# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Improper access control in Oracle Corporation Helidon](https://agentprime.io/advisories/CVE-2026-101573.md)
  `CVE-2026-101573` · CVE record: Oracle Corporation Helidon · CVSS 6.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Helidon](https://agentprime.io/advisories/CVE-2026-101571.md)
  `CVE-2026-101571` · CVE record: Oracle Corporation Helidon · CVSS 5.6 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Helidon](https://agentprime.io/advisories/CVE-2026-101569.md)
  `CVE-2026-101569` · CVE record: Oracle Corporation Helidon · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Cost Management](https://agentprime.io/advisories/CVE-2026-101567.md)
  `CVE-2026-101567` · CVE record: Oracle Corporation Oracle Cost Management · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Application Object Library](https://agentprime.io/advisories/CVE-2026-101566.md)
  `CVE-2026-101566` · CVE record: Oracle Corporation Oracle Application Object Library · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Commerce Platform](https://agentprime.io/advisories/CVE-2026-101560.md)
  `CVE-2026-101560` · CVE record: Oracle Corporation Oracle Commerce Platform · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Oracle Corporation Oracle Purchasing](https://agentprime.io/advisories/CVE-2026-101559.md)
  `CVE-2026-101559` · CVE record: Oracle Corporation Oracle Purchasing · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Purchasing](https://agentprime.io/advisories/CVE-2026-101557.md)
  `CVE-2026-101557` · CVE record: Oracle Corporation Oracle Purchasing · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Payroll](https://agentprime.io/advisories/CVE-2026-101556.md)
  `CVE-2026-101556` · CVE record: Oracle Corporation Oracle Payroll · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Payroll](https://agentprime.io/advisories/CVE-2026-101555.md)
  `CVE-2026-101555` · CVE record: Oracle Corporation Oracle Payroll · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Payroll](https://agentprime.io/advisories/CVE-2026-101554.md)
  `CVE-2026-101554` · CVE record: Oracle Corporation Oracle Payroll · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Oracle Corporation Oracle Payroll](https://agentprime.io/advisories/CVE-2026-101553.md)
  `CVE-2026-101553` · CVE record: Oracle Corporation Oracle Payroll · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Application Object Library](https://agentprime.io/advisories/CVE-2026-101552.md)
  `CVE-2026-101552` · CVE record: Oracle Corporation Oracle Application Object Library · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Materials Requirement Planning](https://agentprime.io/advisories/CVE-2026-101546.md)
  `CVE-2026-101546` · CVE record: Oracle Corporation Oracle Materials Requirement Planning · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Capacity](https://agentprime.io/advisories/CVE-2026-101543.md)
  `CVE-2026-101543` · CVE record: Oracle Corporation Oracle Capacity · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Capacity](https://agentprime.io/advisories/CVE-2026-101542.md)
  `CVE-2026-101542` · CVE record: Oracle Corporation Oracle Capacity · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Oracle Corporation Oracle Payroll](https://agentprime.io/advisories/CVE-2026-101539.md)
  `CVE-2026-101539` · CVE record: Oracle Corporation Oracle Payroll · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Oracle Corporation Oracle Order Management](https://agentprime.io/advisories/CVE-2026-101538.md)
  `CVE-2026-101538` · CVE record: Oracle Corporation Oracle Order Management · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Cost Management](https://agentprime.io/advisories/CVE-2026-101536.md)
  `CVE-2026-101536` · CVE record: Oracle Corporation Oracle Cost Management · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Sales Foundation](https://agentprime.io/advisories/CVE-2026-101535.md)
  `CVE-2026-101535` · CVE record: Oracle Corporation Oracle Sales Foundation · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle EDI Gateway](https://agentprime.io/advisories/CVE-2026-101534.md)
  `CVE-2026-101534` · CVE record: Oracle Corporation Oracle EDI Gateway · CVSS 8.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle EDI Gateway](https://agentprime.io/advisories/CVE-2026-101533.md)
  `CVE-2026-101533` · CVE record: Oracle Corporation Oracle EDI Gateway · CVSS 6.6 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle EDI Gateway](https://agentprime.io/advisories/CVE-2026-101532.md)
  `CVE-2026-101532` · CVE record: Oracle Corporation Oracle EDI Gateway · CVSS 7.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass
- [Improper access control in Oracle Corporation Oracle Enterprise Manager for Oracle Database](https://agentprime.io/advisories/CVE-2026-101529.md)
  `CVE-2026-101529` · CVE record: Oracle Corporation Oracle Enterprise Manager for Oracle Database · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Enterprise Manager for Oracle Database](https://agentprime.io/advisories/CVE-2026-101528.md)
  `CVE-2026-101528` · CVE record: Oracle Corporation Oracle Enterprise Manager for Oracle Database · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Enterprise Manager for Siebel](https://agentprime.io/advisories/CVE-2026-101526.md)
  `CVE-2026-101526` · CVE record: Oracle Corporation Oracle Enterprise Manager for Siebel · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Enterprise Manager for Siebel](https://agentprime.io/advisories/CVE-2026-101525.md)
  `CVE-2026-101525` · CVE record: Oracle Corporation Oracle Enterprise Manager for Siebel · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle TimesTen In-Memory Database](https://agentprime.io/advisories/CVE-2026-101522.md)
  `CVE-2026-101522` · CVE record: Oracle Corporation Oracle TimesTen In-Memory Database · CVSS 5.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle EDI Gateway](https://agentprime.io/advisories/CVE-2026-101519.md)
  `CVE-2026-101519` · CVE record: Oracle Corporation Oracle EDI Gateway · CVSS 7.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Privilege escalation, Broken access control, Authentication bypass
- [Improper access control in Oracle Corporation Oracle Enterprise Manager Base Platform](https://agentprime.io/advisories/CVE-2026-101518.md)
  `CVE-2026-101518` · CVE record: Oracle Corporation Oracle Enterprise Manager Base Platform · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Utilities Network Management System](https://agentprime.io/advisories/CVE-2026-101517.md)
  `CVE-2026-101517` · CVE record: Oracle Corporation Oracle Utilities Network Management System · CVSS 5.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Java SE and others](https://agentprime.io/advisories/CVE-2026-101516.md)
  `CVE-2026-101516` · CVE record: Oracle Corporation Oracle Java SE and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Information disclosure in Oracle Corporation Oracle WebLogic Server](https://agentprime.io/advisories/CVE-2026-101515.md)
  `CVE-2026-101515` · CVE record: Oracle Corporation Oracle WebLogic Server · CVSS 5.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure, Broken access control
- [Improper access control in Oracle Corporation Oracle Database Server](https://agentprime.io/advisories/CVE-2026-101512.md)
  `CVE-2026-101512` · CVE record: Oracle Corporation Oracle Database Server · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Trusted Answer Search](https://agentprime.io/advisories/CVE-2026-101505.md)
  `CVE-2026-101505` · CVE record: Oracle Corporation Oracle Trusted Answer Search · CVSS 8.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Trusted Answer Search](https://agentprime.io/advisories/CVE-2026-101503.md)
  `CVE-2026-101503` · CVE record: Oracle Corporation Oracle Trusted Answer Search · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Global Lifecycle Management OPatchAuto](https://agentprime.io/advisories/CVE-2026-101500.md)
  `CVE-2026-101500` · CVE record: Oracle Corporation Oracle Global Lifecycle Management OPatchAuto · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-101493.md)
  `CVE-2026-101493` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM Integration](https://agentprime.io/advisories/CVE-2026-101492.md)
  `CVE-2026-101492` · CVE record: Oracle Corporation Siebel CRM Integration · CVSS 4.7 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control, Cross-site request forgery (CSRF)
- [Incorrect authorization in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101491.md)
  `CVE-2026-101491` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 5.0 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101489.md)
  `CVE-2026-101489` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 4.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101487.md)
  `CVE-2026-101487` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-101486.md)
  `CVE-2026-101486` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Autonomous Health Framework](https://agentprime.io/advisories/CVE-2026-101485.md)
  `CVE-2026-101485` · CVE record: Oracle Corporation Oracle Autonomous Health Framework · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Secure Backup](https://agentprime.io/advisories/CVE-2026-101482.md)
  `CVE-2026-101482` · CVE record: Oracle Corporation Oracle Secure Backup · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Secure Backup](https://agentprime.io/advisories/CVE-2026-101481.md)
  `CVE-2026-101481` · CVE record: Oracle Corporation Oracle Secure Backup · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authorization in Oracle Corporation Siebel Apps - Marketing](https://agentprime.io/advisories/CVE-2026-101476.md)
  `CVE-2026-101476` · CVE record: Oracle Corporation Siebel Apps - Marketing · CVSS 4.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Missing authentication in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-101473.md)
  `CVE-2026-101473` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control, Authentication bypass
- [Incorrect default permissions in Oracle Corporation Oracle Product Lifecycle Analytics](https://agentprime.io/advisories/CVE-2026-101472.md)
  `CVE-2026-101472` · CVE record: Oracle Corporation Oracle Product Lifecycle Analytics · CVSS 5.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Product Lifecycle Analytics](https://agentprime.io/advisories/CVE-2026-101470.md)
  `CVE-2026-101470` · CVE record: Oracle Corporation Oracle Product Lifecycle Analytics · CVSS 6.0 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM End User](https://agentprime.io/advisories/CVE-2026-101467.md)
  `CVE-2026-101467` · CVE record: Oracle Corporation Siebel CRM End User · CVSS 7.4 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM Deployment](https://agentprime.io/advisories/CVE-2026-101465.md)
  `CVE-2026-101465` · CVE record: Oracle Corporation Siebel CRM Deployment · CVSS 6.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM Deployment](https://agentprime.io/advisories/CVE-2026-101464.md)
  `CVE-2026-101464` · CVE record: Oracle Corporation Siebel CRM Deployment · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM End User](https://agentprime.io/advisories/CVE-2026-101463.md)
  `CVE-2026-101463` · CVE record: Oracle Corporation Siebel CRM End User · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM Deployment](https://agentprime.io/advisories/CVE-2026-101462.md)
  `CVE-2026-101462` · CVE record: Oracle Corporation Siebel CRM Deployment · CVSS 5.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM Deployment](https://agentprime.io/advisories/CVE-2026-101460.md)
  `CVE-2026-101460` · CVE record: Oracle Corporation Siebel CRM Deployment · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM Deployment](https://agentprime.io/advisories/CVE-2026-101458.md)
  `CVE-2026-101458` · CVE record: Oracle Corporation Siebel CRM Deployment · CVSS 8.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel Apps - Life Sciences](https://agentprime.io/advisories/CVE-2026-101457.md)
  `CVE-2026-101457` · CVE record: Oracle Corporation Siebel Apps - Life Sciences · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM Development](https://agentprime.io/advisories/CVE-2026-101456.md)
  `CVE-2026-101456` · CVE record: Oracle Corporation Siebel CRM Development · CVSS 6.0 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Siebel CRM Development](https://agentprime.io/advisories/CVE-2026-101455.md)
  `CVE-2026-101455` · CVE record: Oracle Corporation Siebel CRM Development · CVSS 6.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTIwVDIxOjIwOjU2Ljc3MzAwMFoiLCJDVkUtMjAyNi0xMDE0NTUiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTIwVDIxOjIxOjQwLjk2NDAwMFoiLCJDVkUtMjAyNi0xMDE1ODEiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTIwVDIxOjIxOjQwLjk2NDAwMFoiLCJDVkUtMjAyNi0xMDE1ODEiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.