# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Improper access control in Oracle Corporation Oracle Public Sector Human Resources](https://agentprime.io/advisories/CVE-2026-101669.md)
  `CVE-2026-101669` · CVE record: Oracle Corporation Oracle Public Sector Human Resources · CVSS 6.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Customer Care](https://agentprime.io/advisories/CVE-2026-101668.md)
  `CVE-2026-101668` · CVE record: Oracle Corporation Oracle Customer Care · CVSS 6.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Trade Management](https://agentprime.io/advisories/CVE-2026-101667.md)
  `CVE-2026-101667` · CVE record: Oracle Corporation Oracle Trade Management · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Trade Management](https://agentprime.io/advisories/CVE-2026-101666.md)
  `CVE-2026-101666` · CVE record: Oracle Corporation Oracle Trade Management · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Mobile Field Service](https://agentprime.io/advisories/CVE-2026-101665.md)
  `CVE-2026-101665` · CVE record: Oracle Corporation Oracle Mobile Field Service · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Mobile Field Service](https://agentprime.io/advisories/CVE-2026-101664.md)
  `CVE-2026-101664` · CVE record: Oracle Corporation Oracle Mobile Field Service · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Mobile Field Service](https://agentprime.io/advisories/CVE-2026-101662.md)
  `CVE-2026-101662` · CVE record: Oracle Corporation Oracle Mobile Field Service · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Mobile Field Service](https://agentprime.io/advisories/CVE-2026-101661.md)
  `CVE-2026-101661` · CVE record: Oracle Corporation Oracle Mobile Field Service · CVSS 7.4 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Mobile Field Service](https://agentprime.io/advisories/CVE-2026-101660.md)
  `CVE-2026-101660` · CVE record: Oracle Corporation Oracle Mobile Field Service · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Mobile Field Service](https://agentprime.io/advisories/CVE-2026-101658.md)
  `CVE-2026-101658` · CVE record: Oracle Corporation Oracle Mobile Field Service · CVSS 7.4 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Mobile Field Service](https://agentprime.io/advisories/CVE-2026-101656.md)
  `CVE-2026-101656` · CVE record: Oracle Corporation Oracle Mobile Field Service · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Mobile Field Service](https://agentprime.io/advisories/CVE-2026-101655.md)
  `CVE-2026-101655` · CVE record: Oracle Corporation Oracle Mobile Field Service · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Mobile Field Service](https://agentprime.io/advisories/CVE-2026-101654.md)
  `CVE-2026-101654` · CVE record: Oracle Corporation Oracle Mobile Field Service · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Mobile Field Service](https://agentprime.io/advisories/CVE-2026-101653.md)
  `CVE-2026-101653` · CVE record: Oracle Corporation Oracle Mobile Field Service · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Partner Management](https://agentprime.io/advisories/CVE-2026-101651.md)
  `CVE-2026-101651` · CVE record: Oracle Corporation Oracle Partner Management · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Partner Management](https://agentprime.io/advisories/CVE-2026-101650.md)
  `CVE-2026-101650` · CVE record: Oracle Corporation Oracle Partner Management · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Partner Management](https://agentprime.io/advisories/CVE-2026-101649.md)
  `CVE-2026-101649` · CVE record: Oracle Corporation Oracle Partner Management · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Partner Management](https://agentprime.io/advisories/CVE-2026-101648.md)
  `CVE-2026-101648` · CVE record: Oracle Corporation Oracle Partner Management · CVSS 8.4 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle iSetup](https://agentprime.io/advisories/CVE-2026-101647.md)
  `CVE-2026-101647` · CVE record: Oracle Corporation Oracle iSetup · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle iSetup](https://agentprime.io/advisories/CVE-2026-101646.md)
  `CVE-2026-101646` · CVE record: Oracle Corporation Oracle iSetup · CVSS 7.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle iSetup](https://agentprime.io/advisories/CVE-2026-101645.md)
  `CVE-2026-101645` · CVE record: Oracle Corporation Oracle iSetup · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Mobile Field Service](https://agentprime.io/advisories/CVE-2026-101644.md)
  `CVE-2026-101644` · CVE record: Oracle Corporation Oracle Mobile Field Service · CVSS 6.6 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Sales Online](https://agentprime.io/advisories/CVE-2026-101643.md)
  `CVE-2026-101643` · CVE record: Oracle Corporation Oracle Sales Online · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Report Manager](https://agentprime.io/advisories/CVE-2026-101642.md)
  `CVE-2026-101642` · CVE record: Oracle Corporation Oracle Report Manager · CVSS 7.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Report Manager](https://agentprime.io/advisories/CVE-2026-101641.md)
  `CVE-2026-101641` · CVE record: Oracle Corporation Oracle Report Manager · CVSS 7.6 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Marketing](https://agentprime.io/advisories/CVE-2026-101640.md)
  `CVE-2026-101640` · CVE record: Oracle Corporation Oracle Marketing · CVSS 8.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Marketing](https://agentprime.io/advisories/CVE-2026-101639.md)
  `CVE-2026-101639` · CVE record: Oracle Corporation Oracle Marketing · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Applications DBA](https://agentprime.io/advisories/CVE-2026-101638.md)
  `CVE-2026-101638` · CVE record: Oracle Corporation Applications DBA · CVSS 7.3 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Server and others](https://agentprime.io/advisories/CVE-2026-101637.md)
  `CVE-2026-101637` · CVE record: Oracle Corporation MySQL Server and 1 more · CVSS 5.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Mobile Field Service](https://agentprime.io/advisories/CVE-2026-101636.md)
  `CVE-2026-101636` · CVE record: Oracle Corporation Oracle Mobile Field Service · CVSS 7.4 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Mobile Field Service](https://agentprime.io/advisories/CVE-2026-101635.md)
  `CVE-2026-101635` · CVE record: Oracle Corporation Oracle Mobile Field Service · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Mobile Field Service](https://agentprime.io/advisories/CVE-2026-101634.md)
  `CVE-2026-101634` · CVE record: Oracle Corporation Oracle Mobile Field Service · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Router](https://agentprime.io/advisories/CVE-2026-101633.md)
  `CVE-2026-101633` · CVE record: Oracle Corporation MySQL Router · CVSS 4.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Router](https://agentprime.io/advisories/CVE-2026-101632.md)
  `CVE-2026-101632` · CVE record: Oracle Corporation MySQL Router · CVSS 4.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Router](https://agentprime.io/advisories/CVE-2026-101631.md)
  `CVE-2026-101631` · CVE record: Oracle Corporation MySQL Router · CVSS 6.8 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Advanced Outbound Telephony](https://agentprime.io/advisories/CVE-2026-101630.md)
  `CVE-2026-101630` · CVE record: Oracle Corporation Oracle Advanced Outbound Telephony · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Server and others](https://agentprime.io/advisories/CVE-2026-101629.md)
  `CVE-2026-101629` · CVE record: Oracle Corporation MySQL Server and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Cluster](https://agentprime.io/advisories/CVE-2026-101628.md)
  `CVE-2026-101628` · CVE record: Oracle Corporation MySQL Cluster · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Server and others](https://agentprime.io/advisories/CVE-2026-101627.md)
  `CVE-2026-101627` · CVE record: Oracle Corporation MySQL Server and 1 more · CVSS 4.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Connectors](https://agentprime.io/advisories/CVE-2026-101626.md)
  `CVE-2026-101626` · CVE record: Oracle Corporation MySQL Connectors · CVSS 5.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Connectors](https://agentprime.io/advisories/CVE-2026-101625.md)
  `CVE-2026-101625` · CVE record: Oracle Corporation MySQL Connectors · CVSS 4.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Server and others](https://agentprime.io/advisories/CVE-2026-101624.md)
  `CVE-2026-101624` · CVE record: Oracle Corporation MySQL Server and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Server and others](https://agentprime.io/advisories/CVE-2026-101623.md)
  `CVE-2026-101623` · CVE record: Oracle Corporation MySQL Server and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Server and others](https://agentprime.io/advisories/CVE-2026-101622.md)
  `CVE-2026-101622` · CVE record: Oracle Corporation MySQL Server and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Server and others](https://agentprime.io/advisories/CVE-2026-101621.md)
  `CVE-2026-101621` · CVE record: Oracle Corporation MySQL Server and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Server and others](https://agentprime.io/advisories/CVE-2026-101620.md)
  `CVE-2026-101620` · CVE record: Oracle Corporation MySQL Server and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Server and others](https://agentprime.io/advisories/CVE-2026-101619.md)
  `CVE-2026-101619` · CVE record: Oracle Corporation MySQL Server and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation MySQL Server and others](https://agentprime.io/advisories/CVE-2026-101618.md)
  `CVE-2026-101618` · CVE record: Oracle Corporation MySQL Server and 1 more · CVSS 4.9 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Communications Unified Inventory Management](https://agentprime.io/advisories/CVE-2026-101604.md)
  `CVE-2026-101604` · CVE record: Oracle Corporation Oracle Communications Unified Inventory Management · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Communications Unified Inventory Management](https://agentprime.io/advisories/CVE-2026-101603.md)
  `CVE-2026-101603` · CVE record: Oracle Corporation Oracle Communications Unified Inventory Management · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-101602.md)
  `CVE-2026-101602` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 8.0 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle GoldenGate](https://agentprime.io/advisories/CVE-2026-101601.md)
  `CVE-2026-101601` · CVE record: Oracle Corporation Oracle GoldenGate · CVSS 5.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle TimesTen In-Memory Database](https://agentprime.io/advisories/CVE-2026-101600.md)
  `CVE-2026-101600` · CVE record: Oracle Corporation Oracle TimesTen In-Memory Database · CVSS 3.6 Low · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle VM VirtualBox](https://agentprime.io/advisories/CVE-2026-101599.md)
  `CVE-2026-101599` · CVE record: Oracle Corporation Oracle VM VirtualBox · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle VM VirtualBox](https://agentprime.io/advisories/CVE-2026-101598.md)
  `CVE-2026-101598` · CVE record: Oracle Corporation Oracle VM VirtualBox · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-101596.md)
  `CVE-2026-101596` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-101594.md)
  `CVE-2026-101594` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-101592.md)
  `CVE-2026-101592` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Utilities Network Management System](https://agentprime.io/advisories/CVE-2026-101589.md)
  `CVE-2026-101589` · CVE record: Oracle Corporation Oracle Utilities Network Management System · CVSS 5.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Helidon](https://agentprime.io/advisories/CVE-2026-101581.md)
  `CVE-2026-101581` · CVE record: Oracle Corporation Helidon · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTIwVDIxOjIxOjQwLjk2NDAwMFoiLCJDVkUtMjAyNi0xMDE1ODEiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTIwVDIxOjIyOjEzLjA2MjAwMFoiLCJDVkUtMjAyNi0xMDE2NzAiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTIwVDIxOjIyOjEzLjA2MjAwMFoiLCJDVkUtMjAyNi0xMDE2NzAiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.