# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate deleteBatch Endpoint](https://agentprime.io/advisories/CVE-2026-108619.md)
  `CVE-2026-108619` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Edit Endpoint](https://agentprime.io/advisories/CVE-2026-108618.md)
  `CVE-2026-108618` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate/add Endpoint](https://agentprime.io/advisories/CVE-2026-108617.md)
  `CVE-2026-108617` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/deleteBatch](https://agentprime.io/advisories/CVE-2026-108616.md)
  `CVE-2026-108616` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/delete](https://agentprime.io/advisories/CVE-2026-108615.md)
  `CVE-2026-108615` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/extData/exportXls](https://agentprime.io/advisories/CVE-2026-108614.md)
  `CVE-2026-108614` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/app/release Endpoint](https://agentprime.io/advisories/CVE-2026-108613.md)
  `CVE-2026-108613` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/word/deleteBatch](https://agentprime.io/advisories/CVE-2026-108612.md)
  `CVE-2026-108612` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/word/delete Endpoint](https://agentprime.io/advisories/CVE-2026-108611.md)
  `CVE-2026-108611` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/word/edit Endpoint](https://agentprime.io/advisories/CVE-2026-108610.md)
  `CVE-2026-108610` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 IDOR via /airag/voice/listByUser userId Parameter](https://agentprime.io/advisories/CVE-2026-108609.md)
  `CVE-2026-108609` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 IDOR via deleteVoiceRecord userId Parameter](https://agentprime.io/advisories/CVE-2026-108608.md)
  `CVE-2026-108608` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 IDOR via deleteVideoRecord userId Parameter](https://agentprime.io/advisories/CVE-2026-108607.md)
  `CVE-2026-108607` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/deleteById](https://agentprime.io/advisories/CVE-2026-108606.md)
  `CVE-2026-108606` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/ocr/edit Endpoint](https://agentprime.io/advisories/CVE-2026-108605.md)
  `CVE-2026-108605` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WordPress ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce plugin <= 2.2.4 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-103685.md)
  `CVE-2026-103685` · CVE record: VillaTheme ALD – Dropshipping and Fulfillment for AliExpress and WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Tabularis through 0.27.0 Read-Only Bypass via MCP run_query SELECT Classification](https://agentprime.io/advisories/CVE-2026-108604.md)
  `CVE-2026-108604` · CVE record: TabularisDB tabularis · CVSS 5.8 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WordPress Forminator plugin <= 1.57.3 - Arbitrary Content Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-65459.md)
  `CVE-2026-65459` · CVE record: WPMU DEV Forminator · CVSS 7.5 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WordPress Barcode Scanner with Inventory & Order Manager plugin <= 1.13.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62118.md)
  `CVE-2026-62118` · CVE record: Dmitry V. Barcode Scanner with Inventory & Order Manager · CVSS 7.3 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WordPress AWS S3 for WordPress Plugin – Upcasted plugin <= 3.1.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62035.md)
  `CVE-2026-62035` · CVE record: upcasted AWS S3 for WordPress Plugin – Upcasted · CVSS 6.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WordPress uListing plugin <= 2.2.0 - Settings Change vulnerability](https://agentprime.io/advisories/CVE-2026-62033.md)
  `CVE-2026-62033` · CVE record: Stylemix uListing · CVSS 7.6 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WordPress DK theme <= 3.2.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-42706.md)
  `CVE-2026-42706` · CVE record: ThemeGoods DK · CVSS 7.5 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WordPress Grand News theme <= 3.4 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-42705.md)
  `CVE-2026-42705` · CVE record: ThemeGoods Grand News · CVSS 7.5 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WordPress Jetpack VideoPress plugin <= 3.6 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-40808.md)
  `CVE-2026-40808` · CVE record: Automattic Jetpack VideoPress · CVSS 6.5 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WordPress Pubjet | پابجت plugin <= 5.4.8 - Settings Change vulnerability](https://agentprime.io/advisories/CVE-2026-40802.md)
  `CVE-2026-40802` · CVE record: pubjet Pubjet | پابجت · CVSS 7.6 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WordPress Wordable plugin <= 8.2.10 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-40801.md)
  `CVE-2026-40801` · CVE record: Wordable Wordable · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WordPress WPSection plugin <= 1.5.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-40777.md)
  `CVE-2026-40777` · CVE record: Rashid WPSection · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [OpenLIT 2.1.0 Authorization Bypass via x-openlit-project-id Header](https://agentprime.io/advisories/CVE-2026-108596.md)
  `CVE-2026-108596` · CVE record: openlit openlit · CVSS 6.0 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Phi 0.3.0 through 0.28.4 Permission Bypass via agent_spawn Workdir](https://agentprime.io/advisories/CVE-2026-108595.md)
  `CVE-2026-108595` · CVE record: pulseaiclub phi · CVSS 6.0 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WordPress GIFT4U plugin <= 1.1.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-103357.md)
  `CVE-2026-103357` · CVE record: VillaTheme GIFT4U · CVSS 6.9 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WordPress Bayarcash WooCommerce plugin <= 4.4.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-106609.md)
  `CVE-2026-106609` · CVE record: Web Impian Bayarcash WooCommerce · CVSS 7.5 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [1MCP Agent 0.20.0 through 0.39.0 OAuth Tag-Scope Bypass via Negated Tag Filter](https://agentprime.io/advisories/CVE-2026-108586.md)
  `CVE-2026-108586` · CVE record: 1mcp-app @1mcp/agent · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [GenOffice through 0.11.505 Insecure Permissions in HTTP MCP Server File Store](https://agentprime.io/advisories/CVE-2026-108582.md)
  `CVE-2026-108582` · CVE record: genspark-ai GenOffice · CVSS 6.8 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Octop through 1.0.2b6 Missing Authorization Exposes Provider API Keys via /api/providers](https://agentprime.io/advisories/CVE-2026-108581.md)
  `CVE-2026-108581` · CVE record: TencentCloud Octop · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [SkillHub before 0.2.22 Account Takeover via Account Merge Flow](https://agentprime.io/advisories/CVE-2026-108550.md)
  `CVE-2026-108550` · CVE record: iflytek skillhub · CVSS 8.7 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [AstronRPA through 1.1.6 Cross-Tenant Shared Variable Disclosure via get-batch-shared-var](https://agentprime.io/advisories/CVE-2026-108547.md)
  `CVE-2026-108547` · CVE record: iflytek astron-rpa · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Strapi 5.47.0 through 5.57.0 Improper Authorization via Admin API Token Field Permissions](https://agentprime.io/advisories/CVE-2026-108114.md)
  `CVE-2026-108114` · CVE record: strapi strapi · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Immich through 3.3.1 Missing Authorization in Partner Sync Exposes Locked Folder Metadata](https://agentprime.io/advisories/CVE-2026-108165.md)
  `CVE-2026-108165` · CVE record: immich-app immich · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Open Source Social Network (OSSN) through 10.1 IDOR via Message Attachment Route](https://agentprime.io/advisories/CVE-2026-108164.md)
  `CVE-2026-108164` · CVE record: opensource-socialnetwork opensource-socialnetwork · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels <= 5.0.2 - Insecure Direct Object Reference to Unauthenticated Unauthorized Order Document Access via 'email' Param…](https://agentprime.io/advisories/CVE-2026-93746.md)
  `CVE-2026-93746` · CVE record: webtoffee WebToffee WooCommerce PDF Invoices, Packing Slips, Delivery Notes & Shipping Labels · CVSS 7.5 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [AutomatorWP <= 5.8.4 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via wp_ajax_automatorwp_fluentform_get_forms AJAX Action](https://agentprime.io/advisories/CVE-2026-104728.md)
  `CVE-2026-104728` · CVE record: rubengc AutomatorWP – No-Code Workflow Automation, Integration & Webhooks Plugin, now with AI · CVSS 4.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WordPress Motors theme <= 1.4.108 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-93950.md)
  `CVE-2026-93950` · CVE record: StylemixThemes Motors · CVSS 7.5 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Unauthorized information acquisition vulnerability in ZTE Z80 Ultra product](https://agentprime.io/advisories/CVE-2026-108503.md)
  `CVE-2026-108503` · CVE record: ZTE Z80 Ultra · CVSS 3.3 Low · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [CV Builder – Professional Resume Builder SaaS <= 1.3.1 - Missing Authorization to Unauthenticated PNG File Upload](https://agentprime.io/advisories/CVE-2026-3717.md)
  `CVE-2026-3717` · CVE record: bestwpdeveloper WP CV Builder · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [WP File Download <= 6.3.9 - Missing Authorization to Authenticated (Subscriber+) Arbitrary File Deletion/Modification via 'task' Parameter to Multiple Functions](https://agentprime.io/advisories/CVE-2026-94538.md)
  `CVE-2026-94538` · CVE record: JoomUnited WP File Download · CVSS 8.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Fluent Forms <= 6.2.5 - Missing Authorization to Authenticated (Custom+) Sensitive Data Exposure and Modification](https://agentprime.io/advisories/CVE-2026-15178.md)
  `CVE-2026-15178` · CVE record: wpmanageninja Fluent Forms – Customizable Contact Forms, Survey, Quiz, & Conversational Form Builder · CVSS 5.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Tutor LMS 4.0.5 - 4.1.0 - Instructor+ Arbitrary Post Reparenting via IDOR](https://agentprime.io/advisories/CVE-2026-85571.md)
  `CVE-2026-85571` · CVE record: Unknown Tutor LMS · CVSS 6.5 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Accept PayPal Payments using Contact Form 7 < 4.0.7 - Unauthenticated Transaction Status Forgery](https://agentprime.io/advisories/CVE-2026-105989.md)
  `CVE-2026-105989` · CVE record: Unknown Accept PayPal Payments using Contact Form 7 · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Portfolio Filter Gallery 2.0.2 - 2.2.0 - Contributor+ Cross-User Video Thumbnail Deletion via pfg_delete_video_thumbnail](https://agentprime.io/advisories/CVE-2026-105977.md)
  `CVE-2026-105977` · CVE record: Unknown Portfolio Filter Gallery · CVSS 2.2 Low · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Portfolio Filter Gallery < 2.2.1 - Contributor+ Missing Authorization via Multiple AJAX Actions](https://agentprime.io/advisories/CVE-2026-105976.md)
  `CVE-2026-105976` · CVE record: Unknown Portfolio Filter Gallery · CVSS 4.7 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Semantic Search Settings Modification via ajax_save_semantic_search_settings AJAX action](https://agentprime.io/advisories/CVE-2026-104742.md)
  `CVE-2026-104742` · CVE record: senols AI Puffer – AI Chatbot, AI Writer & Automation · CVSS 3.1 Low · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [AI Puffer <= 2.4.89 - Missing Authorization to Authenticated (Subscriber+) Global Plugin Settings Modification via ajax_save_cpt_indexing_options AJAX Endpoint](https://agentprime.io/advisories/CVE-2026-104741.md)
  `CVE-2026-104741` · CVE record: senols AI Puffer – AI Chatbot, AI Writer & Automation · CVSS 3.1 Low · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params\[presets\]\[order_ite…](https://agentprime.io/advisories/CVE-2026-91050.md)
  `CVE-2026-91050` · CVE record: latepoint Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress · CVSS 4.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [rtMedia for WordPress, BuddyPress and bbPress <= 4.7.13 - Missing Authorization to Unauthenticated Limited File Read/Disclosure and Limited File Deletion via Sideload via 'files\[tmp_name\]' Parameter](https://agentprime.io/advisories/CVE-2026-89301.md)
  `CVE-2026-89301` · CVE record: rtcamp rtMedia for WordPress, BuddyPress and bbPress · CVSS 7.5 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Appointment Booking Calendar <= 1.6.11.11 - Incorrect Authorization to Unauthenticated Sensitive Field Modification via Appointment Public Token](https://agentprime.io/advisories/CVE-2026-6723.md)
  `CVE-2026-6723` · CVE record: croixhaug Simply Schedule Appointments · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Hello Plus <= 1.7.7 - Authenticated (Contributor+) Missing Authorization to Template Activation via hello_plus_set_as_entire_site](https://agentprime.io/advisories/CVE-2026-5727.md)
  `CVE-2026-5727` · CVE record: elemntor Hello Plus · CVSS 5.4 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Online Scheduling and Appointment Booking System <= 28.4 - Insecure Direct Object Reference to Authenticated (Subscriber+) Privilege Escalation via 'id' and 'wp_user_id' Parameters via Query String /…](https://agentprime.io/advisories/CVE-2026-104898.md)
  `CVE-2026-104898` · CVE record: ladela Online Scheduling and Appointment Booking System – Bookly · CVSS 6.8 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Academy LMS <= 4.0.3 - Missing Authorization to Authenticated (Custom+) Arbitrary Academy Comment Deletion via delete_lesson_comment AJAX — Attacker-Controlled course_id vs. Target comment_id](https://agentprime.io/advisories/CVE-2026-104915.md)
  `CVE-2026-104915` · CVE record: kodezen Academy LMS – AI Course Builder, Quizzes, Certificates & eLearning · CVSS 6.5 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [Vikunja: Write-level project members can delete admin-tier link shares through an unloaded permission check](https://agentprime.io/advisories/GHSA-fmmf-xq98-g327.md)
  `GHSA-fmmf-xq98-g327`, `CVE-2026-111921`, `GO-2026-6730` · Go `code.vikunja.io/api`: affected `>=0.13.0, <2.7.0`, fixed in `2.7.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Broken access control
- [Vikunja: Explicit lower-permission share on a sub-project is silently overridden by an inherited parent permission (broken access control / privilege-management regression in v2.6.0)](https://agentprime.io/advisories/GHSA-pjr3-86v4-5p7w.md)
  `GHSA-pjr3-86v4-5p7w`, `CVE-2026-111920`, `GO-2026-6745` · Go `code.vikunja.io/api`: affected `>=2.6.0, <2.7.0`, fixed in `2.7.0` · CVSS 5.3 Medium · Not analysed yet · Published 9 Oct 2026 · Tags: Privilege escalation, Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTA5VDIwOjU3OjQ0LjAwMDAwMFoiLCJHSFNBLXBqcjMtODZ2NC01cDd3Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTEwVDIxOjQ5OjE4LjU5NjAwMFoiLCJDVkUtMjAyNi0xMDg2MjAiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTEwVDIxOjQ5OjE4LjU5NjAwMFoiLCJDVkUtMjAyNi0xMDg2MjAiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.