# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [CVE-2026-118131](https://agentprime.io/advisories/CVE-2026-118131.md)
  `CVE-2026-118131` · CVE record: GnuPG GnuPG · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control, CWE-379, CWE-427
- [CVE-2026-16491 CVE Record](https://agentprime.io/advisories/CVE-2026-16491.md)
  `CVE-2026-16491` · CVE record: Grafana Grafana Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)](https://agentprime.io/advisories/CVE-2026-105780.md)
  `CVE-2026-105780` · CVE record: Adobe Adobe Campaign Classic · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [oretnom23 php-travel-agency-system employee_insert.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-117512.md)
  `CVE-2026-117512` · CVE record: oretnom23 php-travel-agency-system · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [Incorrect authorization in Veeam Backup for Microsoft 365](https://agentprime.io/advisories/CVE-2026-106077.md)
  `CVE-2026-106077` · CVE record: Veeam Backup for Microsoft 365 · CVSS 8.3 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Improper access control in Nextcloud Server](https://agentprime.io/advisories/CVE-2026-82984.md)
  `CVE-2026-82984` · CVE record: Nextcloud Server · CVSS 4.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Improper access control in Nextcloud Files Confidential](https://agentprime.io/advisories/CVE-2026-77173.md)
  `CVE-2026-77173` · CVE record: Nextcloud Files Confidential · CVSS 4.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Improper access control in Nextcloud Richdocuments](https://agentprime.io/advisories/CVE-2026-67400.md)
  `CVE-2026-67400` · CVE record: Nextcloud Richdocuments · CVSS 3.5 Low · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Improper access control in Nextcloud Collectives](https://agentprime.io/advisories/CVE-2026-77171.md)
  `CVE-2026-77171` · CVE record: Nextcloud Collectives · CVSS 3.5 Low · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Improper access control in Nextcloud Tables](https://agentprime.io/advisories/CVE-2026-82986.md)
  `CVE-2026-82986` · CVE record: Nextcloud Tables · CVSS 4.6 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation](https://agentprime.io/advisories/CVE-2026-90465.md)
  `CVE-2026-90465` · CVE record: WatchGuard Fireware OS · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Command injection, Authentication bypass, Broken access control
- [Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root](https://agentprime.io/advisories/CVE-2026-90464.md)
  `CVE-2026-90464` · CVE record: WatchGuard Fireware OS · CVSS 7.2 High · Not analysed yet · Published 27 Oct 2026 · Tags: Path traversal, Broken access control
- [Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection](https://agentprime.io/advisories/CVE-2026-93865.md)
  `CVE-2026-93865` · CVE record: WatchGuard Fireware OS · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Command injection, Authentication bypass, Broken access control
- [Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens](https://agentprime.io/advisories/GHSA-q686-2qmg-hqc7.md)
  `GHSA-q686-2qmg-hqc7`, `CVE-2026-114619`, `PYSEC-2026-4359` · PyPI `authlib`: affected `<1.9.0`, fixed in `1.9.0` · CVSS 4.6 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading](https://agentprime.io/advisories/GHSA-2phh-27fw-q4gc.md)
  `GHSA-2phh-27fw-q4gc`, `CVE-2026-108360`, `PKSA-r15m-kszr-8n8q` · Packagist `phpoffice/phpspreadsheet`: affected `<1.30.7 || >=2.0.0, <2.1.19 || >=2.2.0, <2.4.8 || >=3.3.0, <3.10.8 || >=4.0.0, <5.10.0`, fixed in `1.30.7`, `2.1.19`, `2.4.8`, `3.10.8`, `5.10.0` · CVSS 6.4 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control, Server-side request forgery (SSRF)
- [Strands Agents: Default FileSessionManager storage is world-readable on shared systems](https://agentprime.io/advisories/GHSA-763v-5pjm-fx36.md)
  `GHSA-763v-5pjm-fx36` · PyPI `strands-agents`: affected `<1.48.0`, fixed in `1.48.0` · CVSS 4.0, no score published · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share](https://agentprime.io/advisories/CVE-2026-104189.md)
  `CVE-2026-104189` · CVE record: maz1987in 3Dviewer-Nextcloud · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows](https://agentprime.io/advisories/CVE-2026-92377.md)
  `CVE-2026-92377` · CVE record: TeamViewer Full Client and 1 more · CVSS 7.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring](https://agentprime.io/advisories/CVE-2026-92375.md)
  `CVE-2026-92375` · CVE record: TeamViewer Full Client and 2 more · CVSS 7.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Ghost: Authorization Bypass in Comment Like Feature](https://agentprime.io/advisories/GHSA-qrh6-cwg3-343x.md)
  `GHSA-qrh6-cwg3-343x`, `BIT-ghost-2026-103288`, `CVE-2026-103288` · npm `ghost`: affected `>=5.9.0, <6.44.1`, fixed in `6.44.1` · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control, Other injection
- [SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files](https://agentprime.io/advisories/GHSA-c8r8-95hg-mp34.md)
  `GHSA-c8r8-95hg-mp34`, `CVE-2026-60083`, `GO-2026-6863` · Go `github.com/siyuan-note/siyuan/kernel`: affected `<0.0.0-20260808051406-3542530c505f`, fixed in `0.0.0-20260808051406-3542530c505f` · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Privilege escalation in the DOM: UI Events & Focus Handling component](https://agentprime.io/advisories/CVE-2026-117995.md)
  `CVE-2026-117995` · CVE record: Mozilla Firefox and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Site isolation issue in the DOM: Service Workers component](https://agentprime.io/advisories/CVE-2026-117959.md)
  `CVE-2026-117959` · CVE record: Mozilla Firefox and 1 more · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Ajenti has potential Remote Code Execution](https://agentprime.io/advisories/GHSA-vcw3-r3fx-j444.md)
  `GHSA-vcw3-r3fx-j444`, `CVE-2026-27975` · PyPI `aj`: affected `<2.2.13`, fixed in `2.2.13` · CVSS 8.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [IDOR in Netiket Information Technologies' EdoWEB](https://agentprime.io/advisories/CVE-2026-16307.md)
  `CVE-2026-16307` · CVE record: Netiket Information Technologies EdoWEB · CVSS 4.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [MrDoc through 1.1.1 Broken Access Control via manage_doc_share](https://agentprime.io/advisories/CVE-2026-117563.md)
  `CVE-2026-117563` · CVE record: zmister2016 MrDoc · CVSS 5.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint](https://agentprime.io/advisories/CVE-2026-117562.md)
  `CVE-2026-117562` · CVE record: anyant rssant · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field](https://agentprime.io/advisories/CVE-2026-10752.md)
  `CVE-2026-10752` · CVE record: hwk-fr Advanced Custom Fields: Extended · CVSS 4.8 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Improper access control in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-90730.md)
  `CVE-2026-90730` · CVE record: Dell PowerProtect Data Domain · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [REDAXO before 5.21.4 Broken Access Control in Slice Operations](https://agentprime.io/advisories/CVE-2026-116899.md)
  `CVE-2026-116899` · CVE record: redaxo core · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move](https://agentprime.io/advisories/CVE-2026-116898.md)
  `CVE-2026-116898` · CVE record: redaxo core · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [REDAXO before 5.21.4 Missing Authorization in Version and History Previews](https://agentprime.io/advisories/CVE-2026-116897.md)
  `CVE-2026-116897` · CVE record: redaxo core · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables](https://agentprime.io/advisories/CVE-2026-116896.md)
  `CVE-2026-116896` · CVE record: redaxo core · CVSS 7.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [REDAXO core before 5.21.5 Missing Authorization in rex_api_package API](https://agentprime.io/advisories/CVE-2026-116893.md)
  `CVE-2026-116893` · CVE record: redaxo core · CVSS 6.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Semantic MediaWiki 7.3.0 before 7.3.1 Missing Authorization via smwtask Update Task](https://agentprime.io/advisories/CVE-2026-116879.md)
  `CVE-2026-116879` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected](https://agentprime.io/advisories/CVE-2026-116876.md)
  `CVE-2026-116876` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 7.1 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Semantic MediaWiki 7.3.0 Missing Authorization via smwtask API run-joblist and update](https://agentprime.io/advisories/CVE-2026-116873.md)
  `CVE-2026-116873` · CVE record: SemanticMediaWiki SemanticMediaWiki · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2](https://agentprime.io/advisories/CVE-2026-102789.md)
  `CVE-2026-102789` · CVE record: balbooa.com Gridbox extension for Joomla · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration](https://agentprime.io/advisories/CVE-2026-85299.md)
  `CVE-2026-85299` · CVE record: Google Cloud Compute Engine · CVSS 8.3 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [URL prefix handling permits API key read-scope bypass in Psono Server](https://agentprime.io/advisories/CVE-2026-117472.md)
  `CVE-2026-117472` · CVE record: esaqa GmbH Psono · CVSS 4.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [File-transfer type confusion permits unauthorized repository writes in Psono Server](https://agentprime.io/advisories/CVE-2026-117469.md)
  `CVE-2026-117469` · CVE record: esaqa GmbH Psono · CVSS 5.4 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [code-projects Simple Content Management System Admin welcome.php authorization](https://agentprime.io/advisories/CVE-2026-116623.md)
  `CVE-2026-116623` · CVE record: code-projects Simple Content Management System · CVSS 6.9 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [SourceCodester Online Food Ordering System add_food.php unrestricted upload](https://agentprime.io/advisories/CVE-2026-116603.md)
  `CVE-2026-116603` · CVE record: SourceCodester Online Food Ordering System · CVSS 5.1 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences](https://agentprime.io/advisories/CVE-2026-116810.md)
  `CVE-2026-116810` · CVE record: Openpanel-dev openpanel · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure](https://agentprime.io/advisories/CVE-2026-116809.md)
  `CVE-2026-116809` · CVE record: Openpanel-dev openpanel · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation](https://agentprime.io/advisories/CVE-2026-2270.md)
  `CVE-2026-2270` · CVE record: Kubernetes Kubernetes · CVSS 5.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview](https://agentprime.io/advisories/CVE-2026-116746.md)
  `CVE-2026-116746` · CVE record: qloapps qloapps · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation](https://agentprime.io/advisories/CVE-2026-116745.md)
  `CVE-2026-116745` · CVE record: qloapps qloapps · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [TOTOLINK A950RG global.so getLanguageCfg information disclosure](https://agentprime.io/advisories/CVE-2026-116507.md)
  `CVE-2026-116507` · CVE record: TOTOLINK A950RG · CVSS 6.9 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Information disclosure, Broken access control
- [Missing authorization in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-86925.md)
  `CVE-2026-86925` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112616.md)
  `CVE-2026-112616` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-86968.md)
  `CVE-2026-86968` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple macOS](https://agentprime.io/advisories/CVE-2026-112533.md)
  `CVE-2026-112533` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple iOS and iPadOS](https://agentprime.io/advisories/CVE-2026-86987.md)
  `CVE-2026-86987` · CVE record: Apple iOS and iPadOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple macOS](https://agentprime.io/advisories/CVE-2026-43736.md)
  `CVE-2026-43736` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple macOS](https://agentprime.io/advisories/CVE-2026-112677.md)
  `CVE-2026-112677` · CVE record: Apple macOS · CVSS 7.8 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Missing authorization in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112676.md)
  `CVE-2026-112676` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 7.5 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Apple iOS and iPadOS and others](https://agentprime.io/advisories/CVE-2026-112660.md)
  `CVE-2026-112660` · CVE record: Apple iOS and iPadOS and 2 more · CVSS 3.3 Low · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Incorrect permission assignment in Apple macOS](https://agentprime.io/advisories/CVE-2026-86945.md)
  `CVE-2026-86945` · CVE record: Apple macOS · CVSS 7.1 High · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control
- [Improper access control in Apple macOS](https://agentprime.io/advisories/CVE-2026-84542.md)
  `CVE-2026-84542` · CVE record: Apple macOS · CVSS 5.5 Medium · Not analysed yet · Published 26 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTI2VDIwOjQyOjM0LjM2MTAwMFoiLCJDVkUtMjAyNi04NDU0MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTI3VDE3OjM1OjA2LjA1MzAwMFoiLCJDVkUtMjAyNi0xMTY2NjAiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTI3VDE3OjM1OjA2LjA1MzAwMFoiLCJDVkUtMjAyNi0xMTY2NjAiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.