# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [girishsaraf Online-Appointment-Booking-System Admin Display Pages showdoctor.php authorization](https://agentprime.io/advisories/CVE-2026-109524.md)
  `CVE-2026-109524` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Wazuh 3.9.0 before 4.14.8 Arbitrary File Overwrite RCE via process_files_from_worker](https://agentprime.io/advisories/CVE-2026-74040.md)
  `CVE-2026-74040` · CVE record: Wazuh wazuh-manager · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Wazuh 4.3.0 before 4.14.8 Remote Code Execution via SCA Command Policies](https://agentprime.io/advisories/CVE-2026-74036.md)
  `CVE-2026-74036` · CVE record: Wazuh wazuh-agent · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Wazuh 4.6.0 before 4.14.8 Authentication Bypass via Empty Password in update_user](https://agentprime.io/advisories/CVE-2026-74035.md)
  `CVE-2026-74035` · CVE record: Wazuh wazuh-manager · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Wazuh 4.1.0 before 4.14.8 Arbitrary File Read via upgrade_custom Command](https://agentprime.io/advisories/CVE-2026-74034.md)
  `CVE-2026-74034` · CVE record: Wazuh wazuh-manager · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Wazuh 4.0.0 before 4.14.8 RBAC Authorization Bypass via /security/actions](https://agentprime.io/advisories/CVE-2026-74032.md)
  `CVE-2026-74032` · CVE record: Wazuh wazuh-manager · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Froxlor before 2.3.14 IDOR in Email Template Editor via admin_templates.php](https://agentprime.io/advisories/CVE-2026-109963.md)
  `CVE-2026-109963` · CVE record: froxlor froxlor · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Froxlor 0.10.0 before 2.3.14 Missing Authorization in MysqlServer and Cronjobs API](https://agentprime.io/advisories/CVE-2026-109962.md)
  `CVE-2026-109962` · CVE record: froxlor froxlor · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [EspoCRM before 10.0.7 IDOR via Import attachmentId Parameter](https://agentprime.io/advisories/CVE-2026-109957.md)
  `CVE-2026-109957` · CVE record: espocrm espocrm · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Missing authorization in NVIDIA AIStore framework](https://agentprime.io/advisories/CVE-2026-65172.md)
  `CVE-2026-65172` · CVE record: NVIDIA AIStore framework · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Mitigation bypass in the Enterprise Policies component](https://agentprime.io/advisories/CVE-2026-109764.md)
  `CVE-2026-109764` · CVE record: Mozilla Firefox and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Site isolation issue in the DOM: Web Authentication component](https://agentprime.io/advisories/CVE-2026-109750.md)
  `CVE-2026-109750` · CVE record: Mozilla Firefox and 1 more · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Exposure of Role List to Low-Privileged Remote Users in Bender Custom&Partner Service](https://agentprime.io/advisories/CVE-2026-94410.md)
  `CVE-2026-94410` · CVE record: Bender Customer&Partner · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Insecure direct object reference in Siemens RUGGEDCOM CROSSBOW](https://agentprime.io/advisories/CVE-2026-89204.md)
  `CVE-2026-89204` · CVE record: Siemens RUGGEDCOM CROSSBOW · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Insecure direct object reference in Siemens RUGGEDCOM CROSSBOW](https://agentprime.io/advisories/CVE-2026-89202.md)
  `CVE-2026-89202` · CVE record: Siemens RUGGEDCOM CROSSBOW · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Insecure direct object reference in Siemens RUGGEDCOM CROSSBOW](https://agentprime.io/advisories/CVE-2026-89199.md)
  `CVE-2026-89199` · CVE record: Siemens RUGGEDCOM CROSSBOW · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-109699.md)
  `CVE-2026-109699` · CVE record: ThemeGrill User Registration · CVSS 5.4 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WordPress User Registration plugin <= 5.2.8 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-106598.md)
  `CVE-2026-106598` · CVE record: ThemeGrill User Registration · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [AdithyaYelloju Restaurant-Management-System Order Management mysqli_query authorization](https://agentprime.io/advisories/CVE-2026-109116.md)
  `CVE-2026-109116` · CVE record: AdithyaYelloju Restaurant-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WordPress FOX plugin <= 1.5.4 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-108174.md)
  `CVE-2026-108174` · CVE record: PluginUs.Net FOX · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WordPress User Registration plugin <= 5.2.8 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-106597.md)
  `CVE-2026-106597` · CVE record: ThemeGrill User Registration · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect permission assignment in Hammock Corporation AssetView and others](https://agentprime.io/advisories/CVE-2026-101020.md)
  `CVE-2026-101020` · CVE record: Hammock Corporation AssetView and 2 more · CVSS 8.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WordPress FluentBoards plugin <= 2.1.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-109696.md)
  `CVE-2026-109696` · CVE record: WP ManageNinja LLC FluentBoards · CVSS 5.4 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-109684.md)
  `CVE-2026-109684` · CVE record: TMS Amelia · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WordPress WP User Manager plugin <= 2.9.24 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-108496.md)
  `CVE-2026-108496` · CVE record: WP User Manager WP User Manager · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WordPress Pay for Payment for WooCommerce plugin <= 3.0.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-108493.md)
  `CVE-2026-108493` · CVE record: Karolína Vyskočilová Pay for Payment for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WordPress Quick Paypal Payments plugin <= 6.0.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-108492.md)
  `CVE-2026-108492` · CVE record: Fullworks Plugins Quick Paypal Payments · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WordPress WPGraphQL plugin <= 2.23.1 - Sensitive Data Exposure vulnerability](https://agentprime.io/advisories/CVE-2026-109703.md)
  `CVE-2026-109703` · CVE record: WPGraphQL WPGraphQL · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [SourceCodester Library Management System add_admin.php move_uploaded_file unrestricted upload](https://agentprime.io/advisories/CVE-2026-108975.md)
  `CVE-2026-108975` · CVE record: SourceCodester Library Management System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [SourceCodester E-Learning System Users.php save_users unrestricted upload](https://agentprime.io/advisories/CVE-2026-108974.md)
  `CVE-2026-108974` · CVE record: SourceCodester E-Learning System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [SourceCodester Contact Tracing System Users.php move_uploaded_file unrestricted upload](https://agentprime.io/advisories/CVE-2026-108973.md)
  `CVE-2026-108973` · CVE record: SourceCodester Contact Tracing System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [code-projects Online Reviewer System User Profile Update btn_functions.php dynamically-determined object attributes](https://agentprime.io/advisories/CVE-2026-108948.md)
  `CVE-2026-108948` · CVE record: code-projects Online Reviewer System · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control, CWE-913
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-5954.md)
  `CVE-2026-5954` · CVE record: GitLab GitLab · CVSS 4.2 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-6567.md)
  `CVE-2026-6567` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-9268.md)
  `CVE-2026-9268` · CVE record: GitLab GitLab · CVSS 2.7 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-14552.md)
  `CVE-2026-14552` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-16275.md)
  `CVE-2026-16275` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-16301.md)
  `CVE-2026-16301` · CVE record: GitLab GitLab · CVSS 8.5 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-78335.md)
  `CVE-2026-78335` · CVE record: GitLab GitLab · CVSS 4.2 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-81839.md)
  `CVE-2026-81839` · CVE record: GitLab GitLab · CVSS 7.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-82632.md)
  `CVE-2026-82632` · CVE record: GitLab GitLab · CVSS 3.1 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-84284.md)
  `CVE-2026-84284` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-85529.md)
  `CVE-2026-85529` · CVE record: GitLab GitLab · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-92528.md)
  `CVE-2026-92528` · CVE record: GitLab GitLab · CVSS 4.2 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-103549.md)
  `CVE-2026-103549` · CVE record: GitLab GitLab · CVSS 2.7 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Missing Authorization Check in SAP Global Trade Services, edition for SAP HANA (Display Product Catalog Based on Customs Declaration)](https://agentprime.io/advisories/CVE-2026-89124.md)
  `CVE-2026-89124` · CVE record: SAP_SE SAP HANA (Display Product Catalog Based on Customs Declaration) · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Missing Authorization Check in SAP S/4HANA (Linear Asset Management RAP Business Object)](https://agentprime.io/advisories/CVE-2026-89121.md)
  `CVE-2026-89121` · CVE record: SAP_SE SAP S/4HANA (Linear Asset Management RAP Business Object) · CVSS 4.7 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Broken Access Control in CLA-Assistant � CLA Signature PII Disclosure](https://agentprime.io/advisories/CVE-2026-89112.md)
  `CVE-2026-89112` · CVE record: SAP_SE CLA-Assistant · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Missing Authorization check in SAP Manufacturing Integration and Intelligence (Configuration Service)](https://agentprime.io/advisories/CVE-2026-89108.md)
  `CVE-2026-89108` · CVE record: SAP_SE SAP Manufacturing Integration and Intelligence (Configuration Service) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an Insecure Direct Object Reference (IDOR) via the usrLogin$hdnPFID parameter.](https://agentprime.io/advisories/CVE-2024-34323.md)
  `CVE-2024-34323` · CVE record · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ProPhoenix Law RMS v2022.2403.3.101 was discovered to contain an incorrect access control issue in sensitive API endpoints.](https://agentprime.io/advisories/CVE-2024-34320.md)
  `CVE-2024-34320` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [code-projects Matrimonial System matrimony.sql file access](https://agentprime.io/advisories/CVE-2026-108938.md)
  `CVE-2026-108938` · CVE record: code-projects Matrimonial System · CVSS 6.9 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control, Information disclosure
- [IBM Planning Analytics Local is affected by security vulnerabilities](https://agentprime.io/advisories/CVE-2026-17475.md)
  `CVE-2026-17475` · CVE record: IBM Planning Analytics · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe Suite before commit 2697564 Broken Access Control in Mail Mailbox and Quota APIs](https://agentprime.io/advisories/CVE-2026-109675.md)
  `CVE-2026-109675` · CVE record: frappe suite · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.118.0 Missing Authorization Exposes Financial Data](https://agentprime.io/advisories/CVE-2026-109672.md)
  `CVE-2026-109672` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.110.0 Missing Authorization Allows Unauthorized Status Modification](https://agentprime.io/advisories/CVE-2026-109669.md)
  `CVE-2026-109669` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.110.0 Missing Authorization in Party Record Endpoints](https://agentprime.io/advisories/CVE-2026-109668.md)
  `CVE-2026-109668` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.110.0 Missing Authorization in Inventory Record Endpoints](https://agentprime.io/advisories/CVE-2026-109666.md)
  `CVE-2026-109666` · CVE record: frappe erpnext · CVSS 7.1 High · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.108.0 Missing Authorization Allows Master Record Deactivation](https://agentprime.io/advisories/CVE-2026-109665.md)
  `CVE-2026-109665` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control
- [Frappe ERPNext before 15.112.0 Missing Authorization Allows Arbitrary Record Modification](https://agentprime.io/advisories/CVE-2026-109664.md)
  `CVE-2026-109664` · CVE record: frappe erpnext · CVSS 5.3 Medium · Not analysed yet · Published 12 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTEyVDIyOjIyOjMxLjU3MzAwMFoiLCJDVkUtMjAyNi0xMDk2NjQiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTEzVDE1OjE1OjE3LjMyMTAwMFoiLCJDVkUtMjAyNi0xMDk1MjUiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTEzVDE1OjE1OjE3LjMyMTAwMFoiLCJDVkUtMjAyNi0xMDk1MjUiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.