# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-42690.md)
  `CVE-2026-42690` · CVE record: ThimPress LearnPress · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Microsoft Edge for Android Security Feature Bypass Vulnerability](https://agentprime.io/advisories/CVE-2026-85330.md)
  `CVE-2026-85330` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [ASP.NET Core Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-114148.md)
  `CVE-2026-114148` · CVE record: Microsoft .NET 10.0 installed on Linux and 4 more · CVSS 7.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-103092.md)
  `CVE-2026-103092` · CVE record: IBM Langflow OSS · CVSS 8.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-104316.md)
  `CVE-2026-104316` · CVE record: IBM Langflow OSS · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-107327.md)
  `CVE-2026-107327` · CVE record: IBM Langflow OSS · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Langflow OSS is affected by multiple vulnerabilities](https://agentprime.io/advisories/CVE-2026-110196.md)
  `CVE-2026-110196` · CVE record: IBM Langflow OSS · CVSS 8.8 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress Happy Addons for Elementor plugin <= 3.50.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-109891.md)
  `CVE-2026-109891` · CVE record: weDevs Happy Addons for Elementor · CVSS 6.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress WP ERP plugin <= 1.17.10 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-25448.md)
  `CVE-2026-25448` · CVE record: weDevs WP ERP · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress EventPrime plugin <= 4.3.6.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-42691.md)
  `CVE-2026-42691` · CVE record: EventPrime EventPrime · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress Page Restriction WordPress (WP) plugin <= 1.6.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-54852.md)
  `CVE-2026-54852` · CVE record: miniOrange Page Restriction WordPress (WP) · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97073.md)
  `CVE-2026-97073` · CVE record: myCred myCred · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress Profile Builder plugin <= 4.0.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-54853.md)
  `CVE-2026-54853` · CVE record: Cozmoslabs Profile Builder · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress Kit (formerly ConvertKit) plugin <= 3.4.7 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-27063.md)
  `CVE-2026-27063` · CVE record: Kit Kit (formerly ConvertKit) · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress Custom Price for WooCommerce plugin <= 1.1.29 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-115601.md)
  `CVE-2026-115601` · CVE record: WP Desk Custom Price for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress SureDash plugin <= 1.12.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-115605.md)
  `CVE-2026-115605` · CVE record: Brainstorm Force SureDash · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress ShopBuilder – Elementor WooCommerce Builder Addons plugin <= 3.4.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-54871.md)
  `CVE-2026-54871` · CVE record: Mamunur Rashid ShopBuilder – Elementor WooCommerce Builder Addons · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress User Registration plugin <= 5.3.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-25450.md)
  `CVE-2026-25450` · CVE record: ThemeGrill User Registration · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress Taxi Booking Manager for WooCommerce plugin <= 2.1.6 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-114181.md)
  `CVE-2026-114181` · CVE record: Magepeople inc. Taxi Booking Manager for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-118088.md)
  `CVE-2026-118088` · CVE record: WPFunnels Team WPFunnels · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.24 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-116856.md)
  `CVE-2026-116856` · CVE record: WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress WPFunnels plugin <= 3.13.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-118091.md)
  `CVE-2026-118091` · CVE record: WPFunnels Team WPFunnels · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress SureForms plugin <= 2.12.9 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-116387.md)
  `CVE-2026-116387` · CVE record: Brainstorm Force SureForms · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress MasterStudy LMS plugin <= 3.7.55 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-118092.md)
  `CVE-2026-118092` · CVE record: StylemixThemes MasterStudy LMS · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-116406.md)
  `CVE-2026-116406` · CVE record: Webba Plugins Webba Booking · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-52708.md)
  `CVE-2026-52708` · CVE record: weDevs WP User Frontend · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress WP User Manager plugin <= 2.9.26 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-116846.md)
  `CVE-2026-116846` · CVE record: WP User Manager WP User Manager · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress WP User Frontend plugin <= 4.3.13 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-48884.md)
  `CVE-2026-48884` · CVE record: weDevs WP User Frontend · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [MasterStudy LMS WordPress Plugin < 3.7.50 Missing Authorization via stm_lms_send_test_email_ajax](https://agentprime.io/advisories/CVE-2026-80069.md)
  `CVE-2026-80069` · CVE record: Stylemix MasterStudy LMS WordPress Plugin · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Incorrect Authorization in Elastic Cloud Enterprise (ECE) Leading to Unauthorized Modification of Platform Settings](https://agentprime.io/advisories/CVE-2026-115712.md)
  `CVE-2026-115712` · CVE record: Elastic Elastic Cloud Enterprise · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Authorization Bypass Through User-Controlled Key in Elastic Cloud Enterprise (ECE) Leading to Privilege Escalation](https://agentprime.io/advisories/CVE-2026-115706.md)
  `CVE-2026-115706` · CVE record: Elastic Elastic Cloud Enterprise · CVSS 6.8 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39782.md)
  `CVE-2026-39782` · CVE record: Kaliforms Kali Forms · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Improper Authorization in BMC ITSM SmartIT Change Approvals](https://agentprime.io/advisories/CVE-2026-113696.md)
  `CVE-2026-113696` · CVE record: BMC BMC IT Service Management Suite · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Dnsmasq: dnsmasq: --leasequery without address argument applies no source address check](https://agentprime.io/advisories/CVE-2026-93010.md)
  `CVE-2026-93010` · CVE record: Red Hat Red Hat Ceph Storage 9 and 4 more · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Improper Authorization in BMC ITSM SmartIT Attachments](https://agentprime.io/advisories/CVE-2026-113694.md)
  `CVE-2026-113694` · CVE record: BMC BMC IT Service Management Suite · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [FreeMail before 5.3.2 Authorization Bypass via /api/create Mailbox Claiming](https://agentprime.io/advisories/CVE-2026-119049.md)
  `CVE-2026-119049` · CVE record: idinging FreeMail · CVSS 7.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [JeeSite 5.11.0 through 5.19.1 IDOR in AI CMS Chat Module](https://agentprime.io/advisories/CVE-2026-119048.md)
  `CVE-2026-119048` · CVE record: thinkgem JeeSite · CVSS 2.3 Low · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress HivePress Claim Listings plugin <= 1.1.4 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-42707.md)
  `CVE-2026-42707` · CVE record: HivePress HivePress Claim Listings · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress Simple Cloudflare Turnstile plugin <= 1.44.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39741.md)
  `CVE-2026-39741` · CVE record: RelyWP Simple Cloudflare Turnstile · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress WP Job Portal plugin <= 2.7.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-22386.md)
  `CVE-2026-22386` · CVE record: Ahmad WP Job Portal · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress Kali Forms plugin <= 2.4.27 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-42703.md)
  `CVE-2026-42703` · CVE record: Kaliforms Kali Forms · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress JetEngine plugin <= 3.9.0.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39735.md)
  `CVE-2026-39735` · CVE record: Crocoblock JetEngine · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress Product Feed Manager plugin <= 7.14.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-118093.md)
  `CVE-2026-118093` · CVE record: WPFunnels Team Product Feed Manager · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.62.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-27401.md)
  `CVE-2026-27401` · CVE record: YITH YITH PayPal Express Checkout for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress HANDMADE – Dropshipping for Etsy and WooCommerce plugin <= 1.0.10 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-112827.md)
  `CVE-2026-112827` · CVE record: VillaTheme HANDMADE – Dropshipping for Etsy and WooCommerce · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress GEO my WordPress plugin <= 4.5.5.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-114193.md)
  `CVE-2026-114193` · CVE record: Eyal Fitoussi GEO my WordPress · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-115599.md)
  `CVE-2026-115599` · CVE record: ThimPress LearnPress · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress Broadcast Live Video plugin <= 7.3.9 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-115963.md)
  `CVE-2026-115963` · CVE record: VideoWhisper.com Broadcast Live Video · CVSS 7.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Cross-user Document Access on Foxit Official Website's HTML-to-PDF Service](https://agentprime.io/advisories/CVE-2026-111417.md)
  `CVE-2026-111417` · CVE record: Foxit Software Inc. foxit.com · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: jwt authorization grant bypasses identity provider login restrictions](https://agentprime.io/advisories/CVE-2026-117627.md)
  `CVE-2026-117627` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Wildfly-platform-mbean: wildfly-platform-mbean: rbac sensitive attribute read bypass for platform runtimemxbean](https://agentprime.io/advisories/CVE-2026-19610.md)
  `CVE-2026-19610` · CVE record: Red Hat Red Hat JBoss Enterprise Application Platform 8.1 and 3 more · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [YT Player < 2.1.4 - Contributor+ Missing Authorization via ytp_ajax](https://agentprime.io/advisories/CVE-2026-85007.md)
  `CVE-2026-85007` · CVE record: Unknown Video Player for YouTube · CVSS 3.8 Low · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Photo Engine < 6.6.0 - Author+ Arbitrary Content Modification via IDOR](https://agentprime.io/advisories/CVE-2026-115259.md)
  `CVE-2026-115259` · CVE record: Unknown Photo Engine (Media Organizer & Lightroom) · CVSS 4.9 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Hide Price Until Login < 1.1.2 - Unauthenticated Account Creation via Guest Registration](https://agentprime.io/advisories/CVE-2026-110030.md)
  `CVE-2026-110030` · CVE record: Unknown Hide Price Until Login · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Wallet System for WooCommerce < 2.8.2 - Subscriber+ KYC Document Overwrite via IDOR](https://agentprime.io/advisories/CVE-2026-108763.md)
  `CVE-2026-108763` · CVE record: Unknown Wallet System for WooCommerce · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WP Post Author < 4.2.0 - Unauthenticated Modification of the First User Account's Profile Fields](https://agentprime.io/advisories/CVE-2026-108685.md)
  `CVE-2026-108685` · CVE record: Unknown WP Post Author · CVSS 3.7 Low · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Link Library < 7.10.0 - Unauthenticated Link Submission Login Requirement Bypass](https://agentprime.io/advisories/CVE-2026-78395.md)
  `CVE-2026-78395` · CVE record: Unknown Link Library · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Contact Form by Supsystic < 1.11.1 - Unauthenticated Arbitrary Statistics Deletion](https://agentprime.io/advisories/CVE-2026-115302.md)
  `CVE-2026-115302` · CVE record: Unknown Contact Form by Supsystic · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Improper authorization in Frangoteam](https://agentprime.io/advisories/CVE-2026-42949.md)
  `CVE-2026-42949` · CVE record: frangoteam Frangoteam · CVSS 5.6 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Improper authorization in Frangoteam](https://agentprime.io/advisories/CVE-2026-42922.md)
  `CVE-2026-42922` · CVE record: frangoteam Frangoteam · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTI5VDAyOjU5OjUxLjcxMTAwMFoiLCJDVkUtMjAyNi00MjkyMiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTI5VDE1OjI0OjQxLjA4NTAwMFoiLCJDVkUtMjAyNi0xMTgwODQiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTI5VDE1OjI0OjQxLjA4NTAwMFoiLCJDVkUtMjAyNi0xMTgwODQiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.