# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-112999.md)
  `CVE-2026-112999` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113327.md)
  `CVE-2026-113327` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113207.md)
  `CVE-2026-113207` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113146.md)
  `CVE-2026-113146` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113289.md)
  `CVE-2026-113289` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113183.md)
  `CVE-2026-113183` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113290.md)
  `CVE-2026-113290` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113155.md)
  `CVE-2026-113155` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113051.md)
  `CVE-2026-113051` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113209.md)
  `CVE-2026-113209` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113005.md)
  `CVE-2026-113005` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113219.md)
  `CVE-2026-113219` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113319.md)
  `CVE-2026-113319` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113343.md)
  `CVE-2026-113343` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113014.md)
  `CVE-2026-113014` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113275.md)
  `CVE-2026-113275` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113220.md)
  `CVE-2026-113220` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113105.md)
  `CVE-2026-113105` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113264.md)
  `CVE-2026-113264` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113129.md)
  `CVE-2026-113129` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113131.md)
  `CVE-2026-113131` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113302.md)
  `CVE-2026-113302` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113198.md)
  `CVE-2026-113198` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113011.md)
  `CVE-2026-113011` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113211.md)
  `CVE-2026-113211` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113035.md)
  `CVE-2026-113035` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113281.md)
  `CVE-2026-113281` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113142.md)
  `CVE-2026-113142` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113240.md)
  `CVE-2026-113240` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113018.md)
  `CVE-2026-113018` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113263.md)
  `CVE-2026-113263` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113006.md)
  `CVE-2026-113006` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113069.md)
  `CVE-2026-113069` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113113.md)
  `CVE-2026-113113` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113109.md)
  `CVE-2026-113109` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113022.md)
  `CVE-2026-113022` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113174.md)
  `CVE-2026-113174` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113231.md)
  `CVE-2026-113231` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-112993.md)
  `CVE-2026-112993` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113179.md)
  `CVE-2026-113179` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113222.md)
  `CVE-2026-113222` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113253.md)
  `CVE-2026-113253` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113092.md)
  `CVE-2026-113092` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113058.md)
  `CVE-2026-113058` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113097.md)
  `CVE-2026-113097` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113101.md)
  `CVE-2026-113101` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in the WhatsApp channel in Kiro Crew](https://agentprime.io/advisories/CVE-2026-112380.md)
  `CVE-2026-112380` · CVE record: Amazon Kiro Crew · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service](https://agentprime.io/advisories/GHSA-rvq5-wwqv-78pq.md)
  `GHSA-rvq5-wwqv-78pq`, `CVE-2026-111771` · npm `@modelcontextprotocol/express` and 3 more: affected `>=2.0.0, <2.0.2`, fixed in `2.0.2` · CVSS 6.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [MCP TypeScript SDK: Experimental tasks were not tied to the session that created them](https://agentprime.io/advisories/GHSA-22jm-h49p-29qw.md)
  `GHSA-22jm-h49p-29qw`, `CVE-2026-111767` · npm `@modelcontextprotocol/sdk`: affected `>=1.24.0, <1.32.0`, fixed in `1.32.0` · CVSS 8.6 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)](https://agentprime.io/advisories/GHSA-xf6w-q65w-4f2w.md)
  `GHSA-xf6w-q65w-4f2w`, `CVE-2026-113653` · npm `apostrophe`: affected `<4.33.0`, fixed in `4.33.0` · CVSS 6.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints](https://agentprime.io/advisories/GHSA-vwwx-px9w-crrc.md)
  `GHSA-vwwx-px9w-crrc`, `CVE-2026-113665` · npm `apostrophe`: affected `<4.33.0`, fixed in `4.33.0` · CVSS 3.7 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers](https://agentprime.io/advisories/GHSA-vmxh-77cw-65j7.md)
  `GHSA-vmxh-77cw-65j7`, `CVE-2026-113660` · npm `apostrophe`: affected `<4.33.0`, fixed in `4.33.0` · CVSS 4.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document](https://agentprime.io/advisories/GHSA-jqw5-w6h3-44g6.md)
  `GHSA-jqw5-w6h3-44g6`, `CVE-2026-113662` · npm `@apostrophecms/import-export`: affected `<3.7.0`, fixed in `3.7.0` · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control, Other injection
- [EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization](https://agentprime.io/advisories/CVE-2026-113643.md)
  `CVE-2026-113643` · CVE record: EspoCRM · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [ApostropheCMS: :\_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)](https://agentprime.io/advisories/GHSA-gqh3-7856-rjjg.md)
  `GHSA-gqh3-7856-rjjg`, `CVE-2026-113668` · npm `apostrophe`: affected `<4.33.0`, fixed in `4.33.0` · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure, Broken access control
- [ApostropheCMS: Page REST API authorization bypass](https://agentprime.io/advisories/GHSA-2j32-q6rx-h844.md)
  `GHSA-2j32-q6rx-h844`, `CVE-2026-110904`, `CVE-2026-113670` · npm `apostrophe`: affected `<4.33.0`, fixed in `4.33.0` · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting](https://agentprime.io/advisories/CVE-2026-97406.md)
  `CVE-2026-97406` · CVE record: Xerj Console API · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Authentication bypass, Broken access control
- [ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization](https://agentprime.io/advisories/GHSA-2jrp-qc93-h2j8.md)
  `GHSA-2jrp-qc93-h2j8`, `CVE-2026-113655` · npm `apostrophe`: affected `<4.33.0`, fixed in `4.33.0` · CVSS 4.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-112861.md)
  `CVE-2026-112861` · CVE record: xnau webdesign Participants Database · CVSS 6.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [aaPanel common.py GetClientIp access control](https://agentprime.io/advisories/CVE-2026-113507.md)
  `CVE-2026-113507` · CVE record: aaPanel · CVSS 6.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation, Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTIwVDE3OjMwOjE1LjE5NjAwMFoiLCJDVkUtMjAyNi0xMTM1MDciXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTIwVDIxOjAyOjExLjk5ODAwMFoiLCJDVkUtMjAyNi0xMTMyNDkiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTIwVDIxOjAyOjExLjk5ODAwMFoiLCJDVkUtMjAyNi0xMTMyNDkiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.