# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Microsoft Office SharePoint Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-105720.md)
  `CVE-2026-105720` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Microsoft Office SharePoint Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-102865.md)
  `CVE-2026-102865` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Microsoft Office SharePoint Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-102862.md)
  `CVE-2026-102862` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Microsoft Office SharePoint Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-102861.md)
  `CVE-2026-102861` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Microsoft Office SharePoint Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-102860.md)
  `CVE-2026-102860` · CVE record: Microsoft Microsoft SharePoint Server Subscription Edition · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Visual Studio Code Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-70098.md)
  `CVE-2026-70098` · CVE record: Microsoft Visual Studio Code · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Visual Studio Code Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-102233.md)
  `CVE-2026-102233` · CVE record: Microsoft Visual Studio Code · CVSS 7.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Visual Studio Code Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-102232.md)
  `CVE-2026-102232` · CVE record: Microsoft Visual Studio Code · CVSS 7.0 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component](https://agentprime.io/advisories/CVE-2026-110238.md)
  `CVE-2026-110238` · CVE record: zofe rapyd-admin · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint](https://agentprime.io/advisories/CVE-2026-110230.md)
  `CVE-2026-110230` · CVE record: sergix44 XBackBone · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips](https://agentprime.io/advisories/CVE-2026-110229.md)
  `CVE-2026-110229` · CVE record: Webkul QloApps · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation](https://agentprime.io/advisories/CVE-2026-110226.md)
  `CVE-2026-110226` · CVE record: Webkul QloApps · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL](https://agentprime.io/advisories/CVE-2026-110218.md)
  `CVE-2026-110218` · CVE record: Webkul Aureus ERP · CVSS 6.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint](https://agentprime.io/advisories/CVE-2026-110216.md)
  `CVE-2026-110216` · CVE record: youlaitech youlai-boot · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [youlai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege Escalation](https://agentprime.io/advisories/CVE-2026-110215.md)
  `CVE-2026-110215` · CVE record: youlaitech youlai-boot · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints](https://agentprime.io/advisories/CVE-2026-110213.md)
  `CVE-2026-110213` · CVE record: Stonewuu ai-fusion-video · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint](https://agentprime.io/advisories/CVE-2026-110211.md)
  `CVE-2026-110211` · CVE record: iflytek skillhub · CVSS 7.2 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query](https://agentprime.io/advisories/CVE-2026-110210.md)
  `CVE-2026-110210` · CVE record: Phase Phase Console · CVSS 6.0 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials](https://agentprime.io/advisories/CVE-2026-110209.md)
  `CVE-2026-110209` · CVE record: Stonewuu ai-fusion-video · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys](https://agentprime.io/advisories/CVE-2026-110208.md)
  `CVE-2026-110208` · CVE record: WuKongOpenSource Wukong AICRM · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Wukong AICRM through 20260610 Missing Authorization in User and Role Management APIs](https://agentprime.io/advisories/CVE-2026-110207.md)
  `CVE-2026-110207` · CVE record: WuKongOpenSource Wukong AICRM · CVSS 8.7 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Adobe Commerce | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-92910.md)
  `CVE-2026-92910` · CVE record: Adobe Adobe Commerce and 2 more · CVSS 7.2 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Adobe Commerce | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-92908.md)
  `CVE-2026-92908` · CVE record: Adobe Adobe Commerce and 2 more · CVSS 8.3 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Adobe Commerce | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-92909.md)
  `CVE-2026-92909` · CVE record: Adobe Adobe Commerce and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Missing authorization in Fortinet FortiSIEM](https://agentprime.io/advisories/CVE-2026-106176.md)
  `CVE-2026-106176` · CVE record: Fortinet FortiSIEM · CVSS 3.4 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Git Sync connection configuration can be modified with read-only access](https://agentprime.io/advisories/CVE-2026-15577.md)
  `CVE-2026-15577` · CVE record: Grafana Grafana Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs](https://agentprime.io/advisories/CVE-2026-93294.md)
  `CVE-2026-93294` · CVE record: Grafana Grafana Enterprise and 1 more · CVSS 6.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control, CWE-441, CWE-1220
- [ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints](https://agentprime.io/advisories/CVE-2026-110131.md)
  `CVE-2026-110131` · CVE record: LiuYuYang01 ThriveX-Server · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail](https://agentprime.io/advisories/CVE-2026-110129.md)
  `CVE-2026-110129` · CVE record: fushengqian fuintCatering · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints](https://agentprime.io/advisories/CVE-2026-110127.md)
  `CVE-2026-110127` · CVE record: wayn111 waynboot-mall · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoints](https://agentprime.io/advisories/CVE-2026-110126.md)
  `CVE-2026-110126` · CVE record: wayn111 waynboot-mall · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints](https://agentprime.io/advisories/CVE-2026-110125.md)
  `CVE-2026-110125` · CVE record: wayn111 waynboot-mall · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints](https://agentprime.io/advisories/CVE-2026-110124.md)
  `CVE-2026-110124` · CVE record: kerwincui FastBee · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints](https://agentprime.io/advisories/CVE-2026-110123.md)
  `CVE-2026-110123` · CVE record: makunet maku-boot · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint](https://agentprime.io/advisories/CVE-2026-110122.md)
  `CVE-2026-110122` · CVE record: PickMall lilishop · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint](https://agentprime.io/advisories/CVE-2026-110121.md)
  `CVE-2026-110121` · CVE record: PickMall lilishop · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController](https://agentprime.io/advisories/CVE-2026-110120.md)
  `CVE-2026-110120` · CVE record: guchengwuyue yshopmall · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController](https://agentprime.io/advisories/CVE-2026-110119.md)
  `CVE-2026-110119` · CVE record: guchengwuyue yshopmall · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints](https://agentprime.io/advisories/CVE-2026-110118.md)
  `CVE-2026-110118` · CVE record: risesoft-y9 WorkFlow-Engine · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController](https://agentprime.io/advisories/CVE-2026-110117.md)
  `CVE-2026-110117` · CVE record: 1024-lab SmartAdmin · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint](https://agentprime.io/advisories/CVE-2026-110113.md)
  `CVE-2026-110113` · CVE record: Sanluan PublicCMS · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [JetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints](https://agentprime.io/advisories/CVE-2026-110110.md)
  `CVE-2026-110110` · CVE record: jetlinks JetLinks Community · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save](https://agentprime.io/advisories/CVE-2026-110109.md)
  `CVE-2026-110109` · CVE record: jetlinks JetLinks Community · CVSS 7.1 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API](https://agentprime.io/advisories/CVE-2026-110108.md)
  `CVE-2026-110108` · CVE record: mateaix MateCloud · CVSS 8.6 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}](https://agentprime.io/advisories/CVE-2026-110107.md)
  `CVE-2026-110107` · CVE record: dromara RuoYi-Cloud-Plus · CVSS 2.3 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}](https://agentprime.io/advisories/CVE-2026-110106.md)
  `CVE-2026-110106` · CVE record: dromara RuoYi-Vue-Plus · CVSS 2.3 Low · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [B3log Symphony through 3.6.4 Missing Authorization in Admin Console Routes](https://agentprime.io/advisories/CVE-2026-110105.md)
  `CVE-2026-110105` · CVE record: b3log Symphony · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Jorani before 1.0.4 Missing Authorization and SSRF via Contracts::import()](https://agentprime.io/advisories/CVE-2026-110100.md)
  `CVE-2026-110100` · CVE record: Jorani Jorani · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Jorani before 1.0.4 Missing Authorization in HR Export Actions](https://agentprime.io/advisories/CVE-2026-110099.md)
  `CVE-2026-110099` · CVE record: Jorani Jorani · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests](https://agentprime.io/advisories/CVE-2026-110098.md)
  `CVE-2026-110098` · CVE record: Jorani Jorani · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-109898.md)
  `CVE-2026-109898` · CVE record: Arraytics WP Event Solution · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-109896.md)
  `CVE-2026-109896` · CVE record: WP Chill Download Monitor integration for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [WordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-109890.md)
  `CVE-2026-109890` · CVE record: LeapWorx Premium Addons for Elementor · CVSS 5.3 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [Portal for ArcGIS has a security vulnerability](https://agentprime.io/advisories/CVE-2026-69226.md)
  `CVE-2026-69226` · CVE record: Esri Portal for ArcGIS · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization](https://agentprime.io/advisories/CVE-2026-109605.md)
  `CVE-2026-109605` · CVE record: SourceCodester Simple Cafe Billing System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Privilege escalation, Broken access control
- [x86: XPTI may break on huge-memory systems](https://agentprime.io/advisories/CVE-2026-79609.md)
  `CVE-2026-79609` · CVE record: Xen Xen · CVSS 8.8 High · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control
- [slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-110025.md)
  `CVE-2026-110025` · CVE record: slackero phpwcms · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [Plane: Unauthenticated Workspace Invitation Token Leakage](https://agentprime.io/advisories/CVE-2026-102981.md)
  `CVE-2026-102981` · CVE record: makeplane plane · CVSS 6.5 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure, Broken access control
- [HBAI-Ltd Toonflow-app exportData Endpoint information disclosure](https://agentprime.io/advisories/CVE-2026-109526.md)
  `CVE-2026-109526` · CVE record: HBAI-Ltd Toonflow-app · CVSS 4.8 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Information disclosure, Broken access control
- [girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization](https://agentprime.io/advisories/CVE-2026-109525.md)
  `CVE-2026-109525` · CVE record: girishsaraf Online-Appointment-Booking-System · CVSS 6.9 Medium · Not analysed yet · Published 13 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTEzVDE1OjE1OjE3LjMyMTAwMFoiLCJDVkUtMjAyNi0xMDk1MjUiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTEzVDE4OjU5OjMwLjY4NjAwMFoiLCJDVkUtMjAyNi05NzgwMCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTEzVDE4OjU5OjMwLjY4NjAwMFoiLCJDVkUtMjAyNi05NzgwMCJd>. Everything for agents: <https://agentprime.io/llms.txt>.