# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Kameleo Local API profiles information disclosure](https://agentprime.io/advisories/CVE-2026-116283.md)
  `CVE-2026-116283` · CVE record: Kameleo · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure, Broken access control
- [Kameleo Cookie Controller w.cs CookieController.ListCookies information disclosure](https://agentprime.io/advisories/CVE-2026-116282.md)
  `CVE-2026-116282` · CVE record: Kameleo · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure, Broken access control
- [MacCMS v10 through 2026.1000.4056 Comment Impersonation via user_id Mass Assignment](https://agentprime.io/advisories/CVE-2026-116216.md)
  `CVE-2026-116216` · CVE record: maccmspro maccms10 and 1 more · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Kameleo Profile Controller t.cs ListProfiles information disclosure](https://agentprime.io/advisories/CVE-2026-116281.md)
  `CVE-2026-116281` · CVE record: Kameleo · CVSS 4.8 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure, Broken access control
- [A broken access control vulnerability exists in the Mautic Stats API (/api/stats/{table}).](https://agentprime.io/advisories/CVE-2026-115195.md)
  `CVE-2026-115195` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Frappe CRM before 1.89.1 Missing Authorization via Phone Lookup API](https://agentprime.io/advisories/CVE-2026-116492.md)
  `CVE-2026-116492` · CVE record: frappe crm · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [JIZHICMS Front-end Order OrderController.php pay improper authorization](https://agentprime.io/advisories/CVE-2026-116274.md)
  `CVE-2026-116274` · CVE record: JIZHICMS · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Frappe Builder 1.33.0 before 1.36.0 Missing Authorization via improve_prompt](https://agentprime.io/advisories/CVE-2026-115718.md)
  `CVE-2026-115718` · CVE record: frappe builder · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [WordPress Contact Form by Supsystic plugin <= 1.10.7 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-115595.md)
  `CVE-2026-115595` · CVE record: Supsystic Contact Form by Supsystic · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-115959.md)
  `CVE-2026-115959` · CVE record: WPExperts APIExperts Square for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [WordPress APIExperts Square for WooCommerce plugin <= 4.7.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-115960.md)
  `CVE-2026-115960` · CVE record: WPExperts APIExperts Square for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [WordPress Geo Mashup plugin <= 1.13.22 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-115954.md)
  `CVE-2026-115954` · CVE record: Dylan Kuhn Geo Mashup · CVSS 5.4 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [WordPress Better Post & Filter Widgets for Elementor plugin <= 1.9.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-115949.md)
  `CVE-2026-115949` · CVE record: WP Smart Widgets Better Post & Filter Widgets for Elementor · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-115614.md)
  `CVE-2026-115614` · CVE record: Magepeople inc. Booking and Rental Manager · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [WordPress Royal Elementor Addons plugin <= 1.7.1069 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-97255.md)
  `CVE-2026-97255` · CVE record: WProyal Royal Elementor Addons · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [WordPress Bopo – WooCommerce Product Bundle Builder plugin <= 1.2.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110377.md)
  `CVE-2026-110377` · CVE record: VillaTheme Bopo – WooCommerce Product Bundle Builder · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [WordPress WP Discussion Board plugin <= 2.6.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-115958.md)
  `CVE-2026-115958` · CVE record: WP Discussion Board WP Discussion Board · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Oray Pugongying X5 Pro PPPoE WAN Setting upload_files plugin_init unrestricted upload](https://agentprime.io/advisories/CVE-2026-116236.md)
  `CVE-2026-116236` · CVE record: Oray Pugongying X5 Pro · CVSS 8.6 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [WordPress DEPART plugin <= 1.0.10 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110376.md)
  `CVE-2026-110376` · CVE record: VillaTheme DEPART · CVSS 4.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [WordPress AI Engine plugin <= 3.8.6 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-112828.md)
  `CVE-2026-112828` · CVE record: Meow Apps AI Engine · CVSS 4.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [An upsert on the primary key in Ash ignores attribute multitenancy, so one tenant can read, overwrite and take over another tenant's records](https://agentprime.io/advisories/GHSA-vw7c-67pf-gh96.md)
  `GHSA-vw7c-67pf-gh96`, `CVE-2026-96581`, `EEF-CVE-2026-96581` · Hex `ash`: affected `>=1.22.0, <3.37.2`, fixed in `3.37.2` · CVSS 7.6 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Mintpay <= 2.2.3 - Unauthenticated Order Payment Completion and Cancellation via Callback Forgery](https://agentprime.io/advisories/CVE-2026-103381.md)
  `CVE-2026-103381` · CVE record: Unknown Mintpay for WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [CCAvenue Payment Gateway for WooCommerce <= 3.1 - Unauthenticated Order Payment Completion via Webhook Forgery](https://agentprime.io/advisories/CVE-2026-103298.md)
  `CVE-2026-103298` · CVE record: Unknown CCAvenue Payment Gateway for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [NocoDB Sign-in Endpoint AuthService.validateUser information disclosure](https://agentprime.io/advisories/CVE-2026-116122.md)
  `CVE-2026-116122` · CVE record: NocoDB · CVSS 6.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure, Broken access control
- [Incorrect default permissions in Ministry of Land, Infrastructure, Transport and Tourism…](https://agentprime.io/advisories/CVE-2026-113345.md)
  `CVE-2026-113345` · CVE record: Ministry of Land, Infrastructure, Transport and Tourism, Japan Electronic delivery item Inspection Support System · CVSS 8.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [GouGuOA Api.php chunkUpload unrestricted upload](https://agentprime.io/advisories/CVE-2026-116113.md)
  `CVE-2026-116113` · CVE record: GouGuOA · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [openbq-org OpenBB Local API Server api_settings.py access control](https://agentprime.io/advisories/CVE-2026-116108.md)
  `CVE-2026-116108` · CVE record: openbq-org OpenBB · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Datafeedr Product Sets Plugin AJAX Handlers ajax.php dfrps_ajax_delete_saved_search authorization](https://agentprime.io/advisories/CVE-2026-116107.md)
  `CVE-2026-116107` · CVE record: Datafeedr Product Sets Plugin · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [HeyCyan App FileProvider access control](https://agentprime.io/advisories/CVE-2026-116106.md)
  `CVE-2026-116106` · CVE record: HeyCyan App · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Homestay3 homestay-backend 0.0.1-SNAPSHOT contains an IDOR in ChatServiceImpl.](https://agentprime.io/advisories/CVE-2026-106677.md)
  `CVE-2026-106677` · CVE record · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [AshPostgres ignores attribute multitenancy on the join resource when loading many_to_many and through relationships, returning records related through other tenants' rows](https://agentprime.io/advisories/GHSA-gr2r-f49c-9gm2.md)
  `GHSA-gr2r-f49c-9gm2`, `CVE-2026-115627`, `EEF-CVE-2026-115627` · Hex `ash_postgres`: affected `>=0.38.0, <2.15.2`, fixed in `2.15.2` · CVSS 6.0 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [AshPostgres returns another tenant's record for a skipped upsert when return_skipped_upsert? is set](https://agentprime.io/advisories/GHSA-36hg-wwp2-fg8w.md)
  `GHSA-36hg-wwp2-fg8w`, `CVE-2026-115635`, `EEF-CVE-2026-115635` · Hex `ash_postgres`: affected `>=2.6.22, <2.15.2`, fixed in `2.15.2` · CVSS 6.0 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [Loading a through relationship with a limit of 1 in Ash ignores the through path and returns unrelated destination records](https://agentprime.io/advisories/GHSA-g2h4-xp57-q863.md)
  `GHSA-g2h4-xp57-q863`, `CVE-2026-114214`, `EEF-CVE-2026-114214` · Hex `ash`: affected `>=3.24.0, <3.37.1`, fixed in `3.37.1` · CVSS 6.0 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [KodCloud KodExplorer Online Editor Save Endpoint editor.class.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-116057.md)
  `CVE-2026-116057` · CVE record: KodCloud KodExplorer · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [OpenRemote before 1.31.0 Gateway Authorization Bypass via Reversible mapAssetId](https://agentprime.io/advisories/CVE-2026-116186.md)
  `CVE-2026-116186` · CVE record: openremote core · CVSS 2.3 Low · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [OpenRemote before 1.31.0 Cross-Realm Information Disclosure via getGatewayActiveTunnelInfos](https://agentprime.io/advisories/CVE-2026-116185.md)
  `CVE-2026-116185` · CVE record: openremote core · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [OpenRemote before 1.31.0 Cross-Realm Gateway Impersonation via Websocket](https://agentprime.io/advisories/CVE-2026-116184.md)
  `CVE-2026-116184` · CVE record: openremote core · CVSS 2.1 Low · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [YesWiki 4.6.2 before 4.7.0 Missing Authorization in ActivityPub syncActorPosts](https://agentprime.io/advisories/CVE-2026-116208.md)
  `CVE-2026-116208` · CVE record: YesWiki yeswiki · CVSS 7.2 High · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [Snipe-IT before 8.6.3 Authentication Bypass via Google SSO Callback](https://agentprime.io/advisories/CVE-2026-116199.md)
  `CVE-2026-116199` · CVE record: grokability snipe-it · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [Rclone v1.68.0 before v1.75.2 Authorization Bypass in serve s3 Multipart Uploads](https://agentprime.io/advisories/CVE-2026-116187.md)
  `CVE-2026-116187` · CVE record: rclone rclone · CVSS 6.1 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [phpMyFAQ before 4.1.10 Authorization Bypass via /api/faq/create openQuestionID](https://agentprime.io/advisories/CVE-2026-116183.md)
  `CVE-2026-116183` · CVE record: thorsten phpMyFAQ · CVSS 8.7 High · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [Parse Server 9.0.0 before 9.10.4-alpha.4 Unauthenticated Class Schema Deletion on MongoDB](https://agentprime.io/advisories/CVE-2026-116165.md)
  `CVE-2026-116165` · CVE record: parse-community parse-server · CVSS 8.8 High · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [ImageMagick before 6.9.13-58 and 7.x before 7.1.2-33 Policy Bypass via Delegate Invocation Parsing](https://agentprime.io/advisories/CVE-2026-116140.md)
  `CVE-2026-116140` · CVE record: ImageMagick ImageMagick · CVSS 4.8 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [LinkStackOrg LinkStack cross-site request forgery](https://agentprime.io/advisories/CVE-2026-116052.md)
  `CVE-2026-116052` · CVE record: LinkStackOrg LinkStack · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [ProjectSend 2.0.0 through 2.7.1 Incorrect Authorization via File Version Linking](https://agentprime.io/advisories/CVE-2026-116136.md)
  `CVE-2026-116136` · CVE record: projectsend ProjectSend · CVSS 6.0 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [Dokploy through 0.30.10 Cross-Organization Authorization Bypass via Application tRPC Router](https://agentprime.io/advisories/CVE-2026-116068.md)
  `CVE-2026-116068` · CVE record: Dokploy dokploy · CVSS 8.7 High · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [InstaWP Connect < 0.1.4.2 - Authenticated Plugin Settings Update via instawp_update_settings](https://agentprime.io/advisories/CVE-2026-114743.md)
  `CVE-2026-114743` · CVE record: Unknown InstaWP Connect · CVSS 3.1 Low · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [WP VR 8.3.0 - 9.0.2 - Contributor+ Arbitrary Tour Update via IDOR](https://agentprime.io/advisories/CVE-2026-114742.md)
  `CVE-2026-114742` · CVE record: Unknown WPVR · CVSS 2.7 Low · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [WP VR 9.0.0 - 9.0.2 - Contributor+ Arbitrary Tour Update and Disclosure via IDOR](https://agentprime.io/advisories/CVE-2026-114741.md)
  `CVE-2026-114741` · CVE record: Unknown WPVR · CVSS 3.8 Low · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [WP VR 8.5.55 - 9.1.2 - Contributor+ Arbitrary Tour Creation and Publishing via Setup Wizard](https://agentprime.io/advisories/CVE-2026-114740.md)
  `CVE-2026-114740` · CVE record: Unknown WPVR · CVSS 4.9 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [GiveWP < 4.19.0.1 - Authenticated Arbitrary Donor Address Modification via donor_manage_addresses](https://agentprime.io/advisories/CVE-2026-111981.md)
  `CVE-2026-111981` · CVE record: Unknown GiveWP · CVSS 2.7 Low · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [GiveWP < 4.19.0.1 - Give Worker+ Arbitrary Page Modification via Campaign Page Capability Grant](https://agentprime.io/advisories/CVE-2026-111980.md)
  `CVE-2026-111980` · CVE record: Unknown GiveWP · CVSS 5.5 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [Chikkili Google Pay for WooCommerce <= 1.0.6 - Unauthenticated Payment Confirmation Forgery via Unverified Signature](https://agentprime.io/advisories/CVE-2026-94295.md)
  `CVE-2026-94295` · CVE record: Unknown Chikkili- Google Pay India for Woocommerce · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control
- [prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-116044.md)
  `CVE-2026-116044` · CVE record: prasathmani TinyFileManager · CVSS 5.3 Medium · Not analysed yet · Published 25 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [FaveoSuite Faveo Helpdesk UnAuthController.php UnAuthController.resolve authorization](https://agentprime.io/advisories/CVE-2026-115972.md)
  `CVE-2026-115972` · CVE record: FaveoSuite Faveo Helpdesk · CVSS 6.9 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [Forged signed tokens let any registered user take over other users and organizations](https://agentprime.io/advisories/CVE-2026-115933.md)
  `CVE-2026-115933` · CVE record: GitroomHQ postiz-app · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 24 Oct 2026 · Tags: Authentication bypass, Broken access control, CWE-345
- [WordPress UPI QR Code Payment Gateway for WooCommerce plugin <= 1.6.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-114191.md)
  `CVE-2026-114191` · CVE record: Knit Pay UPI QR Code Payment Gateway for WooCommerce · CVSS 7.5 High · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [WordPress WpEvently plugin <= 5.7.8 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-114192.md)
  `CVE-2026-114192` · CVE record: Magepeople inc. WpEvently · CVSS 6.5 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [BookStack before 26.09.2 Incorrect Authorization via AttachmentController on Draft Pages](https://agentprime.io/advisories/CVE-2026-116020.md)
  `CVE-2026-116020` · CVE record: BookStackApp BookStack · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control
- [ONEARMY community-platform before 2.165.2 IDOR via notification read endpoint](https://agentprime.io/advisories/CVE-2026-116018.md)
  `CVE-2026-116018` · CVE record: ONEARMY community-platform · CVSS 5.3 Medium · Not analysed yet · Published 24 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTI0VDExOjQwOjM0Ljk0ODAwMFoiLCJDVkUtMjAyNi0xMTYwMTgiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTI2VDE0OjAwOjIxLjE5MTAwMFoiLCJDVkUtMjAyNi0xMTYyODQiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTI2VDE0OjAwOjIxLjE5MTAwMFoiLCJDVkUtMjAyNi0xMTYyODQiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.