# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusAnnouncement](https://agentprime.io/advisories/CVE-2026-108679.md)
  `CVE-2026-108679` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRoles](https://agentprime.io/advisories/CVE-2026-108678.md)
  `CVE-2026-108678` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserByName](https://agentprime.io/advisories/CVE-2026-108677.md)
  `CVE-2026-108677` · CVE record: jeecgboot JeecgBoot · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/downLoadFiles](https://agentprime.io/advisories/CVE-2026-108676.md)
  `CVE-2026-108676` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/annountCement/editIzTop](https://agentprime.io/advisories/CVE-2026-108675.md)
  `CVE-2026-108675` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /openapi/queryById](https://agentprime.io/advisories/CVE-2026-108674.md)
  `CVE-2026-108674` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/exportXls](https://agentprime.io/advisories/CVE-2026-108673.md)
  `CVE-2026-108673` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Authorization Bypass via /airag/video/listByUser](https://agentprime.io/advisories/CVE-2026-108672.md)
  `CVE-2026-108672` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/airagMcp/queryById](https://agentprime.io/advisories/CVE-2026-108671.md)
  `CVE-2026-108671` · CVE record: jeecgboot JeecgBoot · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/experiment](https://agentprime.io/advisories/CVE-2026-108670.md)
  `CVE-2026-108670` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/knowledge/embedding/search](https://agentprime.io/advisories/CVE-2026-108669.md)
  `CVE-2026-108669` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteRecycleBin](https://agentprime.io/advisories/CVE-2026-108668.md)
  `CVE-2026-108668` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/revertRecycleBin](https://agentprime.io/advisories/CVE-2026-108667.md)
  `CVE-2026-108667` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/deleteBatch](https://agentprime.io/advisories/CVE-2026-108666.md)
  `CVE-2026-108666` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/edit](https://agentprime.io/advisories/CVE-2026-108665.md)
  `CVE-2026-108665` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/queryById](https://agentprime.io/advisories/CVE-2026-108664.md)
  `CVE-2026-108664` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteApply](https://agentprime.io/advisories/CVE-2026-108663.md)
  `CVE-2026-108663` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/deleteTenantPackUser](https://agentprime.io/advisories/CVE-2026-108662.md)
  `CVE-2026-108662` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/changeOwenUserTenant](https://agentprime.io/advisories/CVE-2026-108661.md)
  `CVE-2026-108661` · CVE record: jeecgboot JeecgBoot · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/updateApplyStatus](https://agentprime.io/advisories/CVE-2026-108660.md)
  `CVE-2026-108660` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/listPackByTenantUserId](https://agentprime.io/advisories/CVE-2026-108659.md)
  `CVE-2026-108659` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/queryTenantAuthInfo](https://agentprime.io/advisories/CVE-2026-108658.md)
  `CVE-2026-108658` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/passApply](https://agentprime.io/advisories/CVE-2026-108657.md)
  `CVE-2026-108657` · CVE record: jeecgboot JeecgBoot · CVSS 8.6 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via getTenantPackApplyUsers Endpoint](https://agentprime.io/advisories/CVE-2026-108656.md)
  `CVE-2026-108656` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/quartzJob/queryById](https://agentprime.io/advisories/CVE-2026-108655.md)
  `CVE-2026-108655` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/oss/file/queryById](https://agentprime.io/advisories/CVE-2026-108654.md)
  `CVE-2026-108654` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via GET /openapi/list](https://agentprime.io/advisories/CVE-2026-108653.md)
  `CVE-2026-108653` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/api/updateAvatar](https://agentprime.io/advisories/CVE-2026-108652.md)
  `CVE-2026-108652` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getRolesByUserId](https://agentprime.io/advisories/CVE-2026-108651.md)
  `CVE-2026-108651` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserPermissionSet](https://agentprime.io/advisories/CVE-2026-108650.md)
  `CVE-2026-108650` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserRolesById](https://agentprime.io/advisories/CVE-2026-108649.md)
  `CVE-2026-108649` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via getDynamicDbSourceByCode Endpoint](https://agentprime.io/advisories/CVE-2026-108648.md)
  `CVE-2026-108648` · CVE record: jeecgboot JeecgBoot · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/checkRule/importExcel](https://agentprime.io/advisories/CVE-2026-108647.md)
  `CVE-2026-108647` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/category/importExcel](https://agentprime.io/advisories/CVE-2026-108646.md)
  `CVE-2026-108646` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/category/edit](https://agentprime.io/advisories/CVE-2026-108645.md)
  `CVE-2026-108645` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/category/delete](https://agentprime.io/advisories/CVE-2026-108644.md)
  `CVE-2026-108644` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/category/deleteBatch](https://agentprime.io/advisories/CVE-2026-108643.md)
  `CVE-2026-108643` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 IDOR via PUT /sys/sysAnnouncementSend/edit](https://agentprime.io/advisories/CVE-2026-108642.md)
  `CVE-2026-108642` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 IDOR via /sys/sysAnnouncementSend/getOne](https://agentprime.io/advisories/CVE-2026-108641.md)
  `CVE-2026-108641` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/queryById](https://agentprime.io/advisories/CVE-2026-108640.md)
  `CVE-2026-108640` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/deletePhysic/{id}](https://agentprime.io/advisories/CVE-2026-108639.md)
  `CVE-2026-108639` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/user/deleteGroupUser](https://agentprime.io/advisories/CVE-2026-108638.md)
  `CVE-2026-108638` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via deleteUserGroupBatch Endpoint](https://agentprime.io/advisories/CVE-2026-108637.md)
  `CVE-2026-108637` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepart/appImportExcel](https://agentprime.io/advisories/CVE-2026-108636.md)
  `CVE-2026-108636` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via getDepartmentHead Endpoint](https://agentprime.io/advisories/CVE-2026-108635.md)
  `CVE-2026-108635` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission deleteBatch Endpoint](https://agentprime.io/advisories/CVE-2026-108634.md)
  `CVE-2026-108634` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/add](https://agentprime.io/advisories/CVE-2026-108633.md)
  `CVE-2026-108633` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission queryById Endpoint](https://agentprime.io/advisories/CVE-2026-108632.md)
  `CVE-2026-108632` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/delete](https://agentprime.io/advisories/CVE-2026-108631.md)
  `CVE-2026-108631` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartPermission/edit](https://agentprime.io/advisories/CVE-2026-108630.md)
  `CVE-2026-108630` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via sysDepartPermission datarule Endpoint](https://agentprime.io/advisories/CVE-2026-108629.md)
  `CVE-2026-108629` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via saveDeptRolePermission Endpoint](https://agentprime.io/advisories/CVE-2026-108628.md)
  `CVE-2026-108628` · CVE record: jeecgboot JeecgBoot · CVSS 8.6 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/role/datarule Endpoint](https://agentprime.io/advisories/CVE-2026-108627.md)
  `CVE-2026-108627` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via sysMessage queryById Endpoint](https://agentprime.io/advisories/CVE-2026-108626.md)
  `CVE-2026-108626` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via sysMessage Edit Endpoint](https://agentprime.io/advisories/CVE-2026-108625.md)
  `CVE-2026-108625` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via sysMessage deleteBatch Endpoint](https://agentprime.io/advisories/CVE-2026-108624.md)
  `CVE-2026-108624` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/log/deleteBatch](https://agentprime.io/advisories/CVE-2026-108623.md)
  `CVE-2026-108623` · CVE record: jeecgboot JeecgBoot · CVSS 7.1 High · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/log/delete Endpoint](https://agentprime.io/advisories/CVE-2026-108622.md)
  `CVE-2026-108622` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/position/edit](https://agentprime.io/advisories/CVE-2026-108621.md)
  `CVE-2026-108621` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/position/deleteBatch](https://agentprime.io/advisories/CVE-2026-108620.md)
  `CVE-2026-108620` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 10 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTEwVDIxOjQ5OjE4LjU5NjAwMFoiLCJDVkUtMjAyNi0xMDg2MjAiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTEwVDIxOjQ5OjU5LjE0NjAwMFoiLCJDVkUtMjAyNi0xMDg2ODAiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTEwVDIxOjQ5OjU5LjE0NjAwMFoiLCJDVkUtMjAyNi0xMDg2ODAiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.