# Broken access control. Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [Missing authorization in Octopus Deploy Octopus Server](https://agentprime.io/advisories/CVE-2026-118426.md) `CVE-2026-118426` · CVE record: Octopus Deploy Octopus Server · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Unauthenticated IDOR Enables Disclosure of Other Users’ last-known details](https://agentprime.io/advisories/CVE-2026-66091.md) `CVE-2026-66091` · CVE record: Apereo Foundation openEQUELLA · CVSS 6.9 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in get_agent_execution_configuration in superagi/controllers/agent_execution_config.py.](https://agentprime.io/advisories/CVE-2026-51905.md) `CVE-2026-51905` · CVE record · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [SuperAGI v0.0.14 contains an improper access control vulnerability in get_agent_by_latest_execution in superagi/controllers/agent_execution.py.](https://agentprime.io/advisories/CVE-2026-51903.md) `CVE-2026-51903` · CVE record · CVSS 8.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [SuperAGI up to v0.0.14 contains an improper access control vulnerability.](https://agentprime.io/advisories/CVE-2026-51902.md) `CVE-2026-51902` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in Tailscale versionCode 297862600 allows unauthorized attackers to make arbitrary changes to another user's VPN configurations and preferences.](https://agentprime.io/advisories/CVE-2026-107060.md) `CVE-2026-107060` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in the io.file.importer.ImportActivity component of OpenTracks versionCode 6751 allows unauthorized attackers to inject crafted tracking data into the victim's location database…](https://agentprime.io/advisories/CVE-2026-107056.md) `CVE-2026-107056` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in the autosave component of AppML neutriNote CE versionCode 1387 allows unauthorized attackers to write arbitrary files.](https://agentprime.io/advisories/CVE-2026-107055.md) `CVE-2026-107055` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in the AIDL interface of ProjectMAXS MAXS Module FileRead versionCode 27 allows unauthorized attackers to arbitrarily reead files outside of the sandbox via providing an absolute…](https://agentprime.io/advisories/CVE-2026-107052.md) `CVE-2026-107052` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [An issue in Forkyz versionCode 8500000 allows attackers to arbitrarily change another user's storage settings via supplying a crafted URI string.](https://agentprime.io/advisories/CVE-2026-107049.md) `CVE-2026-107049` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in mendhak GPSLogger versionCode 137 allows unauthorized attackers to arbitrarily manipulate the app's logging mechanism and log data.](https://agentprime.io/advisories/CVE-2026-107047.md) `CVE-2026-107047` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in the CitrineContentProvider component of Citrine v3.1.0 (versionCode 62) allows unauthorized attackers to arbitrarily read another's Nostr event database.](https://agentprime.io/advisories/CVE-2026-107045.md) `CVE-2026-107045` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in ProjectMAXS MAXS Main v0.5.19 (versionCode 19) allows unauthorized attackers to arbitrarily manipulate the app's MAXS command/transport mechanism.](https://agentprime.io/advisories/CVE-2026-107044.md) `CVE-2026-107044` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in USP Ultimate Screenshot Painter versionCode 240213.009 allows unauthorized attackers to move or overwrite files in another user's private storage via supplying a crafted conte…](https://agentprime.io/advisories/CVE-2026-107042.md) `CVE-2026-107042` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in the ActivityMain component of M66B/Marcel Bokhorst NetGuard no-root firewall versionCode 2026080101/versionName 2.337 allows unauthorized attackers to arbitrarily force a devi…](https://agentprime.io/advisories/CVE-2026-107039.md) `CVE-2026-107039` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in the NotificationHelper component of NoNonsense Notes versionCode 72600 allows unauthorized attackers to write in another user's notes via supplying a note id.](https://agentprime.io/advisories/CVE-2026-107037.md) `CVE-2026-107037` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in the object/Page.java component of MBasov OMN Outline notes Markdown versionCode 3400 allows unauthorized attackers to arbitrarily write content into another user's private sto…](https://agentprime.io/advisories/CVE-2026-107035.md) `CVE-2026-107035` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in LeafPad / Leaf Note v1.21 (versionCode 21) allows unauthorized attackers to arbitrarily read another user's note data.](https://agentprime.io/advisories/CVE-2026-107034.md) `CVE-2026-107034` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in rubenalfon Pile v1.1.3 allows unauthorized attackers to invoke an exported component, leading to arbitrary data access and overwriting.](https://agentprime.io/advisories/CVE-2026-107029.md) `CVE-2026-107029` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in wbpxre150 Shopping List v11.0 (versionCode 11) allows unauthorized attackers to invoke an exported component, leading to manipulation of the shopping-list data.](https://agentprime.io/advisories/CVE-2026-107028.md) `CVE-2026-107028` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in Share to Clipboard v1.14.1 (versionCode 32) allows unauthorized attackers to arbitrarily overwrite another user's clipboard content.](https://agentprime.io/advisories/CVE-2026-107026.md) `CVE-2026-107026` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in Share 2 Archive Today versionCode 61 allows unauthorized attackers to arbitrarily overwrite another user's clipboard content via supplying a crafted URL.](https://agentprime.io/advisories/CVE-2026-107024.md) `CVE-2026-107024` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in the ContentProvider component of mhss1 MyBrain v3.1.0 allows unauthorized attackers to arbitrarily read another user's private notes/tasks/diary content.](https://agentprime.io/advisories/CVE-2026-107023.md) `CVE-2026-107023` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in Ghost Commander File Manager versionCode 479 allows unauthorized attackers to arbitrarily read and write files inside the commander's private storage.](https://agentprime.io/advisories/CVE-2026-107018.md) `CVE-2026-107018` · CVE record · CVSS 8.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in the ShortcutDispatchActivity component of canvoki versionCode 14 allows unauthorized attackers to arbitrarily trigger another user's configured automated actions.](https://agentprime.io/advisories/CVE-2026-107017.md) `CVE-2026-107017` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in Fossify v1.3.0 allows unauthorized attackers to access and read another user's stored contacts.](https://agentprime.io/advisories/CVE-2026-107016.md) `CVE-2026-107016` · CVE record · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [Insecure permissions in Simple Contacts Pro versionCode 107 allow unauthorized attackers to write and read notes in another user's' note database.](https://agentprime.io/advisories/CVE-2026-107015.md) `CVE-2026-107015` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control - [maotoumao MusicFreeDesktop Request Forwarder information disclosure](https://agentprime.io/advisories/CVE-2026-118578.md) `CVE-2026-118578` · CVE record: maotoumao MusicFreeDesktop · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure, Broken access control - [Objects API: Cross-object-type authorization bypass on the object history-detail endpoint](https://agentprime.io/advisories/CVE-2026-82411.md) `CVE-2026-82411` · CVE record: maykinmedia open-object · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [MailWatch: IDOR lets any authenticated user release or delete another tenant's quarantined mail](https://agentprime.io/advisories/CVE-2026-85749.md) `CVE-2026-85749` · CVE record: mailwatch MailWatch · CVSS 8.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control, CWE-566 - [InvoicePlane: Guest user IDOR in quote approval and rejection](https://agentprime.io/advisories/CVE-2026-55561.md) `CVE-2026-55561` · CVE record: InvoicePlane InvoicePlane · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [Domoticz: Missing authorization and path traversal in the udevices Lua parser handler](https://agentprime.io/advisories/CVE-2026-75520.md) `CVE-2026-75520` · CVE record: domoticz domoticz · CVSS 5.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Path traversal, Broken access control - [a2ui-project a2ui Renderer root.js Root.renderComponentTree dynamically-determined object attributes](https://agentprime.io/advisories/CVE-2026-118538.md) `CVE-2026-118538` · CVE record: a2ui-project a2ui · CVSS 5.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control, CWE-913 - [AVideo-Encoder: missing authentication on control and status endpoints](https://agentprime.io/advisories/CVE-2026-61571.md) `CVE-2026-61571` · CVE record: WWBN AVideo-Encoder · CVSS 7.3 High · Not analysed yet · Published 28 Oct 2026 · Tags: Authentication bypass, Broken access control - [Bricks Broken Access Control via query_result Endpoint](https://agentprime.io/advisories/CVE-2026-118804.md) `CVE-2026-118804` · CVE record: Bricks Bricks Builder · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [Mem0: Cross-tenant conversation leak via unescaped delimiter collision in session-scope key (\_build_session_scope)](https://agentprime.io/advisories/GHSA-5324-3w58-qpp2.md) `GHSA-5324-3w58-qpp2`, `CVE-2026-116575` · npm `mem0ai` and 1 more: affected `<3.1.6`, fixed in `3.1.6` · CVSS 6.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Information disclosure, Broken access control - [PiWeb Disable payment method / Partial payment for WooCommerce before 1.1.10.9 Missing Authorization via update_fees](https://agentprime.io/advisories/CVE-2026-118757.md) `CVE-2026-118757` · CVE record: PI Websolution PiWeb Disable payment method / Partial payment for WooCommerce · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [Dolibarr ERP CRM before 24.0.2 Missing Authorization via public recruitment view.php](https://agentprime.io/advisories/CVE-2026-118754.md) `CVE-2026-118754` · CVE record: Dolibarr Dolibarr ERP/CRM · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [LangGraph JavaScript custom authentication may permit cross-user Store access](https://agentprime.io/advisories/GHSA-4hm6-w6qq-w73v.md) `GHSA-4hm6-w6qq-w73v`, `CVE-2026-118668` · PyPI `langgraph-api`: affected `>=0.1.2, <0.15.0`, fixed in `0.15.0` · CVSS 8.6 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [filelock: StrictSoftFileLock creates its claim directories without the lock mode, so another local user with a write bit on them can end a live hold](https://agentprime.io/advisories/GHSA-6627-m3xw-93mp.md) `GHSA-6627-m3xw-93mp`, `CVE-2026-112908` · PyPI `filelock`: affected `>=3.30.0, <4.2.1`, fixed in `4.2.1` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [filelock: WindowsFileLock ignores mode: a 0o600 lock file and the ReadWriteLock database inherit the directory ACL](https://agentprime.io/advisories/GHSA-8mx5-7m5m-r77g.md) `GHSA-8mx5-7m5m-r77g`, `CVE-2026-112910` · PyPI `filelock`: affected `>=3.10.0, <4.2.1`, fixed in `4.2.1` · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [Ai-gateway-payload-processing: ai-gateway-payload-processing: tenant/credential selection from client-controlled url path with no in-process authorization](https://agentprime.io/advisories/CVE-2026-117574.md) `CVE-2026-117574` · CVE record: Red Hat Red Hat OpenShift AI (RHOAI) · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [Echo's middleware.Static: \`%2F\`-encoded path bypasses route/group middleware guarding a statically-served path](https://agentprime.io/advisories/GHSA-375p-5qhx-8wq4.md) `GHSA-375p-5qhx-8wq4`, `CVE-2026-118650`, `GO-2026-6873` · Go `github.com/labstack/echo/v4` and 1 more: affected `<4.16.0`, fixed in `4.16.0` · CVSS 7.5 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control, CWE-177 - [rucio has an Authorization Bypass on REST API endpoint for signing URLs](https://agentprime.io/advisories/GHSA-5j9r-fx4x-rpvg.md) `GHSA-5j9r-fx4x-rpvg`, `CVE-2026-58273` · PyPI `rucio`: affected `>=1.16.1, <35.9.0 || >=36.0.0rc1, <38.6.0 || >=39.0.0rc1, <41.0.0rc1`, fixed in `35.9.0`, `38.6.0`, `41.0.0rc1` · CVSS 8.1 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [ToolJet 3.20.2-lts before 3.20.242-lts Signup Bypass via SignupDisableGuard](https://agentprime.io/advisories/CVE-2026-118685.md) `CVE-2026-118685` · CVE record: ToolJet ToolJet · CVSS 6.9 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass](https://agentprime.io/advisories/CVE-2026-118676.md) `CVE-2026-118676` · CVE record: n8n-io n8n · CVSS 5.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Guard Bypass via Execute Sub-workflow](https://agentprime.io/advisories/CVE-2026-118675.md) `CVE-2026-118675` · CVE record: n8n-io n8n · CVSS 5.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [n8n before 1.123.85, 2.43.5, and 2.44.1 Credential Permission Check Bypass via Inline Sub-Workflows](https://agentprime.io/advisories/CVE-2026-118642.md) `CVE-2026-118642` · CVE record: n8n-io n8n · CVSS 5.1 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [n8n before 1.123.85, 2.43.5, and 2.44.1 Chat Hub Authorization Bypass](https://agentprime.io/advisories/CVE-2026-118640.md) `CVE-2026-118640` · CVE record: n8n-io n8n · CVSS 5.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [Improper access control in Google chrome-devtools-mcp](https://agentprime.io/advisories/CVE-2026-106484.md) `CVE-2026-106484` · CVE record: Google chrome-devtools-mcp · CVSS 4.4 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query](https://agentprime.io/advisories/CVE-2026-105620.md) `CVE-2026-105620` · CVE record: DALIBO PostgreSQL Anonymizer · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [PostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker views](https://agentprime.io/advisories/CVE-2026-105619.md) `CVE-2026-105619` · CVE record: DALIBO PostgreSQL Anonymizer · CVSS 4.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent](https://agentprime.io/advisories/CVE-2026-105618.md) `CVE-2026-105618` · CVE record: DALIBO PostgreSQL Anonymizer · CVSS 5.7 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles](https://agentprime.io/advisories/CVE-2026-105612.md) `CVE-2026-105612` · CVE record: DALIBO PostgreSQL Anonymizer · CVSS 3.5 Low · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [SSO settings authorization bypass](https://agentprime.io/advisories/CVE-2026-103506.md) `CVE-2026-103506` · CVE record: Grafana Grafana Enterprise and 1 more · CVSS 8.9 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [Alerting contact point authorization bypass via schema downgrade](https://agentprime.io/advisories/CVE-2026-100105.md) `CVE-2026-100105` · CVE record: Grafana Grafana Enterprise and 1 more · CVSS 7.7 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [Missing authorization in Jenkins](https://agentprime.io/advisories/CVE-2026-117625.md) `CVE-2026-117625` · CVE record: Jenkins Project Jenkins · CVSS 4.3 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [Missing authorization in Jenkins](https://agentprime.io/advisories/CVE-2026-117614.md) `CVE-2026-117614` · CVE record: Jenkins Project Jenkins · CVSS 8.8 High · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [Apache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs](https://agentprime.io/advisories/CVE-2026-112375.md) `CVE-2026-112375` · CVE record: Apache Software Foundation Apache Kafka · CVSS 6.5 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control - [Session Smart Conductor: Insecure file permissions cause unauthorized access to sensitive routing credentials](https://agentprime.io/advisories/CVE-2026-103404.md) `CVE-2026-103404` · CVE record: Juniper Networks Session Smart Conductor · CVSS 6.8 Medium · Not analysed yet · Published 28 Oct 2026 · Tags: Broken access control Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .