# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Temporal Server applies inbound namespace replication from a connected peer cluster to local namespaces](https://agentprime.io/advisories/CVE-2026-104355.md)
  `CVE-2026-104355` · CVE record: Temporal Technologies, Inc. Temporal Server · CVSS 7.0 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Io.quarkus:quarkus-hibernate-orm-rest-data-panache: missing authorization in quarkus rest data panache via dropped security annotations](https://agentprime.io/advisories/CVE-2026-87744.md)
  `CVE-2026-87744` · CVE record: Red Hat Red Hat build of Quarkus 3.27.6.redhat and 2 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [WordPress WP-Members plugin <= 3.5.7 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-61994.md)
  `CVE-2026-61994` · CVE record: RocketGeek WP-Members · CVSS 5.4 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [WordPress Forminator plugin <= 1.58.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-108486.md)
  `CVE-2026-108486` · CVE record: WPMU DEV Forminator · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-107418.md)
  `CVE-2026-107418` · CVE record: Arraytics Booktics · CVSS 5.4 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [WordPress Broadcast Live Video plugin <= 7.3.6 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-108475.md)
  `CVE-2026-108475` · CVE record: VideoWhisper.com Broadcast Live Video · CVSS 4.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [WordPress Paid Videochat Turnkey Site plugin <= 7.5.13 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-108476.md)
  `CVE-2026-108476` · CVE record: VideoWhisper.com Paid Videochat Turnkey Site · CVSS 5.0 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Netcore NR268 CGI Endpoint cross-site request forgery](https://agentprime.io/advisories/CVE-2026-108909.md)
  `CVE-2026-108909` · CVE record: Netcore NR268 · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Incorrect log file permissions in Progress MarkLogic Server](https://agentprime.io/advisories/CVE-2026-85971.md)
  `CVE-2026-85971` · CVE record: Progress Software Corporation MarkLogic Server · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [WordPress Booktics plugin <= 1.0.28 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-108477.md)
  `CVE-2026-108477` · CVE record: Arraytics Booktics · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [ZITADEL 3.0.0 before 4.19.2 Privilege Escalation via OIDC Token Exchange Impersonation](https://agentprime.io/advisories/CVE-2026-109374.md)
  `CVE-2026-109374` · CVE record: zitadel zitadel · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Edgeless Systems Contrast 1.8.0 before 1.24.1 World-Writable Containerd Config Privilege Escalation](https://agentprime.io/advisories/CVE-2026-109358.md)
  `CVE-2026-109358` · CVE record: edgelesssys contrast · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [LibreNMS before 26.9.0 Missing Authorization in Port Purge via PortsController](https://agentprime.io/advisories/CVE-2026-109356.md)
  `CVE-2026-109356` · CVE record: librenms librenms · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [SurrealDB before 3.3.0 Cross-Tenant Access via USE Statement](https://agentprime.io/advisories/CVE-2026-109343.md)
  `CVE-2026-109343` · CVE record: surrealdb surrealdb · CVSS 8.6 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [SurrealDB 3.1.0 before 3.3.0 Authorization Bypass via REFERENCE ON DELETE CASCADE](https://agentprime.io/advisories/CVE-2026-109340.md)
  `CVE-2026-109340` · CVE record: surrealdb surrealdb · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [SurrealDB before 3.3.0 Field Permission Bypass via LIVE SELECT $before/$after](https://agentprime.io/advisories/CVE-2026-109336.md)
  `CVE-2026-109336` · CVE record: surrealdb surrealdb · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [SurrealDB before 3.3.0 Cross-Tenant Access via Surreal-NS/Surreal-DB Headers and RPC use](https://agentprime.io/advisories/CVE-2026-109334.md)
  `CVE-2026-109334` · CVE record: surrealdb surrealdb · CVSS 8.6 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [SurrealDB 3.0.0 before 3.3.0 Cross-Tenant Record Read via RETURN FETCH](https://agentprime.io/advisories/CVE-2026-109333.md)
  `CVE-2026-109333` · CVE record: surrealdb surrealdb · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Admidio 4.3.2 through 4.3.17 and 5.0.0 before 5.0.15 Cross-Organization Access Control Bypass via members_assignment.php](https://agentprime.io/advisories/CVE-2026-109329.md)
  `CVE-2026-109329` · CVE record: Admidio admidio · CVSS 8.5 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Grav Star Ratings 2.0.1 through 2.0.3 Missing Server-Side vote_access Authorization](https://agentprime.io/advisories/CVE-2026-109323.md)
  `CVE-2026-109323` · CVE record: getgrav grav-plugin-star-ratings · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Grav Guestbook Plugin 0.5.0 and 0.5.1 Missing Authorization and CSRF in Moderation](https://agentprime.io/advisories/CVE-2026-109319.md)
  `CVE-2026-109319` · CVE record: getgrav grav-plugin-guestbook · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Grav Data Manager 1.4.0 through 1.4.5 Unauthenticated File Deletion via Admin](https://agentprime.io/advisories/CVE-2026-109316.md)
  `CVE-2026-109316` · CVE record: getgrav grav-plugin-data-manager · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Craft CMS 5.0.0 before 5.10.14 Missing Authorization via app/switch-to-licensed-edition](https://agentprime.io/advisories/CVE-2026-109306.md)
  `CVE-2026-109306` · CVE record: craftcms cms · CVSS 6.0 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Parse Server before 8.6.93 and 9.0.0 before 9.10.1-alpha.13 protectedFields Bypass via Relation Count Query](https://agentprime.io/advisories/CVE-2026-109303.md)
  `CVE-2026-109303` · CVE record: parse-community parse-server · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Parse Server 8.2.2 before 8.6.94 and 9.0.0 before 9.10.1-alpha.14 GraphQL Schema Disclosure via Persisted Queries](https://agentprime.io/advisories/CVE-2026-109302.md)
  `CVE-2026-109302` · CVE record: parse-community parse-server · CVSS 6.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Open WebUI before 0.11.4 Missing Authorization via Backend Index on Model Routes](https://agentprime.io/advisories/CVE-2026-109296.md)
  `CVE-2026-109296` · CVE record: open-webui open-webui · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Open WebUI 0.9.6 before 0.11.4 Information Disclosure via Unscoped Directory ID](https://agentprime.io/advisories/CVE-2026-109287.md)
  `CVE-2026-109287` · CVE record: open-webui open-webui · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Open WebUI 0.6.0 before 0.11.4 Improper Access Control via Stale File Metadata](https://agentprime.io/advisories/CVE-2026-109285.md)
  `CVE-2026-109285` · CVE record: open-webui open-webui · CVSS 2.3 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Open WebUI 0.11.0 before 0.11.4 Improper Authorization via Chat Fork Endpoint](https://agentprime.io/advisories/CVE-2026-109284.md)
  `CVE-2026-109284` · CVE record: open-webui open-webui · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Open WebUI 0.11.1 before 0.11.4 Authorization Bypass via OAuth Token Exchange](https://agentprime.io/advisories/CVE-2026-109283.md)
  `CVE-2026-109283` · CVE record: open-webui open-webui · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [FreeRDP 2.0.0 before 3.32.0 Insecure Private Key Permissions in winpr-makecert](https://agentprime.io/advisories/CVE-2026-109244.md)
  `CVE-2026-109244` · CVE record: FreeRDP FreeRDP · CVSS 6.8 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [FreeRDP 3.0.0 before 3.32.0 Insecure Permissions on Soft-Smartcard Private Key File](https://agentprime.io/advisories/CVE-2026-109243.md)
  `CVE-2026-109243` · CVE record: FreeRDP FreeRDP · CVSS 4.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Quay: repository auto-prune policy uuid idor in quay api](https://agentprime.io/advisories/CVE-2026-109195.md)
  `CVE-2026-109195` · CVE record: Red Hat Red Hat Quay 3 · CVSS 3.1 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Quay: build trigger uuid idor in quay api](https://agentprime.io/advisories/CVE-2026-109194.md)
  `CVE-2026-109194` · CVE record: Red Hat Red Hat Quay 3 · CVSS 6.4 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Thirty bees through 1.7.0 Account Takeover via PasswordController Guest Checkout](https://agentprime.io/advisories/CVE-2026-109394.md)
  `CVE-2026-109394` · CVE record: thirty bees thirty bees · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [QloApps through 1.7.0 Insecure Direct Object Reference in Back-Office AJAX Handlers](https://agentprime.io/advisories/CVE-2026-109393.md)
  `CVE-2026-109393` · CVE record: Webkul QloApps · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [tobychui zoraxy Path Exception Matcher authProviders.go handleBasicAuth improper authorization](https://agentprime.io/advisories/CVE-2026-108899.md)
  `CVE-2026-108899` · CVE record: tobychui zoraxy · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Privilege escalation, Broken access control
- [@neo4j/graphql: authorization relationship and connection filters invert the "none" quantifier](https://agentprime.io/advisories/CVE-2026-92682.md)
  `CVE-2026-92682` · CVE record: Neo4j @neo4j/graphql · CVSS 8.6 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [LogicalDOC Community Edition through 9.3 Missing Authorization via ConvertPdf Servlet](https://agentprime.io/advisories/CVE-2026-109203.md)
  `CVE-2026-109203` · CVE record: LogicalDOC LogicalDOC Community Edition · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [LogicalDOC Community Edition through 9.3 Missing Authorization via zip-export Servlet](https://agentprime.io/advisories/CVE-2026-109202.md)
  `CVE-2026-109202` · CVE record: LogicalDOC LogicalDOC Community Edition · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [LogicalDOC Community Edition through 9.3 Missing Authorization in DocumentService](https://agentprime.io/advisories/CVE-2026-109201.md)
  `CVE-2026-109201` · CVE record: LogicalDOC LogicalDOC Community Edition · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [BlackBeltTechnology pi-agent-dashboard Terminal terminal-handler.ts terminalManager.spawn improper authorization](https://agentprime.io/advisories/CVE-2026-108890.md)
  `CVE-2026-108890` · CVE record: BlackBeltTechnology pi-agent-dashboard · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Privilege escalation, Broken access control
- [jshERP through 3.6 Missing Authorization in Master Data Add and Import Endpoints](https://agentprime.io/advisories/CVE-2026-109188.md)
  `CVE-2026-109188` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Information Disclosure via /platformConfig/getInfoByKey](https://agentprime.io/advisories/CVE-2026-109187.md)
  `CVE-2026-109187` · CVE record: jishenghua jshERP · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Mass Assignment via PUT /user/update](https://agentprime.io/advisories/CVE-2026-109186.md)
  `CVE-2026-109186` · CVE record: jishenghua jshERP · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Privilege Escalation via PUT /user/updateUser](https://agentprime.io/advisories/CVE-2026-109185.md)
  `CVE-2026-109185` · CVE record: jishenghua jshERP · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Data Scope Bypass via /account/findAccountInOutList](https://agentprime.io/advisories/CVE-2026-109184.md)
  `CVE-2026-109184` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Approval Bypass via addDepotHeadAndDetail Status Parameter](https://agentprime.io/advisories/CVE-2026-109183.md)
  `CVE-2026-109183` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Incorrect Authorization via /supplier/exportExcel](https://agentprime.io/advisories/CVE-2026-109182.md)
  `CVE-2026-109182` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Authorization Bypass via purchaseStatus in /depotHead/list](https://agentprime.io/advisories/CVE-2026-109181.md)
  `CVE-2026-109181` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Authorization Bypass via User-Controlled Warehouse IDs](https://agentprime.io/advisories/CVE-2026-109180.md)
  `CVE-2026-109180` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Missing Authorization via /log/list and /log/info](https://agentprime.io/advisories/CVE-2026-109179.md)
  `CVE-2026-109179` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [jshERP through 3.6 Missing Authorization via /log Audit Endpoints](https://agentprime.io/advisories/CVE-2026-109178.md)
  `CVE-2026-109178` · CVE record: jishenghua jshERP · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [MoguBlog through 6.2 Broken Access Control via networkDisk moveFile and edit](https://agentprime.io/advisories/CVE-2026-109177.md)
  `CVE-2026-109177` · CVE record: moxi624 MoguBlog · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [MoguBlog through 6.2 IDOR Allows Deleting Other Administrators' Network-Disk Files](https://agentprime.io/advisories/CVE-2026-109176.md)
  `CVE-2026-109176` · CVE record: moxi624 MoguBlog · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [MoguBlog through 6.2 Broken Access Control via /networkDisk/getFileList](https://agentprime.io/advisories/CVE-2026-109175.md)
  `CVE-2026-109175` · CVE record: moxi624 MoguBlog · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [MoguBlog through 6.2 Credential Disclosure via /oauth/getSystemConfig](https://agentprime.io/advisories/CVE-2026-109174.md)
  `CVE-2026-109174` · CVE record: moxi624 MoguBlog · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [yshop-crm through 2.1.3 Missing Authorization via invoice check endpoint](https://agentprime.io/advisories/CVE-2026-109173.md)
  `CVE-2026-109173` · CVE record: guchengwuyue yshop-crm · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [yshop-crm through 2.1.3 Missing Authorization via contract-receivables check endpoint](https://agentprime.io/advisories/CVE-2026-109172.md)
  `CVE-2026-109172` · CVE record: guchengwuyue yshop-crm · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [yshop-crm through 2.1.3 Missing Authorization via /admin-api/crm/contract/check](https://agentprime.io/advisories/CVE-2026-109171.md)
  `CVE-2026-109171` · CVE record: guchengwuyue yshop-crm · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTEyVDEzOjEwOjMzLjU5MjAwMFoiLCJDVkUtMjAyNi0xMDkxNzEiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTEyVDE4OjQ0OjIzLjAzMjAwMFoiLCJDVkUtMjAyNi04OTE0MCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTEyVDE4OjQ0OjIzLjAzMjAwMFoiLCJDVkUtMjAyNi04OTE0MCJd>. Everything for agents: <https://agentprime.io/llms.txt>.