in Manager Language API](https://agentprime.io/advisories/CVE-2026-111665.md)
  `CVE-2026-111665` · CVE record: PiranhaCMS Piranha CMS · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [SiteServer SSCMS through 7.4.0 Cross-Site Authorization Bypass via Channels API](https://agentprime.io/advisories/CVE-2026-111658.md)
  `CVE-2026-111658` · CVE record: SiteServer SSCMS · CVSS 5.1 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [BeikeShop through 2.0.0.31 IDOR via RMA mark_as_shipped Endpoint](https://agentprime.io/advisories/CVE-2026-111657.md)
  `CVE-2026-111657` · CVE record: beikeshop beikeshop · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [ChatWiki through 2.9.6 Cross-Tenant IDOR via Form Filter Management Endpoints](https://agentprime.io/advisories/CVE-2026-111656.md)
  `CVE-2026-111656` · CVE record: zhimaAi chatwiki · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [ThinkAdmin think-plugs-admin through 1.0.81 IDOR via admin/file.edit](https://agentprime.io/advisories/CVE-2026-111655.md)
  `CVE-2026-111655` · CVE record: zoujingli think-plugs-admin · CVSS 5.1 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [FastBee through 2.1.0 IDOR via /iot/group By-ID Endpoints](https://agentprime.io/advisories/CVE-2026-111654.md)
  `CVE-2026-111654` · CVE record: kerwincui FastBee · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Engineercms through 2.0.5 Missing Authorization via AttachController.Attachment](https://agentprime.io/advisories/CVE-2026-111652.md)
  `CVE-2026-111652` · CVE record: 3xxx engineercms · CVSS 6.9 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Risesoft Digital-Infrastructure through 9.6.11 Cross-Tenant Data Exposure via DownloadController](https://agentprime.io/advisories/CVE-2026-111651.md)
  `CVE-2026-111651` · CVE record: risesoft-y9 Digital-Infrastructure · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Rocboss paopao-ce through 0.6.0-alpha.3 IDOR via DownloadAttachment Endpoint](https://agentprime.io/advisories/CVE-2026-111649.md)
  `CVE-2026-111649` · CVE record: rocboss paopao-ce · CVSS 7.1 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [BuildAdmin through 2.3.9 IDOR via routine/adminInfo/edit id Parameter](https://agentprime.io/advisories/CVE-2026-111648.md)
  `CVE-2026-111648` · CVE record: build-admin buildadmin · CVSS 5.1 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [PickMall lilishop through 5.0.0 IDOR via /buyer/trade/receipt/{id}](https://agentprime.io/advisories/CVE-2026-111647.md)
  `CVE-2026-111647` · CVE record: PickMall lilishop · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [SurveyKing before 1.13.0 Unauthenticated File Download via /api/public/preview](https://agentprime.io/advisories/CVE-2026-111646.md)
  `CVE-2026-111646` · CVE record: javahuang SurveyKing · CVSS 8.2 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [MrDoc through 1.1.1 Missing Authorization via api/import_local_doc/ Endpoint](https://agentprime.io/advisories/CVE-2026-111645.md)
  `CVE-2026-111645` · CVE record: zmister2016 MrDoc · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [DooTask through 1.9.66 Missing Authorization in OKR Comment Dialogs](https://agentprime.io/advisories/CVE-2026-111640.md)
  `CVE-2026-111640` · CVE record: kuaifan dootask · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [sshportal through 1.19.5 Missing Authorization in 'key show' Command Exposes Private Keys](https://agentprime.io/advisories/CVE-2026-111638.md)
  `CVE-2026-111638` · CVE record: moul sshportal · CVSS 8.3 High · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Aureus ERP through 1.6.0 Multi-Company Authorization Bypass via company_id](https://agentprime.io/advisories/CVE-2026-111632.md)
  `CVE-2026-111632` · CVE record: aureuserp aureuserp · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control
- [Distributor before 2.3.2 Missing Authorization in External Connection AJAX Actions](https://agentprime.io/advisories/CVE-2026-111631.md)
  `CVE-2026-111631` · CVE record: 10up Distributor · CVSS 5.3 Medium · Not analysed yet · Published 16 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTE2VDE3OjM5OjA0Ljg2MTAwMFoiLCJDVkUtMjAyNi0xMTE2MzEiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTE3VDAyOjMxOjA1LjM1MjAwMFoiLCJDVkUtMjAyNi0xMDc3NjIiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTE3VDAyOjMxOjA1LjM1MjAwMFoiLCJDVkUtMjAyNi0xMDc3NjIiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.