# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [FOG: Authenticated low-privileged API user can modify Storage Nodes and reach root command execution](https://agentprime.io/advisories/CVE-2026-116778.md)
  `CVE-2026-116778` · CVE record: FOGProject fogproject · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Command injection, Broken access control
- [YosemiteCrew: Missing organization authorization on service and PMS library/template routes](https://agentprime.io/advisories/CVE-2026-59979.md)
  `CVE-2026-59979` · CVE record: YosemiteCrew Yosemite-Crew · CVSS 8.3 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Xibo: IDOR (Broken Object-Level Authorization) on GET /layout/status/{id} Allows Arbitrary Layout Metadata Disclosure](https://agentprime.io/advisories/CVE-2026-50542.md)
  `CVE-2026-50542` · CVE record: xibosignage xibo-cms · CVSS 5.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Xibo: Missing Authorization on POST /displaygroup/criteria/{displayGroupId} Allows Arbitrary Scheduling Criteria Injection to Player Devices](https://agentprime.io/advisories/CVE-2026-50543.md)
  `CVE-2026-50543` · CVE record: xibosignage xibo-cms · CVSS 4.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [GFI KerioConnect KOFF < 10.0.9p2 Privilege Escalation](https://agentprime.io/advisories/CVE-2026-112357.md)
  `CVE-2026-112357` · CVE record: GFI USA, LLC GFI KerioConnect · CVSS 8.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Xibo: Missing Object-Level Authorization on /notification/export/{id} Allows Authenticated Users to Download Arbitrary Attachments](https://agentprime.io/advisories/CVE-2026-50539.md)
  `CVE-2026-50539` · CVE record: xibosignage xibo-cms · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export](https://agentprime.io/advisories/CVE-2026-50541.md)
  `CVE-2026-50541` · CVE record: xibosignage xibo-cms · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion](https://agentprime.io/advisories/CVE-2026-52729.md)
  `CVE-2026-52729` · CVE record: xibosignage xibo-cms · CVSS 7.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [NORA missing cross-user token-management authorization](https://agentprime.io/advisories/CVE-2026-59164.md)
  `CVE-2026-59164` · CVE record: getnora-io nora · CVSS 7.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-116393.md)
  `CVE-2026-116393` · CVE record: iHomefinder, Inc. Optima Express · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-116404.md)
  `CVE-2026-116404` · CVE record: David Anderson Redux Framework · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [HCL BigFix AEX is affected by multiple security vulnerabilities.](https://agentprime.io/advisories/CVE-2026-67073.md)
  `CVE-2026-67073` · CVE record: HCL Software BigFix AEX · CVSS 8.6 High · Not analysed yet · Published 28 Oct 2026 · Tags: Cross-site scripting (XSS), Broken access control, Unrestricted file upload, Information disclosure
- [WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-116855.md)
  `CVE-2026-116855` · CVE record: wphocus My auctions allegro · CVSS 5.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Essential Addons for Elementor 6.7.3 - 6.8.6 - Unauthenticated Registration Approval Bypass via OTP Verification](https://agentprime.io/advisories/CVE-2026-110508.md)
  `CVE-2026-110508` · CVE record: Unknown Essential Addons for Elementor · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Missing authorization in Dell PowerProtect Data Domain Management Center](https://agentprime.io/advisories/CVE-2026-110540.md)
  `CVE-2026-110540` · CVE record: Dell PowerProtect Data Domain Management Center · CVSS 7.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Giftcard enumeration](https://agentprime.io/advisories/CVE-2026-101273.md)
  `CVE-2026-101273` · CVE record: pretix · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Missing authorization in Dell PowerProtect Data Domain Management Center](https://agentprime.io/advisories/CVE-2026-103799.md)
  `CVE-2026-103799` · CVE record: Dell PowerProtect Data Domain Management Center · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Insecure direct object reference in Acronis Cyber Protect 17](https://agentprime.io/advisories/CVE-2026-87098.md)
  `CVE-2026-87098` · CVE record: Acronis Acronis Cyber Protect 17 · CVSS 3.1 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Missing authorization in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-86390.md)
  `CVE-2026-86390` · CVE record: Dell PowerProtect Data Domain · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Missing authorization in Dell PowerProtect Data Domain](https://agentprime.io/advisories/CVE-2026-86397.md)
  `CVE-2026-86397` · CVE record: Dell PowerProtect Data Domain · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Enable Media Replace <= 4.2.2 - Missing Authorization to Authenticated (Author+) Post Content Modification via Media Replacement Workflow](https://agentprime.io/advisories/CVE-2026-85655.md)
  `CVE-2026-85655` · CVE record: shortpixel Enable Media Replace · CVSS 4.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Advanced Custom Fields: Extended <= 0.9.2.7 - Missing Authorization to Unauthenticated Data Exposure via Multiple AJAX Endpoints](https://agentprime.io/advisories/CVE-2026-2839.md)
  `CVE-2026-2839` · CVE record: hwk-fr Advanced Custom Fields: Extended · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Travelly <= 2.3.6 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Duplication via 'post' Parameter](https://agentprime.io/advisories/CVE-2026-111213.md)
  `CVE-2026-111213` · CVE record: magepeopleteam Travelly – Tour & Travel Booking Manager for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Clean Login <= 1.20.1 - Missing Authorization to Authenticated (Contributor+) Arbitrary Clean-Login Option Update via 'save_post' Hook](https://agentprime.io/advisories/CVE-2026-116610.md)
  `CVE-2026-116610` · CVE record: hornero Clean Login · CVSS 4.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_view' Parameter](https://agentprime.io/advisories/CVE-2026-109980.md)
  `CVE-2026-109980` · CVE record: barrykooij Related Posts for WordPress · CVSS 4.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Rich Showcase for Google Reviews <= 7.1.6 - Missing Authorization to Authenticated (Contributor+) Site Secret Disclosure via 'grw_auth_code' Site Secret Disclosure via grw-builder Admin Page](https://agentprime.io/advisories/CVE-2026-110020.md)
  `CVE-2026-110020` · CVE record: widgetpack Rich Showcase for Google Reviews · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Related Posts for WordPress <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Sensitive Information Exposure via 'rp4wp_create_link' Parameter](https://agentprime.io/advisories/CVE-2026-109979.md)
  `CVE-2026-109979` · CVE record: barrykooij Related Posts for WordPress · CVSS 4.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [AI ChatBot for WooCommerce <= 5.0.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via qcld_rag_manual_sync AJAX Action](https://agentprime.io/advisories/CVE-2026-111372.md)
  `CVE-2026-111372` · CVE record: quantumcloud AI ChatBot for WooCommerce – WoowBot · CVSS 4.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [PayPal Brasil para WooCommerce <= 1.7.8 - Missing Authorization to Unauthenticated Payment Gateway Modification via 'bcdc_activation_update' Action](https://agentprime.io/advisories/CVE-2026-76058.md)
  `CVE-2026-76058` · CVE record: odefranca PayPal Brasil para WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [WP Roster < 2.35 - Unauthenticated Roster Member Deletion](https://agentprime.io/advisories/CVE-2026-115255.md)
  `CVE-2026-115255` · CVE record: Unknown WP Roster · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [PayPlug for WooCommerce 2.8.0 - 3.1.0 - Unauthenticated Arbitrary Order Deletion, Modification and Disclosure](https://agentprime.io/advisories/CVE-2026-113813.md)
  `CVE-2026-113813` · CVE record: Unknown PayPlug for WooCommerce (Official) · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Royal MCP < 1.5.10 - Contributor+ Private and Draft Content Disclosure and publish_posts Bypass via elementor_clone_page](https://agentprime.io/advisories/CVE-2026-111961.md)
  `CVE-2026-111961` · CVE record: Unknown Royal MCP · CVSS 3.8 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Royal MCP 1.4.38 - 1.5.9 - Subscriber+ Non-Public Post Disclosure via wp_search Ability](https://agentprime.io/advisories/CVE-2026-111960.md)
  `CVE-2026-111960` · CVE record: Unknown Royal MCP · CVSS 4.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Welcart e-Commerce < 2.12.6 - Author+ Arbitrary Product SKU Update and Disclosure via item_sku_ajax](https://agentprime.io/advisories/CVE-2026-111032.md)
  `CVE-2026-111032` · CVE record: Unknown Welcart e-Commerce · CVSS 3.8 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [WPOrLogin < 3.1.0 - Unauthenticated Hide Login Slug Update](https://agentprime.io/advisories/CVE-2026-110691.md)
  `CVE-2026-110691` · CVE record: Unknown WPOrLogin · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Royal Elementor Addons 1.3.71 - 1.7.1069 - Unauthenticated Mailchimp Audience Injection via mailchimp_subscribe](https://agentprime.io/advisories/CVE-2026-107097.md)
  `CVE-2026-107097` · CVE record: Unknown Royal Addons for Elementor · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Royal Elementor Addons 1.3.68 - 1.7.1069 - Author+ Form Submission Interception via Widget ID Collision](https://agentprime.io/advisories/CVE-2026-106647.md)
  `CVE-2026-106647` · CVE record: Unknown Royal Addons for Elementor · CVSS 3.8 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Court Reservation < 1.12.4 - Unauthenticated Reservation Type Addition and Deletion](https://agentprime.io/advisories/CVE-2026-106003.md)
  `CVE-2026-106003` · CVE record: Unknown Court Reservation · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Court Reservation < 1.12.4 - Unauthenticated Arbitrary Challenge Deletion](https://agentprime.io/advisories/CVE-2026-106002.md)
  `CVE-2026-106002` · CVE record: Unknown Court Reservation · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Booking Package < 1.7.33 - Unauthenticated Verification Email Sending to Arbitrary Recipient](https://agentprime.io/advisories/CVE-2026-105997.md)
  `CVE-2026-105997` · CVE record: Unknown Booking Package · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Casso Auto-confirm Bank Transfer < 4.2.0 - Unauthenticated WooCommerce Order Payment Confirmation](https://agentprime.io/advisories/CVE-2026-103382.md)
  `CVE-2026-103382` · CVE record: Unknown Casso Flow · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Animated Text Block <= 1.2.6 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'id' Shortcode Attribute](https://agentprime.io/advisories/CVE-2026-116613.md)
  `CVE-2026-116613` · CVE record: bplugins Animated Text Block – Add Typing and Looping Text Effects · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Missing authorization in GROWI](https://agentprime.io/advisories/CVE-2026-115624.md)
  `CVE-2026-115624` · CVE record: GROWI, Inc. GROWI · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Insecure direct object reference in GROWI](https://agentprime.io/advisories/CVE-2026-109848.md)
  `CVE-2026-109848` · CVE record: GROWI, Inc. GROWI · CVSS 2.3 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Insecure direct object reference in GROWI](https://agentprime.io/advisories/CVE-2026-105272.md)
  `CVE-2026-105272` · CVE record: GROWI, Inc. GROWI · CVSS 2.3 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [NexoPOS through 6.3.0 Missing Authorization via Cash Register Session Actions](https://agentprime.io/advisories/CVE-2026-117606.md)
  `CVE-2026-117606` · CVE record: Blair2004 NexoPOS · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [nopCommerce before 5.00.0 Missing Authorization via Admin ProductController Add Popup Handlers](https://agentprime.io/advisories/CVE-2026-117605.md)
  `CVE-2026-117605` · CVE record: nopSolutions nopCommerce · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-118327.md)
  `CVE-2026-118327` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-118353.md)
  `CVE-2026-118353` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Cronicle: Non-admin uid/gid injection in create_event/update_event → run-as-arbitrary-user (incl. root) — sibling of CVE-2026-39401](https://agentprime.io/advisories/CVE-2026-58255.md)
  `CVE-2026-58255` · CVE record: jhuckaby Cronicle · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2026 · Tags: Privilege escalation, Broken access control
- [Asterisk: ARI REST-over-WebSocket read-only bypass allows arbitrary module path load and conditional RCE](https://agentprime.io/advisories/CVE-2026-57200.md)
  `CVE-2026-57200` · CVE record: asterisk asterisk and 1 more · CVSS 7.5 High · Not analysed yet · Published 27 Oct 2026 · Tags: Path traversal, Broken access control
- [Model Context Protocol Python SDK: Server bearer-token authentication accepts tokens issued for a different resource server](https://agentprime.io/advisories/GHSA-w4fh-qvv9-3v23.md)
  `GHSA-w4fh-qvv9-3v23`, `CVE-2026-116684` · PyPI `mcp`: affected `>=1.10.0, <1.30.0 || >=2.0.0, <2.2.0`, fixed in `1.30.0`, `2.2.0` · CVSS 6.8 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Neko: Authorization bypass in legacy WebRTC input handling](https://agentprime.io/advisories/GHSA-5cp7-fp4j-wwcv.md)
  `GHSA-5cp7-fp4j-wwcv`, `CVE-2026-116679`, `GO-2026-6869` · Go `github.com/m1k1o/neko/server`: affected `>=0.0.0-20250401220545-fe94c999c6af, <0.0.0-20260805142851-395ca1a6f62b`, fixed in `0.0.0-20260805142851-395ca1a6f62b` · CVSS 5.4 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [MembershipWorks WordPress Plugin < 6.17 Information Disclosure via WordPress REST API](https://agentprime.io/advisories/CVE-2026-112355.md)
  `CVE-2026-112355` · CVE record: MembershipWorks MembershipWorks · CVSS 8.7 High · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [MISP Guard Incomplete Tag Validation Allows Non-Allowed Taxonomy Tags to Bypass Feed Policy Enforcement](https://agentprime.io/advisories/CVE-2026-118173.md)
  `CVE-2026-118173` · CVE record: MISP misp-guard · CVSS 6.1 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control, CWE-20
- [CVE-2026-118171](https://agentprime.io/advisories/CVE-2026-118171.md)
  `CVE-2026-118171` · CVE record: Strapi Strapi Open Source and Enterprise Headless CMS · CVSS 6.5 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [CVE-2026-118170](https://agentprime.io/advisories/CVE-2026-118170.md)
  `CVE-2026-118170` · CVE record: Strapi Strapi Open Source and Enterprise Headless CMS · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Tanium addressed an improper access controls vulnerability in Comply.](https://agentprime.io/advisories/CVE-2026-108302.md)
  `CVE-2026-108302` · CVE record: Tanium Comply · CVSS 4.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Tanium addressed an improper access controls vulnerability in Comply.](https://agentprime.io/advisories/CVE-2026-108301.md)
  `CVE-2026-108301` · CVE record: Tanium Comply · CVSS 6.0 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control
- [Tanium addressed an improper access controls vulnerability in Enforce.](https://agentprime.io/advisories/CVE-2026-116660.md)
  `CVE-2026-116660` · CVE record: Tanium Enforce · CVSS 4.3 Medium · Not analysed yet · Published 27 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTI3VDE3OjM1OjA2LjA1MzAwMFoiLCJDVkUtMjAyNi0xMTY2NjAiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTI4VDE2OjM1OjI1LjI5NjAwMFoiLCJDVkUtMjAyNi0xMDM0MDQiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTI4VDE2OjM1OjI1LjI5NjAwMFoiLCJDVkUtMjAyNi0xMDM0MDQiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.