# Broken access control. Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [file-management-system FileController.php store unrestricted upload](https://agentprime.io/advisories/CVE-2026-114262.md) `CVE-2026-114262` · CVE record: file-management-system · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control, Unrestricted file upload - [ApostropheCMS: Missing Authentication in \`cleanExport\` Route](https://agentprime.io/advisories/GHSA-rw26-wwfc-9wvm.md) `GHSA-rw26-wwfc-9wvm`, `CVE-2026-113648` · npm `@apostrophecms/import-export`: affected `<3.7.1`, fixed in `3.7.1` · CVSS 3.1 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Authentication bypass, Broken access control - [ApostropheCMS: Import API bypasses publication roles for protected content](https://agentprime.io/advisories/GHSA-5m22-7pfq-vp65.md) `GHSA-5m22-7pfq-vp65`, `CVE-2026-113649` · npm `apostrophe` and 1 more: affected `<4.34.0`, fixed in `4.34.0` · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [ApostropheCMS: Archive duplicate continuation lets contributors overwrite published content](https://agentprime.io/advisories/GHSA-jf5h-36mg-rp6x.md) `GHSA-jf5h-36mg-rp6x`, `CVE-2026-112956` · npm `@apostrophecms/import-export`: affected `<3.7.1`, fixed in `3.7.1` · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Vite: Files outside \`server.fs.allow\` could be served when project paths match system paths on non-Windows machine](https://agentprime.io/advisories/GHSA-rq7h-c2jc-7f22.md) `GHSA-rq7h-c2jc-7f22`, `CVE-2026-112946` · npm `vite` and 1 more: affected `<6.4.4 || >=7.0.0, <7.3.7 || >=8.0.0, <8.1.6 || >=8.2.0, <8.2.4 || >=8.3.0, <8.3.3`, fixed in `6.4.4`, `7.3.7`, `8.1.6`, `8.2.4`, `8.3.3` · CVSS 6.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal, Broken access control - [oretnom23 file-management-system-php admin_class.php save_files unrestricted upload](https://agentprime.io/advisories/CVE-2026-114259.md) `CVE-2026-114259` · CVE record: oretnom23 file-management-system-php · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control, Unrestricted file upload - [OpenChoreo: Authorization bypass on WorkflowRun update allows cross-project takeover of workflow runs](https://agentprime.io/advisories/GHSA-46r4-q7wv-32fc.md) `GHSA-46r4-q7wv-32fc`, `CVE-2026-113727`, `GO-2026-6825` · Go `github.com/openchoreo/openchoreo`: affected `>=1.0.0, <1.0.6 || >=1.1.0, <1.1.7 || >=1.2.0, <1.2.5`, fixed in `1.0.6`, `1.1.7`, `1.2.5` · CVSS 7.4 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Cisco Expressway Series Software Hardening Release: October 2026 - Incorrect Permission Assignment Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76495.md) `CVE-2026-76495` · CVE record: Cisco Cisco TelePresence Video Communication Server (VCS) Expressway · CVSS 7.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Cisco Unified Communications Products Hardening Release: October 2026 - Improper Access Control Vulnerabilities](https://agentprime.io/advisories/CVE-2026-76478.md) `CVE-2026-76478` · CVE record: Cisco Cisco Emergency Responder and 3 more · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Incorrect Authorization in hMailServer](https://agentprime.io/advisories/CVE-2026-114490.md) `CVE-2026-114490` · CVE record: Progressive Robot Ltd hMailServer · CVSS 7.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Missing Authorization in hMailServer](https://agentprime.io/advisories/CVE-2026-114489.md) `CVE-2026-114489` · CVE record: Progressive Robot Ltd hMailServer · CVSS 8.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Missing Authorization in hMailServer](https://agentprime.io/advisories/CVE-2026-114477.md) `CVE-2026-114477` · CVE record: Progressive Robot Ltd hMailServer · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Incorrect Authorization in hMailServer](https://agentprime.io/advisories/CVE-2026-114476.md) `CVE-2026-114476` · CVE record: Progressive Robot Ltd hMailServer · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Missing Authorization in hMailServer](https://agentprime.io/advisories/CVE-2026-114475.md) `CVE-2026-114475` · CVE record: Progressive Robot Ltd hMailServer · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Incorrect Authorization in hMailServer](https://agentprime.io/advisories/CVE-2026-114473.md) `CVE-2026-114473` · CVE record: Progressive Robot Ltd hMailServer · CVSS 5.0 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [CVE-2026-114463](https://agentprime.io/advisories/CVE-2026-114463.md) `CVE-2026-114463` · CVE record: Nous Research Hermes Agent · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [WordPress BjornTech Swish for WooCommerce plugin <= 3.7.8 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-111835.md) `CVE-2026-111835` · CVE record: bjorntech BjornTech Swish for WooCommerce · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Missing authorization in EnterpriseDB WarehousePG](https://agentprime.io/advisories/CVE-2026-104949.md) `CVE-2026-104949` · CVE record: EnterpriseDB WarehousePG · CVSS 2.3 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Missing authorization in EnterpriseDB WarehousePG](https://agentprime.io/advisories/CVE-2026-104948.md) `CVE-2026-104948` · CVE record: EnterpriseDB WarehousePG · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Missing authorization in EnterpriseDB WarehousePG](https://agentprime.io/advisories/CVE-2026-104947.md) `CVE-2026-104947` · CVE record: EnterpriseDB WarehousePG · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [dhikshitha29 Insurance-Management-System Policy Holder Update Form UpdatePolicyHolder-inc.php improper authorization](https://agentprime.io/advisories/CVE-2026-114249.md) `CVE-2026-114249` · CVE record: dhikshitha29 Insurance-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Privilege escalation, Broken access control - [WordPress WpTravelly plugin <= 2.3.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-111849.md) `CVE-2026-111849` · CVE record: Magepeople inc. WpTravelly · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [dhikshitha29 Insurance-Management-System Add New Admin Form Admin-Register-inc.php improper authorization](https://agentprime.io/advisories/CVE-2026-114245.md) `CVE-2026-114245` · CVE record: dhikshitha29 Insurance-Management-System · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Privilege escalation, Broken access control - [Trudesk through 1.2.11 Authorization Bypass via /api/v1/messages/send](https://agentprime.io/advisories/CVE-2026-114395.md) `CVE-2026-114395` · CVE record: polonel trudesk · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Trudesk through 1.2.11 Authorization Bypass via Ticket Comment and Create APIs](https://agentprime.io/advisories/CVE-2026-114394.md) `CVE-2026-114394` · CVE record: polonel trudesk · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Trudesk through 1.2.11 Authorization Bypass via Ticket Update API Endpoints](https://agentprime.io/advisories/CVE-2026-114393.md) `CVE-2026-114393` · CVE record: polonel trudesk · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/tickets/:uid](https://agentprime.io/advisories/CVE-2026-114392.md) `CVE-2026-114392` · CVE record: polonel trudesk · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [ZenTao PMS before 22.3 Authorization Bypass via Ajax Controller Methods](https://agentprime.io/advisories/CVE-2026-114391.md) `CVE-2026-114391` · CVE record: easysoft zentaopms · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization in AJAX Handlers](https://agentprime.io/advisories/CVE-2026-114390.md) `CVE-2026-114390` · CVE record: chamilo chamilo-lms · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Chamilo LMS 2.0.0-alpha.4 before 2.0.0-RC.3 Missing Authorization via openAnswerGrade](https://agentprime.io/advisories/CVE-2026-114389.md) `CVE-2026-114389` · CVE record: chamilo chamilo-lms · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Chamilo LMS 2.0.0-alpha.1 before 2.0.0-RC.3 Missing Authorization via GradebookController](https://agentprime.io/advisories/CVE-2026-114388.md) `CVE-2026-114388` · CVE record: chamilo chamilo-lms · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Shopper 2.0.0 before 2.6.0 Privilege Escalation via Unguarded Livewire Components](https://agentprime.io/advisories/CVE-2026-114387.md) `CVE-2026-114387` · CVE record: shopperlabs shopper · CVSS 8.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [SchedulePress before 5.3.5 Missing Authorization via wpsp_el_editor_form AJAX Action](https://agentprime.io/advisories/CVE-2026-114120.md) `CVE-2026-114120` · CVE record: WPDeveloper SchedulePress · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Apache bRPC: Builtin services reachable from the public port via protobuf protocols despite ServerOptions.internal_port configuration](https://agentprime.io/advisories/CVE-2026-84748.md) `CVE-2026-84748` · CVE record: Apache Software Foundation Apache bRPC · CVSS 7.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Incorrect authorization in Acronis Cyber Infrastructure](https://agentprime.io/advisories/CVE-2026-87096.md) `CVE-2026-87096` · CVE record: Acronis Acronis Cyber Infrastructure · CVSS 3.3 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Incorrect authorization in Acronis Cyber Infrastructure](https://agentprime.io/advisories/CVE-2026-87095.md) `CVE-2026-87095` · CVE record: Acronis Acronis Cyber Infrastructure · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [OnePlus OxygenOS exposed dangerous method vulnerability](https://agentprime.io/advisories/CVE-2026-70387.md) `CVE-2026-70387` · CVE record: OnePlus OxygenOS · CVSS 8.4 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control, CWE-749 - [OnePlus OxygenOS improper neutralization of special elements vulnerability](https://agentprime.io/advisories/CVE-2026-70386.md) `CVE-2026-70386` · CVE record: OnePlus OxygenOS · CVSS 8.5 High · Not analysed yet · Published 21 Oct 2026 · Tags: Command injection, Broken access control - [CMP - Coming Soon & Maintenance 4.1.19 - 4.1.20 - Unauthenticated Maintenance Mode Bypass via Custom URL Whitelist](https://agentprime.io/advisories/CVE-2026-101138.md) `CVE-2026-101138` · CVE record: Unknown CMP – Coming Soon & Maintenance · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Merchant Credential Overwrite via Install Webhook](https://agentprime.io/advisories/CVE-2026-87838.md) `CVE-2026-87838` · CVE record: Unknown Wava Payment Plugin · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Wava Payment 0.3.1 - 0.3.9 - Unauthenticated Order Status Change via Payment Webhook](https://agentprime.io/advisories/CVE-2026-87837.md) `CVE-2026-87837` · CVE record: Unknown Wava Payment Plugin · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [TI WooCommerce Wishlist < 2.13.0 - Unauthenticated Private Wishlist Disclosure via share_key](https://agentprime.io/advisories/CVE-2026-15261.md) `CVE-2026-15261` · CVE record: Unknown TI WooCommerce Wishlist · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [SUMIT Payment Gateway for WooCommerce < 4.0.0 - Unauthenticated Payment Confirmation Forgery via Redirect Callback](https://agentprime.io/advisories/CVE-2026-111957.md) `CVE-2026-111957` · CVE record: Unknown SUMIT Payment Gateway for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Easy Pricing Tables < 4.1.3 - Contributor+ Arbitrary Post Clone and Publish via Legacy Table Duplication](https://agentprime.io/advisories/CVE-2026-111947.md) `CVE-2026-111947` · CVE record: Unknown Pricing Table WordPress Plugin · CVSS 5.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Kliken: Ads + Pixel for Meta < 1.2.3 - Unauthenticated Order Data Disclosure via IDOR](https://agentprime.io/advisories/CVE-2026-111596.md) `CVE-2026-111596` · CVE record: Unknown Kliken: Ads + Pixel for Meta · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [AI Engine < 3.8.6 - Editor+ Arbitrary Post Title and Excerpt Update via update_post_title and update_post_excerpt](https://agentprime.io/advisories/CVE-2026-110982.md) `CVE-2026-110982` · CVE record: Unknown AI Engine · CVSS 4.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [WPZOOM Portfolio < 1.4.34 - Contributor+ Arbitrary Post/Page Type Overwrite via IDOR](https://agentprime.io/advisories/CVE-2026-110514.md) `CVE-2026-110514` · CVE record: Unknown WPZOOM Portfolio Lite · CVSS 4.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Productive Commerce < 1.1.49 - Subscriber+ Arbitrary Plugin Activation](https://agentprime.io/advisories/CVE-2026-109926.md) `CVE-2026-109926` · CVE record: Unknown Productive Commerce · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [SmartyParcel < 1.23.4 - Unauthenticated Shipping Label Disclosure via IDOR](https://agentprime.io/advisories/CVE-2026-107789.md) `CVE-2026-107789` · CVE record: Unknown SmartyParcel · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [SmartyParcel (WC Ukr Shipping) < 1.23.4 - Subscriber+ Arbitrary Shipping Label Deletion](https://agentprime.io/advisories/CVE-2026-107788.md) `CVE-2026-107788` · CVE record: Unknown SmartyParcel · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Backup and Staging by WP Time Capsule < 1.22.28 - Subscriber+ Staging-to-Live Deployment via wptc_copy_stage_to_live](https://agentprime.io/advisories/CVE-2026-107237.md) `CVE-2026-107237` · CVE record: Unknown Backup and Staging by WP Time Capsule · CVSS 8.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Uncanny Toolkit for LearnDash < 3.8.2 - Admin+ Cross-Site Account Lockout via Missing Authorization](https://agentprime.io/advisories/CVE-2026-107128.md) `CVE-2026-107128` · CVE record: Unknown Uncanny Toolkit for LearnDash · CVSS 5.0 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Moloni < 5.0.14 - Subscriber+ Arbitrary Order Invoice Generation via genInvoice](https://agentprime.io/advisories/CVE-2026-106932.md) `CVE-2026-106932` · CVE record: Unknown Moloni · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Booking Package < 1.7.31 - Unauthenticated Subscription Deactivation via Missing Authorization](https://agentprime.io/advisories/CVE-2026-105998.md) `CVE-2026-105998` · CVE record: Unknown Booking Package · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Ettrick Escape Room Booking < 1.3.1 - Unauthenticated Payment Confirmation Bypass](https://agentprime.io/advisories/CVE-2026-105992.md) `CVE-2026-105992` · CVE record: Unknown Ettrick Escape Room Booking · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR](https://agentprime.io/advisories/CVE-2026-105257.md) `CVE-2026-105257` · CVE record: Unknown Appointment Booking Plugin · CVSS 2.7 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Synchrony Financing 1.0.5 - 1.1.1 - Unauthenticated Order Takeover via admin_order_callback REST Route](https://agentprime.io/advisories/CVE-2026-100145.md) `CVE-2026-100145` · CVE record: Unknown Synchrony Financing · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Incorrect authorization in OpenStack Manila](https://agentprime.io/advisories/CVE-2026-71195.md) `CVE-2026-71195` · CVE record: OpenStack Manila · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [vLLM before 0.31.0 contains a cache aliasing vulnerability that allows authenticated attackers to collide shared cache keys by supplying caller-controlled values such as EXIF ImageID or cache_salt....](https://agentprime.io/advisories/GHSA-rh6f-3x46-j33q.md) `GHSA-rh6f-3x46-j33q`, `CVE-2026-114054`, `PYSEC-2026-4362` · PyPI `vllm`: affected `<0.31.0`, fixed in `0.31.0` · CVSS 7.1 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Adm-zip before 0.6.1 Privilege Escalation via keepOriginalPermission Setuid Bits](https://agentprime.io/advisories/CVE-2026-114105.md) `CVE-2026-114105` · CVE record: cthackers adm-zip · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .