# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Essential Addons for Elementor < 6.8.7 - Admin+ Cross-Site User Approval State Change via Bulk Action](https://agentprime.io/advisories/CVE-2026-110537.md)
  `CVE-2026-110537` · CVE record: Unknown Essential Addons for Elementor · CVSS 3.8 Low · Not analysed yet · Published 23 Oct 2026 · Tags: Broken access control
- [Authentication Source Verification Issue in Okta Access Gateway](https://agentprime.io/advisories/CVE-2026-115546.md)
  `CVE-2026-115546` · CVE record: Okta Okta Access Gateway · CVSS 8.1 High · Not analysed yet · Published 23 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Control panel only administrator privilege escalation through sandbox allowed "getOwners(criteria)"](https://agentprime.io/advisories/GHSA-r56r-f696-c8w9.md)
  `GHSA-r56r-f696-c8w9` · Packagist `craftcms/cms`: affected `>=5.8.17, <5.11.2`, fixed in `5.11.2` · No CVSS score · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Ipa: freeipa: freeipa uses subject cn as proof of certificate ownership](https://agentprime.io/advisories/CVE-2026-115221.md)
  `CVE-2026-115221` · CVE record: Red Hat Red Hat Enterprise Linux 10 and 4 more · CVSS 5.4 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Jitsu Console before 2.14.0-beta.41 Cross-Workspace Authorization Bypass via sources/state API](https://agentprime.io/advisories/CVE-2026-115509.md)
  `CVE-2026-115509` · CVE record: jitsucom jitsu · CVSS 2.3 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Incus 7.0.1 before 7.0.2 and 7.2.0 before 7.5.0 Project Restriction Bypass via Custom Volume Copy](https://agentprime.io/advisories/CVE-2026-115376.md)
  `CVE-2026-115376` · CVE record: lxc incus · CVSS 8.3 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Incus before 6.0.7, 6.1.0 before 7.0.2, and 7.1.0 before 7.5.0 Authorization Bypass via GET /1.0/operations/{uuid}](https://agentprime.io/advisories/CVE-2026-115373.md)
  `CVE-2026-115373` · CVE record: lxc incus · CVSS 7.0 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Incus 6.0.5 before 6.0.7, 6.12.0 before 7.0.2, and 7.1.0 before 7.5.0 Restricted Project Bypass via Clustered Migration Refresh](https://agentprime.io/advisories/CVE-2026-115370.md)
  `CVE-2026-115370` · CVE record: lxc incus · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [OpenBao 2.5.0 before 2.6.2 PKI allowed_ip_sans_cidr Bypass via CSR IP SANs](https://agentprime.io/advisories/CVE-2026-115369.md)
  `CVE-2026-115369` · CVE record: openbao openbao · CVSS 2.1 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [OpenBao 2.3.0 before 2.6.3 Missing Root Namespace Enforcement in Plugin Catalog APIs](https://agentprime.io/advisories/CVE-2026-115366.md)
  `CVE-2026-115366` · CVE record: openbao openbao · CVSS 2.0 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [OpenBao 2.3.0 before 2.6.3 Incorrect Authorization via Policy Cache Namespace Traversal](https://agentprime.io/advisories/CVE-2026-115365.md)
  `CVE-2026-115365` · CVE record: openbao openbao · CVSS 7.5 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [OpenBao before 2.6.3 Missing Header Check on Agent/Proxy Quit Endpoints](https://agentprime.io/advisories/CVE-2026-115364.md)
  `CVE-2026-115364` · CVE record: openbao openbao · CVSS 2.1 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [OpenBao before 2.6.3 ACL Bypass via Dropped Templated Policy Denial](https://agentprime.io/advisories/CVE-2026-115361.md)
  `CVE-2026-115361` · CVE record: openbao openbao · CVSS 2.1 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Missing authorization in the Prospero Flow CRM user API allows a basic role user to read and delete other accounts](https://agentprime.io/advisories/CVE-2026-114519.md)
  `CVE-2026-114519` · CVE record: Roskus Prospero Flow CRM · CVSS 8.6 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Authenticated Remote Code Execution allows Unauthorized System Control in Wireless Network Management Interface](https://agentprime.io/advisories/CVE-2026-95704.md)
  `CVE-2026-95704` · CVE record: Hewlett Packard Enterprise (HPE) ArubaOS (AOS) · CVSS 7.2 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [SmileCDR HAPI FHIR unauthorized read](https://agentprime.io/advisories/CVE-2026-113876.md)
  `CVE-2026-113876` · CVE record: SmileCDR HAPI FHIR · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [SmileCDR HAPI FHIR unauthorized read via subscription](https://agentprime.io/advisories/CVE-2026-113875.md)
  `CVE-2026-113875` · CVE record: SmileCDR HAPI FHIR · CVSS 2.3 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [SmileCDR HAPI FHIR trusted tenant partition override](https://agentprime.io/advisories/CVE-2026-113874.md)
  `CVE-2026-113874` · CVE record: SmileCDR HAPI FHIR · CVSS 8.6 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Missing authorization in the unit resources download route in Juju controllers](https://agentprime.io/advisories/CVE-2026-93336.md)
  `CVE-2026-93336` · CVE record: Canonical Juju · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Nuxt: Server-side route rules (\`redirect\`, \`headers\`, \`proxy\`, \`ssr\`) are skipped for case-variant paths when routing is case-insensitive](https://agentprime.io/advisories/GHSA-vjh5-4x84-xrqp.md)
  `GHSA-vjh5-4x84-xrqp`, `CVE-2026-114132` · npm `nuxt` and 1 more: affected `>=3.0.0 || >=4.0.0, <4.6.2`, fixed in `4.6.2` · CVSS 6.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control, CWE-178
- [Nuxt: Route rules are matched against the raw request path, so a percent-encoded segment can bypass \`appMiddleware\` on dynamic and catch-all routes](https://agentprime.io/advisories/GHSA-6gq8-jgmh-3ffp.md)
  `GHSA-6gq8-jgmh-3ffp`, `CVE-2026-114131` · npm `nuxt`: affected `>=3.11.0, <3.21.4 || >=4.0.0, <4.4.4`, fixed in `3.21.4`, `4.4.4` · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control, CWE-436
- [Incorrect authorization checks in Amazon Athena engine version 3 query processing](https://agentprime.io/advisories/CVE-2026-115416.md)
  `CVE-2026-115416` · CVE record: AWS Amazon Athena · CVSS 6.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control, CWE-653
- [Electron: Extension tabs.query returns tab URLs and titles without the tabs permission](https://agentprime.io/advisories/GHSA-98mx-cjp9-gchm.md)
  `GHSA-98mx-cjp9-gchm`, `CVE-2026-113797` · npm `electron`: affected `<42.11.1 || >=43.0.0-alpha.1, <43.5.1 || >=44.0.0-alpha.1, <44.1.1 || >=45.0.0-alpha.1, <45.0.0-alpha.4`, fixed in `42.11.1`, `43.5.1`, `44.1.1`, `45.0.0-alpha.4` · CVSS 3.1 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [DataApp links without login expose job information to other user in KNIME Business Hub](https://agentprime.io/advisories/CVE-2026-115502.md)
  `CVE-2026-115502` · CVE record: KNIME KNIME Business Hub · CVSS 6.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Missing authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2026-114487.md)
  `CVE-2026-114487` · CVE record: Devolutions Server · CVSS 4.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Jupyter Server: Gateway WebSocket handler bypasses kernel execute authorization](https://agentprime.io/advisories/GHSA-354v-3q48-cv69.md)
  `GHSA-354v-3q48-cv69`, `CVE-2026-114135` · PyPI `jupyter-server`: affected `>=2.0.0, <2.6.0`, fixed in `2.6.0` · CVSS 8.8 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Devolutions Server](https://agentprime.io/advisories/CVE-2026-114486.md)
  `CVE-2026-114486` · CVE record: Devolutions Server · CVSS 4.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries](https://agentprime.io/advisories/CVE-2026-115453.md)
  `CVE-2026-115453` · CVE record: MarcosCamara01 Ecommerce Template · CVSS 7.1 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [OCO-Server: Self-Service Portal uninstall-job authorization bypass](https://agentprime.io/advisories/CVE-2026-114515.md)
  `CVE-2026-114515` · CVE record: schorschii OCO-Server · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [WordPress Paid Member Subscriptions plugin <= 3.1.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-112842.md)
  `CVE-2026-112842` · CVE record: Cozmoslabs Paid Member Subscriptions · CVSS 6.5 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Lotus through 0.10.2 Authorization Bypass via switch_organization Endpoint](https://agentprime.io/advisories/CVE-2026-115334.md)
  `CVE-2026-115334` · CVE record: uselotus lotus · CVSS 7.6 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Lotus through 0.10.2 Cross-Organization IDOR via SubscriptionViewSet](https://agentprime.io/advisories/CVE-2026-115329.md)
  `CVE-2026-115329` · CVE record: uselotus lotus · CVSS 6.0 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [QloApps through 1.7.0 IDOR via OrderDetailController Refund Request](https://agentprime.io/advisories/CVE-2026-115326.md)
  `CVE-2026-115326` · CVE record: Webkul QloApps · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Netmaker through 1.7.0 Authorization Bypass via updateExtClient Unscoped Lookup](https://agentprime.io/advisories/CVE-2026-115325.md)
  `CVE-2026-115325` · CVE record: gravitl netmaker · CVSS 8.7 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [EverShop 1.2.2 before 2.2.1 Missing Authorization via Customer Address API](https://agentprime.io/advisories/CVE-2026-115323.md)
  `CVE-2026-115323` · CVE record: evershopcommerce evershop · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Bytebase before 3.16.0 Authorization Bypass via Rollout Service Task Run Handlers](https://agentprime.io/advisories/CVE-2026-115322.md)
  `CVE-2026-115322` · CVE record: bytebase bytebase · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Bytebase before 3.16.0 Authorization Bypass via UpdateIssueComment](https://agentprime.io/advisories/CVE-2026-115321.md)
  `CVE-2026-115321` · CVE record: bytebase bytebase · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [WordPress ЮKassa для WooCommerce plugin <= 2.17.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-114699.md)
  `CVE-2026-114699` · CVE record: yoomoney ЮKassa для WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [WordPress Majestic Support plugin <= 1.2.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-112218.md)
  `CVE-2026-112218` · CVE record: Ahmad Majestic Support · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [WordPress Page Restriction WordPress (WP) plugin <= 1.6.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-114696.md)
  `CVE-2026-114696` · CVE record: miniOrange Page Restriction WordPress (WP) · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [WordPress Sunshine Photo Cart plugin <= 3.7.5 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-111842.md)
  `CVE-2026-111842` · CVE record: WP Sunshine Sunshine Photo Cart · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [WatchGuard Agent Incorrect Permission Assignment in Log Directory Allows Local Log Tampering](https://agentprime.io/advisories/CVE-2026-115253.md)
  `CVE-2026-115253` · CVE record: WatchGuard WatchGuard Agent · CVSS 7.3 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Endpoint Security Cleartext Storage of FileVault Recovery Key in Log File](https://agentprime.io/advisories/CVE-2026-96293.md)
  `CVE-2026-96293` · CVE record: WatchGuard WatchGuard Agent · CVSS 6.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Information disclosure, Broken access control
- [WordPress ACF Extended plugin <= 0.9.2.7 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-112312.md)
  `CVE-2026-112312` · CVE record: ACF Extended ACF Extended · CVSS 7.5 High · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110893.md)
  `CVE-2026-110893` · CVE record: Brainstorm Force SureDash · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-110894.md)
  `CVE-2026-110894` · CVE record: Brainstorm Force SureDash · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [WordPress myCred plugin <= 4.0.0-beta.1 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-114698.md)
  `CVE-2026-114698` · CVE record: myCred myCred · CVSS 5.4 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [WordPress PowerPack Addons for Elementor plugin <= 3.1.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-114182.md)
  `CVE-2026-114182` · CVE record: IdeaBox Creations PowerPack Addons for Elementor · CVSS 4.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [WordPress Strong Testimonials plugin <= 3.3.14 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-112843.md)
  `CVE-2026-112843` · CVE record: WP Chill Strong Testimonials · CVSS 4.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [WordPress Falcon – WordPress Optimizations & Tweaks plugin <= 2.12.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-112826.md)
  `CVE-2026-112826` · CVE record: eLightUp Falcon – WordPress Optimizations & Tweaks · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [WordPress Metform plugin <= 4.3.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-114180.md)
  `CVE-2026-114180` · CVE record: Wpmet Metform · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [WordPress MarketKing plugin <= 2.1.72 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-111847.md)
  `CVE-2026-111847` · CVE record: Kings Plugins MarketKing · CVSS 5.4 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [WordPress eRoom plugin <= 1.7.1 - Settings Change vulnerability](https://agentprime.io/advisories/CVE-2026-114175.md)
  `CVE-2026-114175` · CVE record: DigitalME eRoom · CVSS 5.4 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [MasterStudy LMS 3.7.13 - 3.7.54 - Instructor+ Arbitrary User Display Name Update via Student Enrollment](https://agentprime.io/advisories/CVE-2026-88849.md)
  `CVE-2026-88849` · CVE record: Unknown MasterStudy LMS WordPress Plugin · CVSS 2.7 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Photo Engine < 6.5.8 - Author+ Arbitrary Attachment Deletion via IDOR](https://agentprime.io/advisories/CVE-2026-111972.md)
  `CVE-2026-111972` · CVE record: Unknown Photo Engine (Media Organizer & Lightroom) · CVSS 4.9 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [MB Custom Post Types & Custom Taxonomies 2.4.0 - 2.12.2 - Contributor+ Post Type Definition and Non-Public Post Metadata Disclosure via Export](https://agentprime.io/advisories/CVE-2026-110011.md)
  `CVE-2026-110011` · CVE record: Unknown MB Custom Post Types & Custom Taxonomies · CVSS 2.7 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [MB Custom Post Types & Custom Taxonomies 2.0.2 - 2.12.2 - Unauthenticated Settings Reset via 'mbcpt-force' Parameter](https://agentprime.io/advisories/CVE-2026-110010.md)
  `CVE-2026-110010` · CVE record: Unknown MB Custom Post Types & Custom Taxonomies · CVSS 4.8 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [Infility Global < 2.16.25 - Unauthenticated Google Translate API Key Update](https://agentprime.io/advisories/CVE-2026-109931.md)
  `CVE-2026-109931` · CVE record: Unknown Infility Global · CVSS 3.7 Low · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [FluentCart < 2.2.0 - Unauthenticated Customer Address Disclosure via IDOR](https://agentprime.io/advisories/CVE-2026-100142.md)
  `CVE-2026-100142` · CVE record: Unknown FluentCart A New Era of eCommerce · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control
- [OpenRemote 1.2.0 before 1.31.0 Missing Authorization in Gateway Tunnel Endpoints](https://agentprime.io/advisories/CVE-2026-114661.md)
  `CVE-2026-114661` · CVE record: openremote openremote · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTIyVDAxOjQzOjQ1LjUxNTAwMFoiLCJDVkUtMjAyNi0xMTQ2NjEiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTIzVDA2OjAwOjE4Ljc5ODAwMFoiLCJDVkUtMjAyNi0xMTE3MzgiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTIzVDA2OjAwOjE4Ljc5ODAwMFoiLCJDVkUtMjAyNi0xMTE3MzgiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.