# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Improper access control in Oracle Corporation Siebel CRM Development](https://agentprime.io/advisories/CVE-2026-101454.md)
  `CVE-2026-101454` · CVE record: Oracle Corporation Siebel CRM Development · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Cross-site request forgery in Oracle Corporation Siebel Life Sciences](https://agentprime.io/advisories/CVE-2026-101451.md)
  `CVE-2026-101451` · CVE record: Oracle Corporation Siebel Life Sciences · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control, Cross-site request forgery (CSRF)
- [Improper access control in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-101446.md)
  `CVE-2026-101446` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-101445.md)
  `CVE-2026-101445` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 3.6 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-101444.md)
  `CVE-2026-101444` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 5.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-101443.md)
  `CVE-2026-101443` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-101442.md)
  `CVE-2026-101442` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 3.1 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-101437.md)
  `CVE-2026-101437` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 6.6 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Oracle Corporation Siebel CRM Cloud Applications](https://agentprime.io/advisories/CVE-2026-101436.md)
  `CVE-2026-101436` · CVE record: Oracle Corporation Siebel CRM Cloud Applications · CVSS 4.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101431.md)
  `CVE-2026-101431` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101429.md)
  `CVE-2026-101429` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 7.0 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101428.md)
  `CVE-2026-101428` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101425.md)
  `CVE-2026-101425` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 2.5 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Information disclosure in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101424.md)
  `CVE-2026-101424` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 5.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure, Broken access control
- [Incorrect authorization in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101423.md)
  `CVE-2026-101423` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 4.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101420.md)
  `CVE-2026-101420` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101419.md)
  `CVE-2026-101419` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101418.md)
  `CVE-2026-101418` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101416.md)
  `CVE-2026-101416` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101414.md)
  `CVE-2026-101414` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 2.9 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101411.md)
  `CVE-2026-101411` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101410.md)
  `CVE-2026-101410` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel Apps - Marketing](https://agentprime.io/advisories/CVE-2026-101404.md)
  `CVE-2026-101404` · CVE record: Oracle Corporation Siebel Apps - Marketing · CVSS 3.9 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Capacity](https://agentprime.io/advisories/CVE-2026-101398.md)
  `CVE-2026-101398` · CVE record: Oracle Corporation Oracle Capacity · CVSS 7.6 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel Apps - Marketing](https://agentprime.io/advisories/CVE-2026-101396.md)
  `CVE-2026-101396` · CVE record: Oracle Corporation Siebel Apps - Marketing · CVSS 4.7 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel Apps - Marketing](https://agentprime.io/advisories/CVE-2026-101395.md)
  `CVE-2026-101395` · CVE record: Oracle Corporation Siebel Apps - Marketing · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel Apps - Marketing](https://agentprime.io/advisories/CVE-2026-101394.md)
  `CVE-2026-101394` · CVE record: Oracle Corporation Siebel Apps - Marketing · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel Apps - Marketing](https://agentprime.io/advisories/CVE-2026-101391.md)
  `CVE-2026-101391` · CVE record: Oracle Corporation Siebel Apps - Marketing · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101388.md)
  `CVE-2026-101388` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Capacity](https://agentprime.io/advisories/CVE-2026-101387.md)
  `CVE-2026-101387` · CVE record: Oracle Corporation Oracle Capacity · CVSS 7.6 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101386.md)
  `CVE-2026-101386` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 4.2 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101385.md)
  `CVE-2026-101385` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 4.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101383.md)
  `CVE-2026-101383` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101382.md)
  `CVE-2026-101382` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 4.2 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101381.md)
  `CVE-2026-101381` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101380.md)
  `CVE-2026-101380` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101379.md)
  `CVE-2026-101379` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101378.md)
  `CVE-2026-101378` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 4.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101377.md)
  `CVE-2026-101377` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 2.7 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101376.md)
  `CVE-2026-101376` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 4.7 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101375.md)
  `CVE-2026-101375` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 6.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101374.md)
  `CVE-2026-101374` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 5.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101373.md)
  `CVE-2026-101373` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 2.4 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101371.md)
  `CVE-2026-101371` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 3.1 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101369.md)
  `CVE-2026-101369` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101368.md)
  `CVE-2026-101368` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101367.md)
  `CVE-2026-101367` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101364.md)
  `CVE-2026-101364` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101363.md)
  `CVE-2026-101363` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101362.md)
  `CVE-2026-101362` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 6.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101361.md)
  `CVE-2026-101361` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 4.2 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101360.md)
  `CVE-2026-101360` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101359.md)
  `CVE-2026-101359` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [A2A Java SDK has a fail-open default task authorization](https://agentprime.io/advisories/GHSA-qw47-mcm5-934w.md)
  `GHSA-qw47-mcm5-934w`, `CVE-2026-111764` · Maven `org.a2aproject.sdk:a2a-java-sdk-server-common`: affected `<1.3.0.Final`, fixed in `1.3.0.Final` · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control, CWE-1188
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113125.md)
  `CVE-2026-113125` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113013.md)
  `CVE-2026-113013` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113083.md)
  `CVE-2026-113083` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113286.md)
  `CVE-2026-113286` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113227.md)
  `CVE-2026-113227` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-113122.md)
  `CVE-2026-113122` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTIwVDIxOjAyOjUyLjU0OTAwMFoiLCJDVkUtMjAyNi0xMTMxMjIiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTIwVDIxOjIwOjU2Ljc3MzAwMFoiLCJDVkUtMjAyNi0xMDE0NTUiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTIwVDIxOjIwOjU2Ljc3MzAwMFoiLCJDVkUtMjAyNi0xMDE0NTUiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.