# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Trigger.dev before 4.5.0 Cross-Tenant Run Payload Disclosure via API Replay Route](https://agentprime.io/advisories/CVE-2026-114091.md)
  `CVE-2026-114091` · CVE record: triggerdotdev trigger.dev · CVSS 6.0 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev before 4.6.2 Overly Broad Realtime Session Stream Credentials](https://agentprime.io/advisories/CVE-2026-114082.md)
  `CVE-2026-114082` · CVE record: triggerdotdev trigger.dev · CVSS 7.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev before 4.5.6 Cross-Organization Schedule Deletion via Unscoped friendlyId Lookup](https://agentprime.io/advisories/CVE-2026-114078.md)
  `CVE-2026-114078` · CVE record: triggerdotdev trigger.dev · CVSS 7.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev before 4.5.6 Cross-Tenant Deployment Hijack via createDeploymentBackgroundWorkerV4](https://agentprime.io/advisories/CVE-2026-114077.md)
  `CVE-2026-114077` · CVE record: triggerdotdev trigger.dev · CVSS 6.1 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev before 4.5.12 Authorization Bypass via Alert Channels API](https://agentprime.io/advisories/CVE-2026-114075.md)
  `CVE-2026-114075` · CVE record: triggerdotdev trigger.dev · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev before 4.5.12 Authorization Bypass via Waitpoint Complete Route](https://agentprime.io/advisories/CVE-2026-114071.md)
  `CVE-2026-114071` · CVE record: triggerdotdev trigger.dev · CVSS 2.3 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev before 4.6.0 Missing Authorization via Waitpoint Token Wait Endpoint](https://agentprime.io/advisories/CVE-2026-114068.md)
  `CVE-2026-114068` · CVE record: triggerdotdev trigger.dev · CVSS 7.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev 4.5.0 before 4.6.2 Improper Authorization via snapshot-url Session Route](https://agentprime.io/advisories/CVE-2026-114067.md)
  `CVE-2026-114067` · CVE record: triggerdotdev trigger.dev · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [Trigger.dev before 4.7.0 Missing Authorization via Batch parentRunId Waitpoints](https://agentprime.io/advisories/CVE-2026-114066.md)
  `CVE-2026-114066` · CVE record: triggerdotdev trigger.dev · CVSS 7.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [ArcadeDB before 26.10.1 RCE via Gremlin Groovy Engine Missing Authorization](https://agentprime.io/advisories/CVE-2026-114059.md)
  `CVE-2026-114059` · CVE record: ArcadeData arcadedb · CVSS 7.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [ArcadeDB from 26.2.1 before 26.10.1 Missing Authorization via Bolt Protocol](https://agentprime.io/advisories/CVE-2026-114058.md)
  `CVE-2026-114058` · CVE record: ArcadeData arcadedb · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [ArcadeDB 26.2.1 before 26.10.1 Bolt SHOW DATABASES Information Disclosure](https://agentprime.io/advisories/CVE-2026-114057.md)
  `CVE-2026-114057` · CVE record: ArcadeData arcadedb · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [ArcadeDB from 26.8.1 before 26.10.1 Authorization Bypass via ALTER TYPE WITH](https://agentprime.io/advisories/CVE-2026-114056.md)
  `CVE-2026-114056` · CVE record: ArcadeData arcadedb · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control
- [a2aproject a2a-rs inmemory.rs information disclosure](https://agentprime.io/advisories/CVE-2026-113706.md)
  `CVE-2026-113706` · CVE record: a2aproject a2a-rs · CVSS 5.1 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Information disclosure, Broken access control
- [DataStage on Cloud Pak for Data Improper Authorization](https://agentprime.io/advisories/CVE-2026-81212.md)
  `CVE-2026-81212` · CVE record: IBM DataStage on Cloud Pak for Data · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91663.md)
  `CVE-2026-91663` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91662.md)
  `CVE-2026-91662` · CVE record: Oracle Corporation Oracle Essbase · CVSS 6.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91659.md)
  `CVE-2026-91659` · CVE record: Oracle Corporation Oracle Essbase · CVSS 7.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91658.md)
  `CVE-2026-91658` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91656.md)
  `CVE-2026-91656` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91655.md)
  `CVE-2026-91655` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91654.md)
  `CVE-2026-91654` · CVE record: Oracle Corporation Oracle Essbase · CVSS 6.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91653.md)
  `CVE-2026-91653` · CVE record: Oracle Corporation Oracle Essbase · CVSS 8.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91651.md)
  `CVE-2026-91651` · CVE record: Oracle Corporation Oracle Essbase · CVSS 8.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91647.md)
  `CVE-2026-91647` · CVE record: Oracle Corporation Oracle Essbase · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91646.md)
  `CVE-2026-91646` · CVE record: Oracle Corporation Oracle Essbase · CVSS 5.6 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91644.md)
  `CVE-2026-91644` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91642.md)
  `CVE-2026-91642` · CVE record: Oracle Corporation Oracle Essbase · CVSS 7.3 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91638.md)
  `CVE-2026-91638` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91637.md)
  `CVE-2026-91637` · CVE record: Oracle Corporation Oracle Essbase · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91635.md)
  `CVE-2026-91635` · CVE record: Oracle Corporation Oracle Essbase · CVSS 8.1 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Essbase](https://agentprime.io/advisories/CVE-2026-91633.md)
  `CVE-2026-91633` · CVE record: Oracle Corporation Oracle Essbase · CVSS 6.0 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-91623.md)
  `CVE-2026-91623` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 7.4 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-91622.md)
  `CVE-2026-91622` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Database Server](https://agentprime.io/advisories/CVE-2026-91615.md)
  `CVE-2026-91615` · CVE record: Oracle Corporation Oracle Database Server · CVSS 6.3 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle REST Data Services](https://agentprime.io/advisories/CVE-2026-91610.md)
  `CVE-2026-91610` · CVE record: Oracle Corporation Oracle REST Data Services · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-91604.md)
  `CVE-2026-91604` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 7.5 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Business Intelligence Enterprise Edition](https://agentprime.io/advisories/CVE-2026-91597.md)
  `CVE-2026-91597` · CVE record: Oracle Corporation Oracle Business Intelligence Enterprise Edition · CVSS 8.3 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle BI Publisher](https://agentprime.io/advisories/CVE-2026-91590.md)
  `CVE-2026-91590` · CVE record: Oracle Corporation Oracle BI Publisher · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Business Intelligence Enterprise Edition](https://agentprime.io/advisories/CVE-2026-91577.md)
  `CVE-2026-91577` · CVE record: Oracle Corporation Oracle Business Intelligence Enterprise Edition · CVSS 6.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Business Intelligence Enterprise Edition](https://agentprime.io/advisories/CVE-2026-91576.md)
  `CVE-2026-91576` · CVE record: Oracle Corporation Oracle Business Intelligence Enterprise Edition · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle BI Publisher](https://agentprime.io/advisories/CVE-2026-91574.md)
  `CVE-2026-91574` · CVE record: Oracle Corporation Oracle BI Publisher · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Database Server](https://agentprime.io/advisories/CVE-2026-91568.md)
  `CVE-2026-91568` · CVE record: Oracle Corporation Oracle Database Server · CVSS 7.7 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-91565.md)
  `CVE-2026-91565` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 6.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise FIN Inventory Brazil](https://agentprime.io/advisories/CVE-2026-91562.md)
  `CVE-2026-91562` · CVE record: Oracle Corporation PeopleSoft Enterprise FIN Inventory Brazil · CVSS 4.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise FIN Manufacturing Brazil](https://agentprime.io/advisories/CVE-2026-91559.md)
  `CVE-2026-91559` · CVE record: Oracle Corporation PeopleSoft Enterprise FIN Manufacturing Brazil · CVSS 4.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle BI Publisher](https://agentprime.io/advisories/CVE-2026-91554.md)
  `CVE-2026-91554` · CVE record: Oracle Corporation Oracle BI Publisher · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise FIN Product Configurator Brazil](https://agentprime.io/advisories/CVE-2026-91553.md)
  `CVE-2026-91553` · CVE record: Oracle Corporation PeopleSoft Enterprise FIN Product Configurator Brazil · CVSS 4.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-91550.md)
  `CVE-2026-91550` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Business Intelligence Enterprise Edition](https://agentprime.io/advisories/CVE-2026-91545.md)
  `CVE-2026-91545` · CVE record: Oracle Corporation Oracle Business Intelligence Enterprise Edition · CVSS 7.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise FIN Common Objects Brazil](https://agentprime.io/advisories/CVE-2026-91541.md)
  `CVE-2026-91541` · CVE record: Oracle Corporation PeopleSoft Enterprise FIN Common Objects Brazil · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle SOA Suite](https://agentprime.io/advisories/CVE-2026-91536.md)
  `CVE-2026-91536` · CVE record: Oracle Corporation Oracle SOA Suite · CVSS 5.0 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle GoldenGate](https://agentprime.io/advisories/CVE-2026-91530.md)
  `CVE-2026-91530` · CVE record: Oracle Corporation Oracle GoldenGate · CVSS 4.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle ZFS Storage Appliance Kit](https://agentprime.io/advisories/CVE-2026-91527.md)
  `CVE-2026-91527` · CVE record: Oracle Corporation Oracle ZFS Storage Appliance Kit · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Business Intelligence Enterprise Edition](https://agentprime.io/advisories/CVE-2026-91523.md)
  `CVE-2026-91523` · CVE record: Oracle Corporation Oracle Business Intelligence Enterprise Edition · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-91520.md)
  `CVE-2026-91520` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 8.8 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation PeopleSoft Enterprise PeopleTools](https://agentprime.io/advisories/CVE-2026-91519.md)
  `CVE-2026-91519` · CVE record: Oracle Corporation PeopleSoft Enterprise PeopleTools · CVSS 6.5 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle BI Publisher](https://agentprime.io/advisories/CVE-2026-91518.md)
  `CVE-2026-91518` · CVE record: Oracle Corporation Oracle BI Publisher · CVSS 5.4 Medium · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Management Pack for Oracle GoldenGate](https://agentprime.io/advisories/CVE-2026-91517.md)
  `CVE-2026-91517` · CVE record: Oracle Corporation Oracle Management Pack for Oracle GoldenGate · CVSS 8.0 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control
- [Improper access control in Oracle Corporation Oracle Agile Product Lifecycle Management for Process](https://agentprime.io/advisories/CVE-2026-91512.md)
  `CVE-2026-91512` · CVE record: Oracle Corporation Oracle Agile Product Lifecycle Management for Process · CVSS 7.2 High · Not analysed yet · Published 20 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTIwVDIxOjI2OjIwLjM0MDAwMFoiLCJDVkUtMjAyNi05MTUxMiJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTIxVDAwOjM3OjA2LjAxODAwMFoiLCJDVkUtMjAyNi0xMTQxMDUiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTIxVDAwOjM3OjA2LjAxODAwMFoiLCJDVkUtMjAyNi0xMTQxMDUiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.