# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Incorrect authorization in Oracle Corporation Oracle Java SE](https://agentprime.io/advisories/CVE-2026-91375.md)
  `CVE-2026-91375` · CVE record: Oracle Corporation Oracle Java SE · CVSS 4.7 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Java SE and others](https://agentprime.io/advisories/CVE-2026-91374.md)
  `CVE-2026-91374` · CVE record: Oracle Corporation Oracle Java SE and 2 more · CVSS 4.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-91369.md)
  `CVE-2026-91369` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-91368.md)
  `CVE-2026-91368` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 4.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-91367.md)
  `CVE-2026-91367` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-91366.md)
  `CVE-2026-91366` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 4.7 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-91364.md)
  `CVE-2026-91364` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 6.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-91361.md)
  `CVE-2026-91361` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise HCM Global Payroll Switzerland](https://agentprime.io/advisories/CVE-2026-91356.md)
  `CVE-2026-91356` · CVE record: Oracle Corporation PeopleSoft Enterprise HCM Global Payroll Switzerland · CVSS 4.2 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Outside In Technology](https://agentprime.io/advisories/CVE-2026-91354.md)
  `CVE-2026-91354` · CVE record: Oracle Corporation Oracle Outside In Technology · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Outside In Technology](https://agentprime.io/advisories/CVE-2026-91351.md)
  `CVE-2026-91351` · CVE record: Oracle Corporation Oracle Outside In Technology · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation iSupport](https://agentprime.io/advisories/CVE-2026-91347.md)
  `CVE-2026-91347` · CVE record: Oracle Corporation iSupport · CVSS 8.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Outside In Technology](https://agentprime.io/advisories/CVE-2026-91343.md)
  `CVE-2026-91343` · CVE record: Oracle Corporation Oracle Outside In Technology · CVSS 8.6 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Outside In Technology](https://agentprime.io/advisories/CVE-2026-91342.md)
  `CVE-2026-91342` · CVE record: Oracle Corporation Oracle Outside In Technology · CVSS 8.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Outside In Technology](https://agentprime.io/advisories/CVE-2026-91341.md)
  `CVE-2026-91341` · CVE record: Oracle Corporation Oracle Outside In Technology · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Outside In Technology](https://agentprime.io/advisories/CVE-2026-91340.md)
  `CVE-2026-91340` · CVE record: Oracle Corporation Oracle Outside In Technology · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation iSupport](https://agentprime.io/advisories/CVE-2026-91338.md)
  `CVE-2026-91338` · CVE record: Oracle Corporation iSupport · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation iProcurement](https://agentprime.io/advisories/CVE-2026-91337.md)
  `CVE-2026-91337` · CVE record: Oracle Corporation iProcurement · CVSS 7.4 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Solaris](https://agentprime.io/advisories/CVE-2026-91336.md)
  `CVE-2026-91336` · CVE record: Oracle Corporation Oracle Solaris · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Java SE](https://agentprime.io/advisories/CVE-2026-91332.md)
  `CVE-2026-91332` · CVE record: Oracle Corporation Oracle Java SE · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise CC Common Application Objects](https://agentprime.io/advisories/CVE-2026-91331.md)
  `CVE-2026-91331` · CVE record: Oracle Corporation PeopleSoft Enterprise CC Common Application Objects · CVSS 3.8 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91329.md)
  `CVE-2026-91329` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91327.md)
  `CVE-2026-91327` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91326.md)
  `CVE-2026-91326` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation iProcurement](https://agentprime.io/advisories/CVE-2026-91321.md)
  `CVE-2026-91321` · CVE record: Oracle Corporation iProcurement · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle JDeveloper](https://agentprime.io/advisories/CVE-2026-91320.md)
  `CVE-2026-91320` · CVE record: Oracle Corporation Oracle JDeveloper · CVSS 5.7 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle JDeveloper](https://agentprime.io/advisories/CVE-2026-91319.md)
  `CVE-2026-91319` · CVE record: Oracle Corporation Oracle JDeveloper · CVSS 5.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation iProcurement](https://agentprime.io/advisories/CVE-2026-91316.md)
  `CVE-2026-91316` · CVE record: Oracle Corporation iProcurement · CVSS 7.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91315.md)
  `CVE-2026-91315` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91314.md)
  `CVE-2026-91314` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91312.md)
  `CVE-2026-91312` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91304.md)
  `CVE-2026-91304` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91303.md)
  `CVE-2026-91303` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91301.md)
  `CVE-2026-91301` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 3.6 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Orchestrator](https://agentprime.io/advisories/CVE-2026-91299.md)
  `CVE-2026-91299` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Orchestrator · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91298.md)
  `CVE-2026-91298` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91297.md)
  `CVE-2026-91297` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91291.md)
  `CVE-2026-91291` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 3.6 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91288.md)
  `CVE-2026-91288` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 7.4 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91287.md)
  `CVE-2026-91287` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91286.md)
  `CVE-2026-91286` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 8.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Orchestrator](https://agentprime.io/advisories/CVE-2026-91285.md)
  `CVE-2026-91285` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Orchestrator · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91281.md)
  `CVE-2026-91281` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91280.md)
  `CVE-2026-91280` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91279.md)
  `CVE-2026-91279` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Orchestrator](https://agentprime.io/advisories/CVE-2026-91276.md)
  `CVE-2026-91276` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Orchestrator · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91275.md)
  `CVE-2026-91275` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 6.6 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91273.md)
  `CVE-2026-91273` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 8.6 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91272.md)
  `CVE-2026-91272` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 7.4 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91271.md)
  `CVE-2026-91271` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91269.md)
  `CVE-2026-91269` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91268.md)
  `CVE-2026-91268` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation JD Edwards EnterpriseOne Tools](https://agentprime.io/advisories/CVE-2026-91266.md)
  `CVE-2026-91266` · CVE record: Oracle Corporation JD Edwards EnterpriseOne Tools · CVSS 8.4 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise SCM Manufacturing](https://agentprime.io/advisories/CVE-2026-91264.md)
  `CVE-2026-91264` · CVE record: Oracle Corporation PeopleSoft Enterprise SCM Manufacturing · CVSS 3.7 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-91263.md)
  `CVE-2026-91263` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 4.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle WebCenter Content](https://agentprime.io/advisories/CVE-2026-91262.md)
  `CVE-2026-91262` · CVE record: Oracle Corporation Oracle WebCenter Content · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91251.md)
  `CVE-2026-91251` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper authorization in Oracle Corporation Oracle WebCenter Portal](https://agentprime.io/advisories/CVE-2026-91245.md)
  `CVE-2026-91245` · CVE record: Oracle Corporation Oracle WebCenter Portal · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Business Process Management Suite](https://agentprime.io/advisories/CVE-2026-91243.md)
  `CVE-2026-91243` · CVE record: Oracle Corporation Oracle Business Process Management Suite · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Solaris](https://agentprime.io/advisories/CVE-2026-91242.md)
  `CVE-2026-91242` · CVE record: Oracle Corporation Oracle Solaris · CVSS 7.4 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTIwVDIxOjI0OjUwLjY0NDAwMFoiLCJDVkUtMjAyNi05MTI0MiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTIwVDIxOjI1OjM3LjU2MTAwMFoiLCJDVkUtMjAyNi05MTM3NiJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTIwVDIxOjI1OjM3LjU2MTAwMFoiLCJDVkUtMjAyNi05MTM3NiJd>. Everything for agents: <https://agentprime.io/llms.txt>.