# Broken access control. Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first. ## Records, newest first (an older page) - [WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php](https://agentprime.io/advisories/CVE-2026-114633.md) `CVE-2026-114633` · CVE record: WWBN AVideo · CVSS 7.0 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Incorrect authorization in Roundcube Webmail](https://agentprime.io/advisories/CVE-2026-114721.md) `CVE-2026-114721` · CVE record: Roundcube Webmail · CVSS 3.1 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118](https://agentprime.io/advisories/CVE-2026-84910.md) `CVE-2026-84910` · CVE record: Drupal Advanced Search · CVSS 4.2 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120](https://agentprime.io/advisories/CVE-2026-84912.md) `CVE-2026-84912` · CVE record: Drupal AI (Artificial Intelligence) · CVSS 4.6 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121](https://agentprime.io/advisories/CVE-2026-84913.md) `CVE-2026-84913` · CVE record: Drupal AI Translate · CVSS 4.6 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122](https://agentprime.io/advisories/CVE-2026-84914.md) `CVE-2026-84914` · CVE record: Drupal Calculate Working Days · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126](https://agentprime.io/advisories/CVE-2026-84916.md) `CVE-2026-84916` · CVE record: Drupal Islandora · CVSS 3.7 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127](https://agentprime.io/advisories/CVE-2026-84917.md) `CVE-2026-84917` · CVE record: Drupal Jsonapi Role Access · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132](https://agentprime.io/advisories/CVE-2026-84920.md) `CVE-2026-84920` · CVE record: Drupal Unpublished Node Permissions · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133](https://agentprime.io/advisories/CVE-2026-84921.md) `CVE-2026-84921` · CVE record: Drupal Webform Submissions Delete · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141](https://agentprime.io/advisories/CVE-2026-87943.md) `CVE-2026-87943` · CVE record: Drupal SAML SSO - Service Provider · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152](https://agentprime.io/advisories/CVE-2026-87954.md) `CVE-2026-87954` · CVE record: Drupal Taxonomy Term Glossary · CVSS 4.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153](https://agentprime.io/advisories/CVE-2026-87955.md) `CVE-2026-87955` · CVE record: Drupal Ultimate Table Field · CVSS 4.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164](https://agentprime.io/advisories/CVE-2026-96370.md) `CVE-2026-96370` · CVE record: Drupal Webform · CVSS 5.4 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168](https://agentprime.io/advisories/CVE-2026-96373.md) `CVE-2026-96373` · CVE record: Drupal Webform · CVSS 3.3 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169](https://agentprime.io/advisories/CVE-2026-96366.md) `CVE-2026-96366` · CVE record: Drupal Webform · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Webform - Less critical - Access bypass - SA-CONTRIB-2026-173](https://agentprime.io/advisories/CVE-2026-96398.md) `CVE-2026-96398` · CVE record: Drupal Webform · CVSS 4.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174](https://agentprime.io/advisories/CVE-2026-96356.md) `CVE-2026-96356` · CVE record: Drupal Webform · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179](https://agentprime.io/advisories/CVE-2026-96378.md) `CVE-2026-96378` · CVE record: Drupal Commerce Decoupled Checkout · CVSS 4.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180](https://agentprime.io/advisories/CVE-2026-96384.md) `CVE-2026-96384` · CVE record: Drupal Mermaid Diagram Field · CVSS 3.5 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186](https://agentprime.io/advisories/CVE-2026-96391.md) `CVE-2026-96391` · CVE record: Drupal Webform REST · CVSS 4.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189](https://agentprime.io/advisories/CVE-2026-96380.md) `CVE-2026-96380` · CVE record: Drupal CSS Usage Analyzer · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190](https://agentprime.io/advisories/CVE-2026-96386.md) `CVE-2026-96386` · CVE record: Drupal Smart Content · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [Incorrect authorization in Roundcube Webmail](https://agentprime.io/advisories/CVE-2026-114715.md) `CVE-2026-114715` · CVE record: Roundcube Webmail · CVSS 6.8 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control - [massCodeIO massCode Local HTTP Service index.ts information disclosure](https://agentprime.io/advisories/CVE-2026-114574.md) `CVE-2026-114574` · CVE record: massCodeIO massCode · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Information disclosure, Broken access control - [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-12664.md) `CVE-2026-12664` · CVE record: GitLab GitLab · CVSS 6.8 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Authorization Bypass Through User-Controlled Key in GitLab](https://agentprime.io/advisories/CVE-2026-13319.md) `CVE-2026-13319` · CVE record: GitLab GitLab · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-16255.md) `CVE-2026-16255` · CVE record: GitLab GitLab · CVSS 5.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Incorrect Authorization in GitLab](https://agentprime.io/advisories/CVE-2026-103515.md) `CVE-2026-103515` · CVE record: GitLab GitLab · CVSS 2.7 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Improper Access Control in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76407.md) `CVE-2026-76407` · CVE record: Splunk Splunk SOAR · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Missing Authorization through the REST API in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76308.md) `CVE-2026-76308` · CVE record: Splunk Splunk SOAR · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Improper Access Control during App Downloads in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76305.md) `CVE-2026-76305` · CVE record: Splunk Splunk SOAR · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR](https://agentprime.io/advisories/CVE-2026-76304.md) `CVE-2026-76304` · CVE record: Splunk Splunk SOAR · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Security Hardening in Splunk Enterprise - October 2026](https://agentprime.io/advisories/CVE-2026-76299.md) `CVE-2026-76299` · CVE record: Splunk Splunk Enterprise · CVSS 9.9 Critical · Critical (CVSS 9+) · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76296.md) `CVE-2026-76296` · CVE record: Splunk Splunk Enterprise · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Improper Access Control in Field Extraction Management in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76294.md) `CVE-2026-76294` · CVE record: Splunk Splunk Enterprise · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Missing Authorization through REST API Endpoints in Splunk Secure Gateway](https://agentprime.io/advisories/CVE-2026-76292.md) `CVE-2026-76292` · CVE record: Splunk Splunk Enterprise and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Improper Access Control through Scheduled Search Safeguards in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76291.md) `CVE-2026-76291` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Authorization Bypass in the Data Management REST API in Splunk Enterprise](https://agentprime.io/advisories/CVE-2026-76287.md) `CVE-2026-76287` · CVE record: Splunk Splunk Enterprise · CVSS 5.4 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs](https://agentprime.io/advisories/GHSA-3x84-qq85-fj65.md) `GHSA-3x84-qq85-fj65`, `CVE-2026-62197` · npm `openclaw`: affected `<2026.6.6`, fixed in `2026.6.6` · CVSS 6.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control, Server-side request forgery (SSRF) - [Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials](https://agentprime.io/advisories/CVE-2026-111812.md) `CVE-2026-111812` · CVE record: Apache Software Foundation Apache Traffic Server · CVSS 7.0 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [HarnessRouter Identity Mode app.py improper authorization](https://agentprime.io/advisories/CVE-2026-114361.md) `CVE-2026-114361` · CVE record: HarnessRouter · CVSS 6.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Privilege escalation, Broken access control - [SourceCodester Food Order Management System Admin Endpoint authorization](https://agentprime.io/advisories/CVE-2026-114267.md) `CVE-2026-114267` · CVE record: SourceCodester Food Order Management System · CVSS 6.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer](https://agentprime.io/advisories/CVE-2026-19947.md) `CVE-2026-19947` · CVE record: zephyrproject zephyr · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation](https://agentprime.io/advisories/CVE-2026-105942.md) `CVE-2026-105942` · CVE record: Apache Software Foundation Apache Pulsar · CVSS 7.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all](https://agentprime.io/advisories/CVE-2026-105938.md) `CVE-2026-105938` · CVE record: Apache Software Foundation Apache Pulsar · CVSS 2.3 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data](https://agentprime.io/advisories/CVE-2026-105937.md) `CVE-2026-105937` · CVE record: Apache Software Foundation Apache Pulsar · CVSS 8.7 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint](https://agentprime.io/advisories/CVE-2026-105936.md) `CVE-2026-105936` · CVE record: Apache Software Foundation Apache Pulsar · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission](https://agentprime.io/advisories/CVE-2026-105935.md) `CVE-2026-105935` · CVE record: Apache Software Foundation Apache Pulsar · CVSS 4.9 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic](https://agentprime.io/advisories/CVE-2026-105934.md) `CVE-2026-105934` · CVE record: Apache Software Foundation Apache Pulsar · CVSS 7.2 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints](https://agentprime.io/advisories/CVE-2026-105932.md) `CVE-2026-105932` · CVE record: Apache Software Foundation Apache Pulsar · CVSS 2.3 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants](https://agentprime.io/advisories/CVE-2026-105931.md) `CVE-2026-105931` · CVE record: Apache Software Foundation Apache Pulsar · CVSS 2.3 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download](https://agentprime.io/advisories/CVE-2026-105930.md) `CVE-2026-105930` · CVE record: Apache Software Foundation Apache Pulsar · CVSS 6.0 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-112868.md) `CVE-2026-112868` · CVE record: H5P H5P · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission](https://agentprime.io/advisories/CVE-2026-105927.md) `CVE-2026-105927` · CVE record: Apache Software Foundation Apache Pulsar · CVSS 2.3 Low · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-114176.md) `CVE-2026-114176` · CVE record: DigitalME eRoom · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands](https://agentprime.io/advisories/CVE-2026-105926.md) `CVE-2026-105926` · CVE record: Apache Software Foundation Apache Pulsar · CVSS 5.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites](https://agentprime.io/advisories/GHSA-f2ph-cmg5-wxc8.md) `GHSA-f2ph-cmg5-wxc8`, `CVE-2026-114125` · npm `storybook` and 5 more: affected `>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6`, fixed in `8.6.19`, `9.1.21`, `10.6.2`, `11.0.0-alpha.6` · CVSS 8.6 High · Not analysed yet · Published 21 Oct 2026 · Tags: Path traversal, Code injection, Broken access control, CWE-346 - [NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-111184.md) `CVE-2026-111184` · CVE record: NoMachine NoMachine · CVSS 7.8 High · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control - [ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users](https://agentprime.io/advisories/GHSA-vh56-5m88-39rq.md) `GHSA-vh56-5m88-39rq`, `CVE-2026-112957` · npm `apostrophe`: affected `<4.34.0`, fixed in `4.34.0` · CVSS 4.3 Medium · Not analysed yet · Published 21 Oct 2026 · Tags: Broken access control Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .