# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions](https://agentprime.io/advisories/CVE-2026-94230.md)
  `CVE-2026-94230` · CVE record: Unknown TrueBooker · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter](https://agentprime.io/advisories/CVE-2026-94229.md)
  `CVE-2026-94229` · CVE record: Unknown TrueBooker · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data](https://agentprime.io/advisories/CVE-2026-94228.md)
  `CVE-2026-94228` · CVE record: Unknown TrueBooker · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery](https://agentprime.io/advisories/CVE-2026-106010.md)
  `CVE-2026-106010` · CVE record: Unknown BDM Digital Payment Gateway · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment](https://agentprime.io/advisories/CVE-2026-94273.md)
  `CVE-2026-94273` · CVE record: Unknown Snap Finance · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery](https://agentprime.io/advisories/CVE-2026-106014.md)
  `CVE-2026-106014` · CVE record: Unknown Gateway for Vantiv on WC · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter](https://agentprime.io/advisories/CVE-2026-91047.md)
  `CVE-2026-91047` · CVE record: Unknown ElementsReady Addons for Elementor · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing Authorization](https://agentprime.io/advisories/CVE-2026-91046.md)
  `CVE-2026-91046` · CVE record: Unknown ElementsReady Addons for Elementor · CVSS 4.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation](https://agentprime.io/advisories/CVE-2026-106028.md)
  `CVE-2026-106028` · CVE record: Unknown ActiveTrail for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [donetick History Deletion model.go CanDeleteHistory improper authorization](https://agentprime.io/advisories/CVE-2026-112045.md)
  `CVE-2026-112045` · CVE record: donetick · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Privilege escalation, Broken access control
- [calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization](https://agentprime.io/advisories/CVE-2026-112043.md)
  `CVE-2026-112043` · CVE record: calcom cal.com and 1 more · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)](https://agentprime.io/advisories/CVE-2026-103091.md)
  `CVE-2026-103091` · CVE record: Google SAM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Authentication bypass, Broken access control, CWE-1188
- [Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)](https://agentprime.io/advisories/CVE-2026-102503.md)
  `CVE-2026-102503` · CVE record: Google SAM · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Authentication bypass, Broken access control
- [aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgery](https://agentprime.io/advisories/CVE-2026-112033.md)
  `CVE-2026-112033` · CVE record: aircheng-org iWebShop-5 · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [light0011 cms Captcha Validation UserController.class.php access control](https://agentprime.io/advisories/CVE-2026-112025.md)
  `CVE-2026-112025` · CVE record: light0011 cms · CVSS 6.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Gitea API disclosure of private user social graph, keys and stars](https://agentprime.io/advisories/CVE-2026-97859.md)
  `CVE-2026-97859` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Gitea label deletion across repository and organization IDs](https://agentprime.io/advisories/CVE-2026-97204.md)
  `CVE-2026-97204` · CVE record: Gitea Gitea · CVSS 3.1 Low · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Gitea release attachment re-linking of issue attachments](https://agentprime.io/advisories/CVE-2026-110494.md)
  `CVE-2026-110494` · CVE record: Gitea Gitea · CVSS 6.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Gitea watched repositories API disclosure after access revocation](https://agentprime.io/advisories/CVE-2026-109844.md)
  `CVE-2026-109844` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Gitea reactions accepted on locked issues and comments](https://agentprime.io/advisories/CVE-2026-107686.md)
  `CVE-2026-107686` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [dyad-sh dyad OAuth Callback cross-site request forgery](https://agentprime.io/advisories/CVE-2026-111988.md)
  `CVE-2026-111988` · CVE record: dyad-sh dyad · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions](https://agentprime.io/advisories/CVE-2026-112047.md)
  `CVE-2026-112047` · CVE record: OneUptime oneuptime · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint](https://agentprime.io/advisories/CVE-2026-112004.md)
  `CVE-2026-112004` · CVE record: teableio teable · CVSS 2.3 Low · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities](https://agentprime.io/advisories/CVE-2026-112001.md)
  `CVE-2026-112001` · CVE record: ProjectSend ProjectSend · CVSS 8.6 High · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs](https://agentprime.io/advisories/CVE-2026-112000.md)
  `CVE-2026-112000` · CVE record: vanus-labs vanus · CVSS 7.2 High · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110880.md)
  `CVE-2026-110880` · CVE record: Kit Kit (formerly ConvertKit) · CVSS 6.5 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-110383.md)
  `CVE-2026-110383` · CVE record: WP E-Signature Electronic Signature Add-on for Fluent Forms · CVSS 7.5 High · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110365.md)
  `CVE-2026-110365` · CVE record: WPExperts Advanced File Manager · CVSS 6.5 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media](https://agentprime.io/advisories/CVE-2026-111041.md)
  `CVE-2026-111041` · CVE record: Unknown AI Engine · CVSS 4.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media](https://agentprime.io/advisories/CVE-2026-110976.md)
  `CVE-2026-110976` · CVE record: Unknown AI Engine · CVSS 4.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR](https://agentprime.io/advisories/CVE-2026-110070.md)
  `CVE-2026-110070` · CVE record: Unknown Modern Events Calendar Lite · CVSS 6.5 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route](https://agentprime.io/advisories/CVE-2026-110035.md)
  `CVE-2026-110035` · CVE record: Unknown Salon Booking System · CVSS 4.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor](https://agentprime.io/advisories/CVE-2026-110032.md)
  `CVE-2026-110032` · CVE record: Unknown Salon Booking System · CVSS 5.5 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion](https://agentprime.io/advisories/CVE-2026-110026.md)
  `CVE-2026-110026` · CVE record: Unknown Tasty Recipes Lite · CVSS 4.9 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [Product Designer <= 1.0.40 - Unauthenticated Design Template Data Injection](https://agentprime.io/advisories/CVE-2026-87844.md)
  `CVE-2026-87844` · CVE record: Unknown PickPlugins Product Designer for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization](https://agentprime.io/advisories/CVE-2026-111875.md)
  `CVE-2026-111875` · CVE record: David-Crty Databasement · CVSS 5.1 Medium · Not analysed yet · Published 18 Oct 2026 · Tags: Broken access control
- [WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110882.md)
  `CVE-2026-110882` · CVE record: Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications · CVSS 4.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC](https://agentprime.io/advisories/CVE-2026-111929.md)
  `CVE-2026-111929` · CVE record: coder coder · CVSS 6.0 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy](https://agentprime.io/advisories/CVE-2026-111928.md)
  `CVE-2026-111928` · CVE record: coder coder · CVSS 5.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed](https://agentprime.io/advisories/CVE-2026-111916.md)
  `CVE-2026-111916` · CVE record: Admidio admidio · CVSS 6.9 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php](https://agentprime.io/advisories/CVE-2026-111914.md)
  `CVE-2026-111914` · CVE record: Admidio admidio · CVSS 7.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php](https://agentprime.io/advisories/CVE-2026-111913.md)
  `CVE-2026-111913` · CVE record: Admidio admidio · CVSS 5.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update](https://agentprime.io/advisories/CVE-2026-111912.md)
  `CVE-2026-111912` · CVE record: Admidio admidio · CVSS 7.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads](https://agentprime.io/advisories/CVE-2026-111910.md)
  `CVE-2026-111910` · CVE record: thorsten phpMyFAQ · CVSS 7.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API](https://agentprime.io/advisories/CVE-2026-111908.md)
  `CVE-2026-111908` · CVE record: thorsten phpMyFAQ · CVSS 8.7 High · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data](https://agentprime.io/advisories/CVE-2026-111905.md)
  `CVE-2026-111905` · CVE record: thorsten phpMyFAQ · CVSS 7.0 High · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API](https://agentprime.io/advisories/CVE-2026-111902.md)
  `CVE-2026-111902` · CVE record: thorsten phpMyFAQ · CVSS 6.9 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php](https://agentprime.io/advisories/CVE-2026-111900.md)
  `CVE-2026-111900` · CVE record: thorsten phpMyFAQ · CVSS 5.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints](https://agentprime.io/advisories/CVE-2026-111897.md)
  `CVE-2026-111897` · CVE record: thorsten phpMyFAQ · CVSS 7.1 High · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard](https://agentprime.io/advisories/CVE-2026-111889.md)
  `CVE-2026-111889` · CVE record: thorsten phpMyFAQ · CVSS 5.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API](https://agentprime.io/advisories/CVE-2026-111888.md)
  `CVE-2026-111888` · CVE record: thorsten phpMyFAQ · CVSS 5.1 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission](https://agentprime.io/advisories/CVE-2026-81343.md)
  `CVE-2026-81343` · CVE record: Unknown ACF Frontend Admin by DynamiApps · CVSS 5.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass](https://agentprime.io/advisories/CVE-2026-110527.md)
  `CVE-2026-110527` · CVE record: Unknown WP User Manager · CVSS 5.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration](https://agentprime.io/advisories/CVE-2026-92431.md)
  `CVE-2026-92431` · CVE record: Unknown Patreon WordPress · CVSS 3.7 Low · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action](https://agentprime.io/advisories/CVE-2026-107744.md)
  `CVE-2026-107744` · CVE record: thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses · CVSS 6.5 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action](https://agentprime.io/advisories/CVE-2026-108123.md)
  `CVE-2026-108123` · CVE record: murgroland WP Booking System – Booking Calendar · CVSS 7.5 High · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse](https://agentprime.io/advisories/CVE-2026-109369.md)
  `CVE-2026-109369` · CVE record: murgroland WP Booking System – Booking Calendar · CVSS 6.8 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action](https://agentprime.io/advisories/CVE-2026-109368.md)
  `CVE-2026-109368` · CVE record: murgroland WP Booking System – Booking Calendar · CVSS 6.5 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter](https://agentprime.io/advisories/CVE-2026-92715.md)
  `CVE-2026-92715` · CVE record: themeum Tutor LMS – eLearning and online course solution · CVSS 4.3 Medium · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control
- [Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter](https://agentprime.io/advisories/CVE-2026-107762.md)
  `CVE-2026-107762` · CVE record: themeum Kirki – Freeform Page Builder, Website Builder & Customizer · CVSS 7.5 High · Not analysed yet · Published 17 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTE3VDAyOjMxOjA1LjM1MjAwMFoiLCJDVkUtMjAyNi0xMDc3NjIiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTE5VDA2OjQ2OjE5LjgyMzAwMFoiLCJDVkUtMjAyNi05NDIzMSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTE5VDA2OjQ2OjE5LjgyMzAwMFoiLCJDVkUtMjAyNi05NDIzMSJd>. Everything for agents: <https://agentprime.io/llms.txt>.