# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data](https://agentprime.io/advisories/CVE-2026-109661.md)
  `CVE-2026-109661` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints](https://agentprime.io/advisories/CVE-2026-109660.md)
  `CVE-2026-109660` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data](https://agentprime.io/advisories/CVE-2026-109659.md)
  `CVE-2026-109659` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints](https://agentprime.io/advisories/CVE-2026-109658.md)
  `CVE-2026-109658` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access](https://agentprime.io/advisories/CVE-2026-109656.md)
  `CVE-2026-109656` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints](https://agentprime.io/advisories/CVE-2026-109655.md)
  `CVE-2026-109655` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints](https://agentprime.io/advisories/CVE-2026-109654.md)
  `CVE-2026-109654` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data](https://agentprime.io/advisories/CVE-2026-109650.md)
  `CVE-2026-109650` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization](https://agentprime.io/advisories/CVE-2026-109645.md)
  `CVE-2026-109645` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data](https://agentprime.io/advisories/CVE-2026-109644.md)
  `CVE-2026-109644` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data](https://agentprime.io/advisories/CVE-2026-109643.md)
  `CVE-2026-109643` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints](https://agentprime.io/advisories/CVE-2026-109642.md)
  `CVE-2026-109642` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints](https://agentprime.io/advisories/CVE-2026-109641.md)
  `CVE-2026-109641` · CVE record: frappe erpnext · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification](https://agentprime.io/advisories/CVE-2026-109640.md)
  `CVE-2026-109640` · CVE record: frappe erpnext · CVSS 7.2 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification](https://agentprime.io/advisories/CVE-2026-109637.md)
  `CVE-2026-109637` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data](https://agentprime.io/advisories/CVE-2026-109636.md)
  `CVE-2026-109636` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints](https://agentprime.io/advisories/CVE-2026-109635.md)
  `CVE-2026-109635` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints](https://agentprime.io/advisories/CVE-2026-109632.md)
  `CVE-2026-109632` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints](https://agentprime.io/advisories/CVE-2026-109630.md)
  `CVE-2026-109630` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint](https://agentprime.io/advisories/CVE-2026-109629.md)
  `CVE-2026-109629` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization](https://agentprime.io/advisories/CVE-2026-109628.md)
  `CVE-2026-109628` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data](https://agentprime.io/advisories/CVE-2026-109627.md)
  `CVE-2026-109627` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data](https://agentprime.io/advisories/CVE-2026-109625.md)
  `CVE-2026-109625` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data](https://agentprime.io/advisories/CVE-2026-109624.md)
  `CVE-2026-109624` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization](https://agentprime.io/advisories/CVE-2026-109623.md)
  `CVE-2026-109623` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization](https://agentprime.io/advisories/CVE-2026-109622.md)
  `CVE-2026-109622` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass](https://agentprime.io/advisories/CVE-2026-109621.md)
  `CVE-2026-109621` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints](https://agentprime.io/advisories/CVE-2026-109617.md)
  `CVE-2026-109617` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification](https://agentprime.io/advisories/CVE-2026-109616.md)
  `CVE-2026-109616` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints](https://agentprime.io/advisories/CVE-2026-109615.md)
  `CVE-2026-109615` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data](https://agentprime.io/advisories/CVE-2026-109614.md)
  `CVE-2026-109614` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification](https://agentprime.io/advisories/CVE-2026-109613.md)
  `CVE-2026-109613` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints](https://agentprime.io/advisories/CVE-2026-109611.md)
  `CVE-2026-109611` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification](https://agentprime.io/advisories/CVE-2026-109610.md)
  `CVE-2026-109610` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe before 16.31.0 Improper Access Control in Document Follow Notifications](https://agentprime.io/advisories/CVE-2026-109600.md)
  `CVE-2026-109600` · CVE record: frappe frappe · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification](https://agentprime.io/advisories/CVE-2026-109599.md)
  `CVE-2026-109599` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe before 16.33.0 Broken Authorization via send_sms Endpoint](https://agentprime.io/advisories/CVE-2026-109598.md)
  `CVE-2026-109598` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy](https://agentprime.io/advisories/CVE-2026-109572.md)
  `CVE-2026-109572` · CVE record: open-webui open-webui · CVSS 7.2 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe before 13.46.3 Improper Access Control for Email Templates](https://agentprime.io/advisories/CVE-2023-54412.md)
  `CVE-2023-54412` · CVE record: frappe frappe · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe before 13.22.0 Improper Authorization via Document Rename](https://agentprime.io/advisories/CVE-2023-54410.md)
  `CVE-2023-54410` · CVE record: frappe frappe · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Nango: Production flow RBAC bypass on private flow-read routes](https://agentprime.io/advisories/CVE-2026-102596.md)
  `CVE-2026-102596` · CVE record: NangoHQ nango · CVSS 4.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution](https://agentprime.io/advisories/CVE-2026-49483.md)
  `CVE-2026-49483` · CVE record: codefori vscode-ibmi · CVSS 8.9 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control, CWE-345
- [IBM Maximo Application Suite - Location Service for Esri Component Improper Access Control](https://agentprime.io/advisories/CVE-2026-18517.md)
  `CVE-2026-18517` · CVE record: IBM Maximo Application Suite - Location Service for Esri Component · CVSS 7.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Shaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routes](https://agentprime.io/advisories/CVE-2026-109568.md)
  `CVE-2026-109568` · CVE record: MarceauKa Shaark · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint](https://agentprime.io/advisories/CVE-2026-109564.md)
  `CVE-2026-109564` · CVE record: learnhouse LearnHouse · CVSS 2.3 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API](https://agentprime.io/advisories/CVE-2026-109562.md)
  `CVE-2026-109562` · CVE record: snapotter-hq SnapOtter · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations](https://agentprime.io/advisories/CVE-2026-109561.md)
  `CVE-2026-109561` · CVE record: aaif-goose goose · CVSS 2.3 Low · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Continue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chaining](https://agentprime.io/advisories/CVE-2026-109560.md)
  `CVE-2026-109560` · CVE record: continuedev continue · CVSS 7.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate](https://agentprime.io/advisories/CVE-2026-109559.md)
  `CVE-2026-109559` · CVE record: tianma-if EdgeEver · CVSS 8.4 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods](https://agentprime.io/advisories/CVE-2026-109377.md)
  `CVE-2026-109377` · CVE record: Frappe ERPNext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html](https://agentprime.io/advisories/CVE-2026-109376.md)
  `CVE-2026-109376` · CVE record: Frappe ERPNext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure](https://agentprime.io/advisories/CVE-2026-108930.md)
  `CVE-2026-108930` · CVE record: Netcore NR268 · CVSS 5.1 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Information disclosure, Broken access control
- [Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs](https://agentprime.io/advisories/CVE-2026-109427.md)
  `CVE-2026-109427` · CVE record: weebzone Telegram-Stremio · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Convex: Unauthorized data access](https://agentprime.io/advisories/CVE-2026-97691.md)
  `CVE-2026-97691` · CVE record: get-convex convex-backend · CVSS 4.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Apache Allura: REST API Mass Assignment](https://agentprime.io/advisories/CVE-2026-92119.md)
  `CVE-2026-92119` · CVE record: Apache Software Foundation Apache Allura · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization](https://agentprime.io/advisories/CVE-2026-108924.md)
  `CVE-2026-108924` · CVE record: getkirby Kirby · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [1024-lab smart-admin Support Config Query queryByKey access control](https://agentprime.io/advisories/CVE-2026-108923.md)
  `CVE-2026-108923` · CVE record: 1024-lab smart-admin · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Privilege escalation, Broken access control
- [KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload](https://agentprime.io/advisories/CVE-2026-108922.md)
  `CVE-2026-108922` · CVE record: KusalkaSilva Learning-Management-System · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem](https://agentprime.io/advisories/CVE-2026-18166.md)
  `CVE-2026-18166` · CVE record: IBM Db2 · CVSS 7.7 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state](https://agentprime.io/advisories/CVE-2026-89140.md)
  `CVE-2026-89140` · CVE record: Temporal Technologies, Inc. Temporal Server · CVSS 6.0 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTEyVDE4OjQ0OjIzLjAzMjAwMFoiLCJDVkUtMjAyNi04OTE0MCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTEyVDIyOjIyOjMxLjU3MzAwMFoiLCJDVkUtMjAyNi0xMDk2NjQiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTEyVDIyOjIyOjMxLjU3MzAwMFoiLCJDVkUtMjAyNi0xMDk2NjQiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.