# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint](https://agentprime.io/advisories/CVE-2026-116017.md)
  `CVE-2026-116017` · CVE record: xinnan-tech xiaozhi-esp32-server · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint](https://agentprime.io/advisories/CVE-2026-116015.md)
  `CVE-2026-116015` · CVE record: YunaiV yudao-cloud · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers](https://agentprime.io/advisories/CVE-2026-116010.md)
  `CVE-2026-116010` · CVE record: francoisjacquet RosarioSIS · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign](https://agentprime.io/advisories/CVE-2026-116008.md)
  `CVE-2026-116008` · CVE record: Bottelet DaybydayCRM · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-114705.md)
  `CVE-2026-114705` · CVE record: quadlayers WP Social Feed Gallery · CVSS 6.5 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [IDOR: User reads and modifies findings from other people's projects](https://agentprime.io/advisories/CVE-2026-115998.md)
  `CVE-2026-115998` · CVE record: CervantesSec cervantes · CVSS 4.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [BOLA Allows Cross-Project Target Tampering](https://agentprime.io/advisories/CVE-2026-115994.md)
  `CVE-2026-115994` · CVE record: CervantesSec cervantes · CVSS 5.4 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110892.md)
  `CVE-2026-110892` · CVE record: Brainstorm Force SureDash · CVSS 6.5 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [Broken access control in JiraController](https://agentprime.io/advisories/CVE-2026-115975.md)
  `CVE-2026-115975` · CVE record: CervantesSec cervantes · CVSS 7.1 High · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization](https://agentprime.io/advisories/CVE-2026-115803.md)
  `CVE-2026-115803` · CVE record: Scada-LTS · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification](https://agentprime.io/advisories/CVE-2026-113674.md)
  `CVE-2026-113674` · CVE record: Unknown GeoDirectory · CVSS 3.7 Low · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR](https://agentprime.io/advisories/CVE-2026-113489.md)
  `CVE-2026-113489` · CVE record: Unknown GeoDirectory · CVSS 4.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form](https://agentprime.io/advisories/CVE-2026-97353.md)
  `CVE-2026-97353` · CVE record: Unknown News Kit Addons For Elementor · CVSS 5.4 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer](https://agentprime.io/advisories/CVE-2026-97352.md)
  `CVE-2026-97352` · CVE record: Unknown News Kit Addons For Elementor · CVSS 4.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist](https://agentprime.io/advisories/CVE-2026-107907.md)
  `CVE-2026-107907` · CVE record: Unknown MAS Videos · CVSS 6.5 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment](https://agentprime.io/advisories/CVE-2026-87835.md)
  `CVE-2026-87835` · CVE record: Unknown Front End Users · CVSS 6.5 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme](https://agentprime.io/advisories/CVE-2026-107887.md)
  `CVE-2026-107887` · CVE record: Unknown Advanced Twenty Seventeen · CVSS 5.4 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [virtualenv: Seeded files retain permissions from an older cache](https://agentprime.io/advisories/GHSA-fc2g-4w5p-6whm.md)
  `GHSA-fc2g-4w5p-6whm`, `BIT-virtualenv-2026-113720`, `CVE-2026-113720` · PyPI `virtualenv`: affected `<21.14.9`, fixed in `21.14.9` · CVSS 4.4 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [LangGraph: Namespace labels containing \`.\` reach other namespaces in Postgres and SQLite stores](https://agentprime.io/advisories/GHSA-6hmw-9432-67qq.md)
  `GHSA-6hmw-9432-67qq`, `CVE-2026-115883` · PyPI `langgraph-checkpoint-postgres` and 1 more: affected `<3.1.3`, fixed in `3.1.3` · CVSS 6.0 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control, CWE-20
- [FastMCP: Post-transform component authorization is skipped on direct calls](https://agentprime.io/advisories/GHSA-7xgj-8392-5q4r.md)
  `GHSA-7xgj-8392-5q4r` · PyPI `fastmcp` and 1 more: affected `>=3.0.0, <3.4.10 || >=4.0.0, <4.1.2`, fixed in `3.4.10`, `4.1.2` · CVSS 6.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Incorrect default permissions in Apple Container](https://agentprime.io/advisories/CVE-2026-113951.md)
  `CVE-2026-113951` · CVE record: Apple Container · CVSS 7.8 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Livewire: Authorization bypass in #\[Authorize\] via reordered parameter keys and #\[Json\] execution order](https://agentprime.io/advisories/GHSA-mhf7-xp6r-6qrc.md)
  `GHSA-mhf7-xp6r-6qrc`, `PKSA-xhv3-nr94-h8db` · Packagist `livewire/livewire`: affected `>=4.3.0, <4.4.8`, fixed in `4.4.8` · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls](https://agentprime.io/advisories/GHSA-cxf3-9h37-7rr8.md)
  `GHSA-cxf3-9h37-7rr8`, `CVE-2026-118264`, `GO-2026-6839` · Go `github.com/labstack/echo/v4` and 1 more: affected `>=4.0.0, <4.16.1`, fixed in `4.16.1` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: HTTP request smuggling, Broken access control
- [OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant](https://agentprime.io/advisories/CVE-2026-75525.md)
  `CVE-2026-75525` · CVE record: open-reception appointment-booking-software · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Tenda F6 Web Management cross-site request forgery](https://agentprime.io/advisories/CVE-2026-115796.md)
  `CVE-2026-115796` · CVE record: Tenda F6 · CVSS 5.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes](https://agentprime.io/advisories/GHSA-r3g7-r4hr-m258.md)
  `GHSA-r3g7-r4hr-m258`, `CVE-2026-115478` · npm `obsidian-tc`: affected `>=1.0.1, <1.31.4`, fixed in `1.31.4` · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control, CWE-459
- [SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers](https://agentprime.io/advisories/GHSA-p4qw-vx5p-g984.md)
  `GHSA-p4qw-vx5p-g984`, `CVE-2026-73049`, `GO-2026-6833` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260730150429-5b42614311b0`, fixed in `0.0.0-20260730150429-5b42614311b0` · CVSS 6.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized](https://agentprime.io/advisories/GHSA-xp3q-r38w-vgqm.md)
  `GHSA-xp3q-r38w-vgqm`, `GO-2026-6836` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260729005258-4daee87d4152`, fixed in `0.0.0-20260729005258-4daee87d4152` · CVSS 5.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields](https://agentprime.io/advisories/GHSA-43r2-c7g8-prc8.md)
  `GHSA-43r2-c7g8-prc8`, `CVE-2026-77362` · npm `obsidian-tc`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 4.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Information disclosure, Broken access control
- [Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning](https://agentprime.io/advisories/CVE-2026-112342.md)
  `CVE-2026-112342` · CVE record: Tandoor Recipes Tandoor Recipes · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP](https://agentprime.io/advisories/GHSA-737x-cwfr-5vvc.md)
  `GHSA-737x-cwfr-5vvc`, `CVE-2026-115477` · npm `obsidian-tc`: affected `>=1.13.0, <1.31.4`, fixed in `1.31.4` · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [obsidian-tc tokens can access arbitrary configured vaults](https://agentprime.io/advisories/GHSA-84c9-qqpq-2pq5.md)
  `GHSA-84c9-qqpq-2pq5`, `CVE-2026-77366` · npm `obsidian-tc`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default](https://agentprime.io/advisories/GHSA-cvp8-vvgf-69q4.md)
  `GHSA-cvp8-vvgf-69q4`, `CVE-2026-77364` · npm `obsidian-tc`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Information disclosure, Broken access control
- [obsidian-tc : Symlink read-ACL scope bypass via lexical path checks](https://agentprime.io/advisories/GHSA-c5xx-h28h-f682.md)
  `GHSA-c5xx-h28h-f682`, `CVE-2026-77361` · npm `obsidian-tc`: affected `<1.3.1`, fixed in `1.3.1` · CVSS 4.7 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal, Broken access control
- [Improper access control in node](https://agentprime.io/advisories/CVE-2026-105482.md)
  `CVE-2026-105482` · CVE record: nodejs node · CVSS 7.4 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Improper access control in node](https://agentprime.io/advisories/CVE-2026-106071.md)
  `CVE-2026-106071` · CVE record: nodejs node · CVSS 3.6 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Improper access control in node](https://agentprime.io/advisories/CVE-2026-106073.md)
  `CVE-2026-106073` · CVE record: nodejs node · CVSS 3.3 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation](https://agentprime.io/advisories/CVE-2026-55463.md)
  `CVE-2026-55463` · CVE record: intranda goobi-viewer-core · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, Broken access control, CWE-1385
- [baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure](https://agentprime.io/advisories/CVE-2026-114623.md)
  `CVE-2026-114623` · CVE record: baserproject basercms · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Path traversal, Information disclosure, Broken access control
- [DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization](https://agentprime.io/advisories/CVE-2026-114356.md)
  `CVE-2026-114356` · CVE record: DJI CrystalSky ZS600C · CVSS 7.0 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration](https://agentprime.io/advisories/CVE-2026-93640.md)
  `CVE-2026-93640` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 7.8 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root](https://agentprime.io/advisories/CVE-2026-114354.md)
  `CVE-2026-114354` · CVE record: DJI CrystalSky ZS600C · CVSS 8.6 High · Not analysed yet · Published 23 Oct 2026 · Tags: Command injection, Broken access control
- [Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions](https://agentprime.io/advisories/CVE-2026-50057.md)
  `CVE-2026-50057` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 7.8 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation](https://agentprime.io/advisories/CVE-2026-93639.md)
  `CVE-2026-93639` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 8.7 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records](https://agentprime.io/advisories/CVE-2026-93634.md)
  `CVE-2026-93634` · CVE record: Zimbra Zimbra Collaboration Suite · CVSS 4.3 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id](https://agentprime.io/advisories/CVE-2026-115725.md)
  `CVE-2026-115725` · CVE record: chatwoot chatwoot · CVSS 2.3 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Unauthorized volume access through asset replacement](https://agentprime.io/advisories/GHSA-hvp5-pwxx-2752.md)
  `GHSA-hvp5-pwxx-2752` · Packagist `craftcms/cms`: affected `>=5.10.0, <5.11.2`, fixed in `5.11.2` · No CVSS score · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Unauthenticated GraphQL cross-site disclosure via "localized" field bypasses schema Sites scope](https://agentprime.io/advisories/GHSA-mp59-9rf5-93wr.md)
  `GHSA-mp59-9rf5-93wr` · Packagist `craftcms/cms`: affected `>=5.0.0, <5.11.2`, fixed in `5.11.2` · No CVSS score · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Anonymous GraphQL clients can read out-of-scope section content](https://agentprime.io/advisories/GHSA-xpg7-m6gm-4xfh.md)
  `GHSA-xpg7-m6gm-4xfh` · Packagist `craftcms/cms`: affected `>=5.0.0, <5.11.2`, fixed in `5.11.2` · No CVSS score · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users](https://agentprime.io/advisories/CVE-2026-25716.md)
  `CVE-2026-25716` · CVE record: Hallo Welt! GmbH BlueSpice · CVSS 7.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Local Privilege Escalation in CGM CLININET](https://agentprime.io/advisories/CVE-2025-30054.md)
  `CVE-2025-30054` · CVE record: CGM CGM CLININET · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Insecure File Permissions in CGM CLININET](https://agentprime.io/advisories/CVE-2025-30051.md)
  `CVE-2025-30051` · CVE record: CGM CGM CLININET · CVSS 6.8 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-112359.md)
  `CVE-2026-112359` · CVE record: Amauri.IO WPMobile.App · CVSS 7.5 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-112821.md)
  `CVE-2026-112821` · CVE record: Knit Pay Knit Pay · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-112825.md)
  `CVE-2026-112825` · CVE record: Magepeople inc. Car Rental Manager · CVSS 6.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action](https://agentprime.io/advisories/CVE-2026-94262.md)
  `CVE-2026-94262` · CVE record: Unknown Advanced Custom Fields: Extended and 1 more · CVSS 8.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal](https://agentprime.io/advisories/CVE-2026-113501.md)
  `CVE-2026-113501` · CVE record: Unknown LiteSpeed Cache · CVSS 3.1 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter](https://agentprime.io/advisories/CVE-2026-112230.md)
  `CVE-2026-112230` · CVE record: Unknown Popup Builder · CVSS 3.7 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route](https://agentprime.io/advisories/CVE-2026-112219.md)
  `CVE-2026-112219` · CVE record: Unknown Download Monitor · CVSS 4.9 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option](https://agentprime.io/advisories/CVE-2026-111738.md)
  `CVE-2026-111738` · CVE record: Unknown Speed Optimizer · CVSS 5.5 Medium · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTIzVDA2OjAwOjE4Ljc5ODAwMFoiLCJDVkUtMjAyNi0xMTE3MzgiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTI0VDExOjQwOjM0Ljk0ODAwMFoiLCJDVkUtMjAyNi0xMTYwMTgiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTI0VDExOjQwOjM0Ljk0ODAwMFoiLCJDVkUtMjAyNi0xMTYwMTgiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.