# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Missing authorization in Apple macOS and others](https://agentprime.io/advisories/CVE-2026-28850.md)
  `CVE-2026-28850` · CVE record: Apple macOS and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header](https://agentprime.io/advisories/CVE-2026-77937.md)
  `CVE-2026-77937` · CVE record: letta-ai letta · CVSS 8.6 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers](https://agentprime.io/advisories/CVE-2026-77935.md)
  `CVE-2026-77935` · CVE record: coze-dev coze-studio · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents](https://agentprime.io/advisories/CVE-2026-77930.md)
  `CVE-2026-77930` · CVE record: EvoScientist EvoScientist · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection](https://agentprime.io/advisories/CVE-2026-109444.md)
  `CVE-2026-109444` · CVE record: Tracer-Cloud opensre · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Langflow OSS Authorization Bypass Through User-Controlled Key](https://agentprime.io/advisories/CVE-2026-107366.md)
  `CVE-2026-107366` · CVE record: IBM Langflow OSS · CVSS 8.3 High · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Incorrect permission assignment in Dell Application Store](https://agentprime.io/advisories/CVE-2026-71169.md)
  `CVE-2026-71169` · CVE record: Dell Application Store · CVSS 7.0 High · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations](https://agentprime.io/advisories/CVE-2026-112778.md)
  `CVE-2026-112778` · CVE record: traefik traefik · CVSS 6.4 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations](https://agentprime.io/advisories/CVE-2026-112776.md)
  `CVE-2026-112776` · CVE record: craftcms cms · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass](https://agentprime.io/advisories/CVE-2026-112769.md)
  `CVE-2026-112769` · CVE record: parse-community parse-server · CVSS 2.3 Low · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update](https://agentprime.io/advisories/CVE-2026-112768.md)
  `CVE-2026-112768` · CVE record: parse-community parse-server · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass](https://agentprime.io/advisories/GHSA-f8c7-rwf9-fmgm.md)
  `GHSA-f8c7-rwf9-fmgm`, `CVE-2026-111057` · PyPI `mercury`: affected `>=3.0.0, <3.2.4`, fixed in `3.2.4` · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control, CWE-185
- [agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable](https://agentprime.io/advisories/GHSA-953h-535j-jg2v.md)
  `GHSA-953h-535j-jg2v` · Go `github.com/envoyproxy/ai-gateway`: affected `>=0.4.0-rc1, <1.2.0-rc1`, fixed in `1.2.0-rc1` · CVSS 4.0, no score published · Not analysed yet · Published 19 Oct 2026 · Tags: Hard-coded credentials, Broken access control
- [Mercury: Unauthenticated Remote Code Execution via /api/kernels](https://agentprime.io/advisories/GHSA-rv4m-xm3f-3ccq.md)
  `GHSA-rv4m-xm3f-3ccq`, `CVE-2026-111058` · PyPI `mercury`: affected `<3.2.6`, fixed in `3.2.6` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption](https://agentprime.io/advisories/CVE-2025-7043.md)
  `CVE-2025-7043` · CVE record: WSO2 WSO2 API Manager and 3 more · CVSS 5.4 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions](https://agentprime.io/advisories/CVE-2026-111046.md)
  `CVE-2026-111046` · CVE record: FOSSBilling FOSSBilling · CVSS 2.3 Low · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Incorrect Default Permissions in hMailServer](https://agentprime.io/advisories/CVE-2026-107571.md)
  `CVE-2026-107571` · CVE record: Progressive Robot Ltd hMailServer · CVSS 7.8 High · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Missing Authorization in hMailServer](https://agentprime.io/advisories/CVE-2026-107566.md)
  `CVE-2026-107566` · CVE record: Progressive Robot Ltd hMailServer · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Missing Authorization in hMailServer](https://agentprime.io/advisories/CVE-2026-107568.md)
  `CVE-2026-107568` · CVE record: Progressive Robot Ltd hMailServer · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override](https://agentprime.io/advisories/CVE-2026-112305.md)
  `CVE-2026-112305` · CVE record: semaphoreui Semaphore UI · CVSS 8.7 High · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Camunda Broken Access Control via Cockpit](https://agentprime.io/advisories/CVE-2026-109433.md)
  `CVE-2026-109433` · CVE record: Camunda Camunda 7 · CVSS 6.0 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Camunda Missing Authorization in Task Sub-Resources](https://agentprime.io/advisories/CVE-2026-109431.md)
  `CVE-2026-109431` · CVE record: Camunda Camunda 7 · CVSS 8.6 High · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Sensei LMS 4.26.4 Broken Access Control via save_new_message](https://agentprime.io/advisories/CVE-2026-112329.md)
  `CVE-2026-112329` · CVE record: Automattic Sensei LMS · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX](https://agentprime.io/advisories/CVE-2026-112328.md)
  `CVE-2026-112328` · CVE record: Automattic Sensei LMS · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload](https://agentprime.io/advisories/CVE-2026-112149.md)
  `CVE-2026-112149` · CVE record: vraj404 Criminal-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [ai-genius-automations octoally index.ts information disclosure](https://agentprime.io/advisories/CVE-2026-112147.md)
  `CVE-2026-112147` · CVE record: ai-genius-automations octoally · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Broken access control
- [FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update](https://agentprime.io/advisories/CVE-2026-112295.md)
  `CVE-2026-112295` · CVE record: sunkaifei FlyCms · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint](https://agentprime.io/advisories/CVE-2026-112294.md)
  `CVE-2026-112294` · CVE record: sunkaifei FlyCms · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API](https://agentprime.io/advisories/CVE-2026-112293.md)
  `CVE-2026-112293` · CVE record: BoxyHQ saas-starter-kit · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules](https://agentprime.io/advisories/CVE-2026-112292.md)
  `CVE-2026-112292` · CVE record: operacle checkcle · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API](https://agentprime.io/advisories/CVE-2026-112291.md)
  `CVE-2026-112291` · CVE record: Flarum Extension Manager · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module](https://agentprime.io/advisories/CVE-2026-112287.md)
  `CVE-2026-112287` · CVE record: krayin laravel-crm · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints](https://agentprime.io/advisories/CVE-2026-112286.md)
  `CVE-2026-112286` · CVE record: krayin laravel-crm · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes](https://agentprime.io/advisories/CVE-2026-112268.md)
  `CVE-2026-112268` · CVE record: sgl-project sglang-router · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors](https://agentprime.io/advisories/CVE-2026-112262.md)
  `CVE-2026-112262` · CVE record: risingwavelabs risingwave · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation](https://agentprime.io/advisories/CVE-2026-111939.md)
  `CVE-2026-111939` · CVE record: frappe helpdesk · CVSS 5.1 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log](https://agentprime.io/advisories/CVE-2026-111938.md)
  `CVE-2026-111938` · CVE record: frappe crm · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records](https://agentprime.io/advisories/CVE-2026-111937.md)
  `CVE-2026-111937` · CVE record: frappe crm · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [satya-vinay Events-Management-System project.sql file access](https://agentprime.io/advisories/CVE-2026-112144.md)
  `CVE-2026-112144` · CVE record: satya-vinay Events-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control, Information disclosure
- [WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-112222.md)
  `CVE-2026-112222` · CVE record: Surfer Surfer · CVSS 5.4 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-110902.md)
  `CVE-2026-110902` · CVE record: Liquid Web / StellarWP Event Tickets · CVSS 4.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-111845.md)
  `CVE-2026-111845` · CVE record: YITH YITH WooCommerce Product Bundles · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-111831.md)
  `CVE-2026-111831` · CVE record: WP ManageNinja LLC FluentForm · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110363.md)
  `CVE-2026-110363` · CVE record: ThimPress LearnPress · CVSS 5.4 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [WordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-111836.md)
  `CVE-2026-111836` · CVE record: WP ManageNinja LLC FluentCommunity · CVSS 4.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [WordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-111839.md)
  `CVE-2026-111839` · CVE record: VideoWhisper.com Broadcast Live Video · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions](https://agentprime.io/advisories/CVE-2026-85300.md)
  `CVE-2026-85300` · CVE record: Apache Software Foundation Apache Camel · CVSS 5.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions](https://agentprime.io/advisories/CVE-2026-71563.md)
  `CVE-2026-71563` · CVE record: Apache Software Foundation Apache Answer · CVSS 4.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Apache Answer: Improper Authorization in Question Invite User Lookup](https://agentprime.io/advisories/CVE-2026-68482.md)
  `CVE-2026-68482` · CVE record: Apache Software Foundation Apache Answer · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Apache Answer: Email Code Purpose Confusion May Allow Account Takeover](https://agentprime.io/advisories/CVE-2026-67249.md)
  `CVE-2026-67249` · CVE record: Apache Software Foundation Apache Answer · CVSS 5.4 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions](https://agentprime.io/advisories/CVE-2026-64945.md)
  `CVE-2026-64945` · CVE record: Apache Software Foundation Apache Answer · CVSS 7.5 High · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings](https://agentprime.io/advisories/CVE-2026-112192.md)
  `CVE-2026-112192` · CVE record: MISP MISP · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Broken access control
- [MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution](https://agentprime.io/advisories/CVE-2026-112188.md)
  `CVE-2026-112188` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Broken access control
- [Apache Kylin: missing JDBC-config authorization](https://agentprime.io/advisories/CVE-2026-108766.md)
  `CVE-2026-108766` · CVE record: Apache Software Foundation Apache Kylin · CVSS 6.5 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control](https://agentprime.io/advisories/CVE-2026-112178.md)
  `CVE-2026-112178` · CVE record: MISP MISP · CVSS 7.1 High · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [pg_read_binary_file_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块](https://agentprime.io/advisories/CVE-2026-111439.md)
  `CVE-2026-111439` · CVE record: openGauss-server openGauss-server · CVSS 4.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure](https://agentprime.io/advisories/CVE-2026-112091.md)
  `CVE-2026-112091` · CVE record: Dav-ee dairy-management-system · CVSS 6.9 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Information disclosure, Broken access control
- [App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php](https://agentprime.io/advisories/CVE-2026-94294.md)
  `CVE-2026-94294` · CVE record: Unknown App Builder · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions](https://agentprime.io/advisories/CVE-2026-94272.md)
  `CVE-2026-94272` · CVE record: Unknown Snap Finance · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control
- [TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification](https://agentprime.io/advisories/CVE-2026-94231.md)
  `CVE-2026-94231` · CVE record: Unknown TrueBooker · CVSS 5.3 Medium · Not analysed yet · Published 19 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTE5VDA2OjQ2OjE5LjgyMzAwMFoiLCJDVkUtMjAyNi05NDIzMSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTIwVDAwOjUwOjE4LjQ1NTAwMFoiLCJDVkUtMjAyNi02NTM1NiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTIwVDAwOjUwOjE4LjQ1NTAwMFoiLCJDVkUtMjAyNi02NTM1NiJd>. Everything for agents: <https://agentprime.io/llms.txt>.