# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [lamp-cloud through 5.10.1 IDOR via /anyone/appendix/listFileByBizId](https://agentprime.io/advisories/CVE-2026-109168.md)
  `CVE-2026-109168` · CVE record: dromara lamp-cloud · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [TDuck survey form through 6.0 Authorization Bypass via User-Controlled Theme ID in POST /user/form/theme/save](https://agentprime.io/advisories/CVE-2026-109167.md)
  `CVE-2026-109167` · CVE record: TDuckCloud tduck-survey-form · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [lamp-cloud through 5.10.1 IDOR via /anyone/file/findUrlById](https://agentprime.io/advisories/CVE-2026-109166.md)
  `CVE-2026-109166` · CVE record: dromara lamp-cloud · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [TDuck survey form through 6.0 Authorization Bypass via User-Controlled Form Key in POST /user/form/item/batch/create](https://agentprime.io/advisories/CVE-2026-109165.md)
  `CVE-2026-109165` · CVE record: TDuckCloud tduck-survey-form · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [TDuck survey form through 6.0 Authorization Bypass via User-Controlled Submission IDs in POST /user/form/data/delete/{formKey}](https://agentprime.io/advisories/CVE-2026-109164.md)
  `CVE-2026-109164` · CVE record: TDuckCloud tduck-survey-form · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [LavaLite CMS through 10.1.2 Authorization Bypass via User Update API](https://agentprime.io/advisories/CVE-2026-108951.md)
  `CVE-2026-108951` · CVE record: lavalite cms · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Open Source Social Network (OSSN) through 10.1 Missing Authorization via Album Photo Routes](https://agentprime.io/advisories/CVE-2026-108950.md)
  `CVE-2026-108950` · CVE record: opensource-socialnetwork opensource-socialnetwork · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Apache SkyWalking BanyanDB: Canopy does not enforce readonly-role restrictions on the /monitoring/\* proxy](https://agentprime.io/advisories/CVE-2026-85499.md)
  `CVE-2026-85499` · CVE record: Apache Software Foundation Apache SkyWalking BanyanDB · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Authorization Bypass Through User-Controlled Key vulnerability affecting Tuleap Enterprise Edition from 17.0 through 17.5](https://agentprime.io/advisories/CVE-2026-105411.md)
  `CVE-2026-105411` · CVE record: Dassault Systèmes Tuleap Enterprise Edition · CVSS 8.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [MikroTik RouterOS WinBox split-principal authentication bypass allows privilege escalation](https://agentprime.io/advisories/CVE-2026-103903.md)
  `CVE-2026-103903` · CVE record: MikroTik RouterOS · CVSS 8.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [WordPress WP User Manager plugin <= 2.9.22 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-107423.md)
  `CVE-2026-107423` · CVE record: WP User Manager WP User Manager · CVSS 4.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [WordPress Flexible Subscriptions plugin <= 1.8.4 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-107869.md)
  `CVE-2026-107869` · CVE record: WP Desk Flexible Subscriptions · CVSS 4.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [WordPress Products Restricted Users for WooCommerce plugin <= 0.7 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-107863.md)
  `CVE-2026-107863` · CVE record: Codection Products Restricted Users for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [WordPress Event post plugin <= 6.1.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-107432.md)
  `CVE-2026-107432` · CVE record: NOUS Ouvert Utile et Simple Event post · CVSS 5.4 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [WordPress TMDS plugin <= 1.0.15 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-103356.md)
  `CVE-2026-103356` · CVE record: VillaTheme TMDS · CVSS 5.4 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [WordPress VideoWhisper Site Manager for ChatGPT, Claude, Codex plugin <= 1.2.10 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-107430.md)
  `CVE-2026-107430` · CVE record: VideoWhisper.com VideoWhisper Site Manager for ChatGPT, Claude, Codex · CVSS 5.4 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [WordPress Event post plugin <= 6.1.1 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-107427.md)
  `CVE-2026-107427` · CVE record: NOUS Ouvert Utile et Simple Event post · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [SEMCMS SEMCMS_User.php user improper authorization](https://agentprime.io/advisories/CVE-2026-108812.md)
  `CVE-2026-108812` · CVE record: SEMCMS · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Privilege escalation, Broken access control
- [WMCMS index.php information disclosure](https://agentprime.io/advisories/CVE-2026-108811.md)
  `CVE-2026-108811` · CVE record: WMCMS · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure, Broken access control
- [tsi-coop tsi-dpdp-cms JSON Schema Validation information disclosure](https://agentprime.io/advisories/CVE-2026-108810.md)
  `CVE-2026-108810` · CVE record: tsi-coop tsi-dpdp-cms · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure, Broken access control
- [WP Comment Cleaner 6.1 - 7.1 - Subscriber+ Bulk Comment Deletion via nav_delete_all_comment](https://agentprime.io/advisories/CVE-2026-107791.md)
  `CVE-2026-107791` · CVE record: Unknown WP Comment Cleaner · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Hotel Booking <= 3.8 - Subscriber+ Booking Order PII Disclosure via IDOR](https://agentprime.io/advisories/CVE-2026-84167.md)
  `CVE-2026-84167` · CVE record: Unknown Hotel Booking · CVSS 4.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Foreman: domain and subnet interface api skips host search filters](https://agentprime.io/advisories/CVE-2026-107203.md)
  `CVE-2026-107203` · CVE record: Red Hat Red Hat Satellite 6 · CVSS 5.4 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Foreman: api filter lookup ignores a search-limited filter permission](https://agentprime.io/advisories/CVE-2026-107193.md)
  `CVE-2026-107193` · CVE record: Red Hat Red Hat Satellite 6.16 for RHEL 8 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Improper access control in Samsung Mobile Samsung Internet](https://agentprime.io/advisories/CVE-2026-21135.md)
  `CVE-2026-21135` · CVE record: Samsung Mobile Samsung Internet · CVSS 5.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Incorrect default permissions in Samsung Mobile Samsung Flow](https://agentprime.io/advisories/CVE-2026-21131.md)
  `CVE-2026-21131` · CVE record: Samsung Mobile Samsung Flow · CVSS 2.1 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Improper access control in Samsung Mobile Devices](https://agentprime.io/advisories/CVE-2026-21118.md)
  `CVE-2026-21118` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Improper access control in Samsung Mobile Devices](https://agentprime.io/advisories/CVE-2026-21117.md)
  `CVE-2026-21117` · CVE record: Samsung Mobile Samsung Mobile Devices · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [prasathmani TinyFileManager tinyfilemanager.php move_uploaded_file unrestricted upload](https://agentprime.io/advisories/CVE-2026-108801.md)
  `CVE-2026-108801` · CVE record: prasathmani TinyFileManager · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [yangzongzhuan RuoYi cross-site request forgery](https://agentprime.io/advisories/CVE-2026-108800.md)
  `CVE-2026-108800` · CVE record: yangzongzhuan RuoYi · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [ZKTeco BioTime Employee REST API employees authorization](https://agentprime.io/advisories/CVE-2026-108797.md)
  `CVE-2026-108797` · CVE record: ZKTeco BioTime · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [ZKTeco BioTime Biometric Data Endpoint finger_data authorization](https://agentprime.io/advisories/CVE-2026-108796.md)
  `CVE-2026-108796` · CVE record: ZKTeco BioTime · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [ZKTeco BioTime System Settings API systemSettings access control](https://agentprime.io/advisories/CVE-2026-108795.md)
  `CVE-2026-108795` · CVE record: ZKTeco BioTime · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Privilege escalation, Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/user/getUserDetailByUserId](https://agentprime.io/advisories/CVE-2026-108891.md)
  `CVE-2026-108891` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/sysDepartRole/exportXls](https://agentprime.io/advisories/CVE-2026-108888.md)
  `CVE-2026-108888` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/comment/exportXls](https://agentprime.io/advisories/CVE-2026-108887.md)
  `CVE-2026-108887` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/user/queryChildrenByUsername](https://agentprime.io/advisories/CVE-2026-108886.md)
  `CVE-2026-108886` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/message/sysMessage/delete](https://agentprime.io/advisories/CVE-2026-108885.md)
  `CVE-2026-108885` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via sysMessageTemplate Delete Endpoint](https://agentprime.io/advisories/CVE-2026-108884.md)
  `CVE-2026-108884` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/thirdApp/editThirdAppConfig](https://agentprime.io/advisories/CVE-2026-108883.md)
  `CVE-2026-108883` · CVE record: jeecgboot JeecgBoot · CVSS 7.1 High · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/position/removePositionUser](https://agentprime.io/advisories/CVE-2026-108882.md)
  `CVE-2026-108882` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/tenant/getTenantPackInfo](https://agentprime.io/advisories/CVE-2026-108881.md)
  `CVE-2026-108881` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/dict/editDictByLowAppId](https://agentprime.io/advisories/CVE-2026-108880.md)
  `CVE-2026-108880` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 IDOR via /airag/api/getChatVariable Username Parameter](https://agentprime.io/advisories/CVE-2026-108879.md)
  `CVE-2026-108879` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/app/queryById](https://agentprime.io/advisories/CVE-2026-108878.md)
  `CVE-2026-108878` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /airag/prompts/delete](https://agentprime.io/advisories/CVE-2026-108877.md)
  `CVE-2026-108877` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/user/putCancelQuit](https://agentprime.io/advisories/CVE-2026-108876.md)
  `CVE-2026-108876` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/user/addSysUserGroup](https://agentprime.io/advisories/CVE-2026-108875.md)
  `CVE-2026-108875` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/user/changeDepartChargePerson](https://agentprime.io/advisories/CVE-2026-108874.md)
  `CVE-2026-108874` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/user/doUpdateDepartInfo](https://agentprime.io/advisories/CVE-2026-108873.md)
  `CVE-2026-108873` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/user/batchEditUsers](https://agentprime.io/advisories/CVE-2026-108872.md)
  `CVE-2026-108872` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via POST /sys/sysDepartRole/datarule](https://agentprime.io/advisories/CVE-2026-108871.md)
  `CVE-2026-108871` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via POST /sys/role/datarule](https://agentprime.io/advisories/CVE-2026-108870.md)
  `CVE-2026-108870` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendSysAnnouncement](https://agentprime.io/advisories/CVE-2026-108869.md)
  `CVE-2026-108869` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/api/sendBusTemplateAnnouncement](https://agentprime.io/advisories/CVE-2026-108868.md)
  `CVE-2026-108868` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/api/getUserRoleSetById](https://agentprime.io/advisories/CVE-2026-108867.md)
  `CVE-2026-108867` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [JeecgBoot through 3.9.5 Missing Authorization via /sys/api/queryUserAuths](https://agentprime.io/advisories/CVE-2026-108866.md)
  `CVE-2026-108866` · CVE record: jeecgboot JeecgBoot · CVSS 5.3 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [iFlytek Astron Agent through 1.1.2 Authorization Bypass via /workflow/v1/resume Endpoint](https://agentprime.io/advisories/CVE-2026-108864.md)
  `CVE-2026-108864` · CVE record: iflytek astron-agent · CVSS 2.3 Low · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [APIPark through 1.9.7-beta IDOR via application authorization endpoints](https://agentprime.io/advisories/CVE-2026-108862.md)
  `CVE-2026-108862` · CVE record: APIParkLab APIPark · CVSS 6.0 Medium · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control
- [UnicomAI Wanwu through 0.6.5 Authorization Bypass via /v1/appspace/app/key AppKey Minting](https://agentprime.io/advisories/CVE-2026-108856.md)
  `CVE-2026-108856` · CVE record: UnicomAI Wanwu · CVSS 2.3 Low · Not analysed yet · Published 11 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTExVDEzOjI2OjA0LjU1ODAwMFoiLCJDVkUtMjAyNi0xMDg4NTYiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTEyVDEzOjEwOjMzLjU5MjAwMFoiLCJDVkUtMjAyNi0xMDkxNzEiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTEyVDEzOjEwOjMzLjU5MjAwMFoiLCJDVkUtMjAyNi0xMDkxNzEiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.