# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Improper access control in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-86990.md)
  `CVE-2026-86990` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 5.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple macOS](https://agentprime.io/advisories/CVE-2026-65392.md)
  `CVE-2026-65392` · CVE record: Apple macOS · CVSS 4.4 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Incorrect permission assignment in Apple macOS](https://agentprime.io/advisories/CVE-2026-113948.md)
  `CVE-2026-113948` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple macOS](https://agentprime.io/advisories/CVE-2026-112569.md)
  `CVE-2026-112569` · CVE record: Apple macOS · CVSS 8.2 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple macOS](https://agentprime.io/advisories/CVE-2026-86939.md)
  `CVE-2026-86939` · CVE record: Apple macOS · CVSS 4.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-113914.md)
  `CVE-2026-113914` · CVE record: Apple iOS and iPadOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Incorrect permission assignment in Apple macOS](https://agentprime.io/advisories/CVE-2026-112539.md)
  `CVE-2026-112539` · CVE record: Apple macOS · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Apple macOS](https://agentprime.io/advisories/CVE-2026-112647.md)
  `CVE-2026-112647` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple macOS](https://agentprime.io/advisories/CVE-2026-112542.md)
  `CVE-2026-112542` · CVE record: Apple macOS · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112692.md)
  `CVE-2026-112692` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112446.md)
  `CVE-2026-112446` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Apple macOS](https://agentprime.io/advisories/CVE-2026-112447.md)
  `CVE-2026-112447` · CVE record: Apple macOS · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112685.md)
  `CVE-2026-112685` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112559.md)
  `CVE-2026-112559` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple macOS](https://agentprime.io/advisories/CVE-2026-112467.md)
  `CVE-2026-112467` · CVE record: Apple macOS · CVSS 3.3 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112624.md)
  `CVE-2026-112624` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 5.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-65397.md)
  `CVE-2026-65397` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-86920.md)
  `CVE-2026-86920` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-65363.md)
  `CVE-2026-65363` · CVE record: Apple iOS and iPadOS and 1 more · CVSS 8.4 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-112701.md)
  `CVE-2026-112701` · CVE record: Apple iOS and iPadOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple macOS](https://agentprime.io/advisories/CVE-2026-112557.md)
  `CVE-2026-112557` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-112609.md)
  `CVE-2026-112609` · CVE record: Apple iOS and iPadOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple macOS](https://agentprime.io/advisories/CVE-2026-112473.md)
  `CVE-2026-112473` · CVE record: Apple macOS · CVSS 7.4 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-84614.md)
  `CVE-2026-84614` · CVE record: Apple iOS and iPadOS · CVSS 4.6 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112706.md)
  `CVE-2026-112706` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple macOS](https://agentprime.io/advisories/CVE-2026-112497.md)
  `CVE-2026-112497` · CVE record: Apple macOS · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-84594.md)
  `CVE-2026-84594` · CVE record: Apple iOS and iPadOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-84605.md)
  `CVE-2026-84605` · CVE record: Apple iOS and iPadOS · CVSS 4.0 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple macOS](https://agentprime.io/advisories/CVE-2026-112675.md)
  `CVE-2026-112675` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112618.md)
  `CVE-2026-112618` · CVE record: Apple iOS and iPadOS and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Apple macOS](https://agentprime.io/advisories/CVE-2026-112462.md)
  `CVE-2026-112462` · CVE record: Apple macOS · CVSS 3.3 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple macOS](https://agentprime.io/advisories/CVE-2026-112570.md)
  `CVE-2026-112570` · CVE record: Apple macOS · CVSS 8.2 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-86880.md)
  `CVE-2026-86880` · CVE record: Apple iOS and iPadOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple macOS](https://agentprime.io/advisories/CVE-2026-86984.md)
  `CVE-2026-86984` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112567.md)
  `CVE-2026-112567` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple macOS](https://agentprime.io/advisories/CVE-2026-112480.md)
  `CVE-2026-112480` · CVE record: Apple macOS · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112455.md)
  `CVE-2026-112455` · CVE record: Apple iOS and iPadOS and 4 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-112681.md)
  `CVE-2026-112681` · CVE record: Apple iOS and iPadOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple macOS](https://agentprime.io/advisories/CVE-2026-112551.md)
  `CVE-2026-112551` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112678.md)
  `CVE-2026-112678` · CVE record: Apple iOS and iPadOS and 3 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple macOS](https://agentprime.io/advisories/CVE-2026-112506.md)
  `CVE-2026-112506` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules](https://agentprime.io/advisories/CVE-2026-110720.md)
  `CVE-2026-110720` · CVE record: HashiCorp Tooling · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Consul vulnerable to an authorization bypass in health check registration](https://agentprime.io/advisories/CVE-2026-115804.md)
  `CVE-2026-115804` · CVE record: HashiCorp Consul and 1 more · CVSS 6.4 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [BUG-000182936 - ArcGIS Server has a security vulnerability.](https://agentprime.io/advisories/CVE-2026-33522.md)
  `CVE-2026-33522` · CVE record: Esri ArcGIS Server · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API](https://agentprime.io/advisories/CVE-2026-105765.md)
  `CVE-2026-105765` · CVE record: HashiCorp Consul and 1 more · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-112839.md)
  `CVE-2026-112839` · CVE record: VillaTheme Customer Coupons for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset](https://agentprime.io/advisories/CVE-2026-102649.md)
  `CVE-2026-102649` · CVE record: padok-team burrito · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Bdtask Garage 24 Garage Management Software Backend improper authorization](https://agentprime.io/advisories/CVE-2026-116384.md)
  `CVE-2026-116384` · CVE record: Bdtask Garage 24 Garage Management Software · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation, Broken access control
- [OctoPrint API Key settings.py getSettings information disclosure](https://agentprime.io/advisories/CVE-2013-10077.md)
  `CVE-2013-10077` · CVE record: OctoPrint · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure, Broken access control
- [WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-115598.md)
  `CVE-2026-115598` · CVE record: ThimPress LearnPress · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-115597.md)
  `CVE-2026-115597` · CVE record: ThimPress LearnPress · CVSS 5.4 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-116388.md)
  `CVE-2026-116388` · CVE record: TMS Amelia · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Team admin can escalate a team member's permissions via the team member roles endpoint](https://agentprime.io/advisories/CVE-2026-93846.md)
  `CVE-2026-93846` · CVE record: Mattermost Mattermost · CVSS 3.8 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [DeepSeek Harness Browser Auth browser-auth.ts improper authorization](https://agentprime.io/advisories/CVE-2026-116368.md)
  `CVE-2026-116368` · CVE record: DeepSeek Harness · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Apache Vysper: Authorization bypass](https://agentprime.io/advisories/CVE-2026-115748.md)
  `CVE-2026-115748` · CVE record: Apache Software Foundation Apache Vysper · CVSS 8.8 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Incorrect Permission Assignment for Critical Resource in boneIO](https://agentprime.io/advisories/CVE-2026-77060.md)
  `CVE-2026-77060` · CVE record: boneIO black_debian_images · CVSS 6.8 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization](https://agentprime.io/advisories/CVE-2026-116340.md)
  `CVE-2026-116340` · CVE record: iFlytek astron-agent · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write](https://agentprime.io/advisories/CVE-2026-93328.md)
  `CVE-2026-93328` · CVE record: Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox) · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 26 Oct 2026 · Tags: Path traversal, Broken access control
- [Improper post type validation on scheduled post endpoints](https://agentprime.io/advisories/CVE-2026-93847.md)
  `CVE-2026-93847` · CVE record: Mattermost Mattermost · CVSS 3.5 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Kameleo Local API user-info information disclosure](https://agentprime.io/advisories/CVE-2026-116284.md)
  `CVE-2026-116284` · CVE record: Kameleo · CVSS 5.3 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure, Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTI2VDE0OjAwOjIxLjE5MTAwMFoiLCJDVkUtMjAyNi0xMTYyODQiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTI2VDIwOjQyOjM0LjM2MTAwMFoiLCJDVkUtMjAyNi04NDU0MiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTI2VDIwOjQyOjM0LjM2MTAwMFoiLCJDVkUtMjAyNi04NDU0MiJd>. Everything for agents: <https://agentprime.io/llms.txt>.