# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [SmartLinker AI - Moderately critical - Information disclosure - SA-CONTRIB-2026-210](https://agentprime.io/advisories/CVE-2026-107307.md)
  `CVE-2026-107307` · CVE record: Drupal SmartLinker AI · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Easy Breadcrumb - Moderately critical - Information disclosure - SA-CONTRIB-2026-212](https://agentprime.io/advisories/CVE-2026-107309.md)
  `CVE-2026-107309` · CVE record: Drupal Easy Breadcrumb · CVSS 3.7 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Restrict route by IP - Critical - Access bypass - SA-CONTRIB-2026-216](https://agentprime.io/advisories/CVE-2026-107255.md)
  `CVE-2026-107255` · CVE record: Drupal Restrict route by IP · CVSS 7.3 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Dopup - Critical - Information disclosure - SA-CONTRIB-2026-227](https://agentprime.io/advisories/CVE-2026-114530.md)
  `CVE-2026-114530` · CVE record: Drupal Dopup · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Ágora Transparency Theme - Moderately critical - Information disclosure - SA-CONTRIB-2026-231](https://agentprime.io/advisories/CVE-2026-114533.md)
  `CVE-2026-114533` · CVE record: Drupal Ágora Transparency Theme · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Swiper formatter - Moderately critical - Information disclosure - SA-CONTRIB-2026-233](https://agentprime.io/advisories/CVE-2026-114535.md)
  `CVE-2026-114535` · CVE record: Drupal Swiper formatter · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [View Unpublished - Moderately critical - Access bypass - SA-CONTRIB-2026-235](https://agentprime.io/advisories/CVE-2026-114537.md)
  `CVE-2026-114537` · CVE record: Drupal View Unpublished · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Domain - Moderately critical - Access bypass - SA-CONTRIB-2026-238](https://agentprime.io/advisories/CVE-2026-114540.md)
  `CVE-2026-114540` · CVE record: Drupal Domain · CVSS 6.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Simple User Management - Moderately critical - Access bypass - SA-CONTRIB-2026-239](https://agentprime.io/advisories/CVE-2026-114543.md)
  `CVE-2026-114543` · CVE record: Drupal Simple User Management · No CVSS score · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Frontend Editing - Less critical - Access bypass - SA-CONTRIB-2026-241](https://agentprime.io/advisories/CVE-2026-114553.md)
  `CVE-2026-114553` · CVE record: Drupal Frontend Editing · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Media Bulk Upload - Moderately critical - Access bypass - SA-CONTRIB-2026-243](https://agentprime.io/advisories/CVE-2026-114544.md)
  `CVE-2026-114544` · CVE record: Drupal Media Bulk Upload · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Fullcalendar View - Moderately critical - Access bypass - SA-CONTRIB-2026-244](https://agentprime.io/advisories/CVE-2026-114545.md)
  `CVE-2026-114545` · CVE record: Drupal Fullcalendar View · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [TinyPNG - Moderately critical - Information disclosure - SA-CONTRIB-2026-246](https://agentprime.io/advisories/CVE-2026-114547.md)
  `CVE-2026-114547` · CVE record: Drupal TinyPNG · CVSS 3.7 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [AI File to Text - Moderately critical - Access bypass - SA-CONTRIB-2026-251](https://agentprime.io/advisories/CVE-2026-114554.md)
  `CVE-2026-114554` · CVE record: Drupal AI File to Text · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Rabbit Hole - Moderately critical - Access Bypass - SA-CONTRIB-2026-252](https://agentprime.io/advisories/CVE-2026-114571.md)
  `CVE-2026-114571` · CVE record: Drupal Rabbit Hole · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Monster Menus - Critical - PHP object injection - SA-CONTRIB-2026-253](https://agentprime.io/advisories/CVE-2026-114573.md)
  `CVE-2026-114573` · CVE record: Drupal Monster Menus · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Commerce Core - Highly critical - Access bypass - SA-CONTRIB-2026-254](https://agentprime.io/advisories/CVE-2026-118539.md)
  `CVE-2026-118539` · CVE record: Drupal Commerce Core · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Commerce Core - Moderately critical - Information disclosure - SA-CONTRIB-2026-255](https://agentprime.io/advisories/CVE-2026-118540.md)
  `CVE-2026-118540` · CVE record: Drupal Commerce Core · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Commerce Core - Less critical - Access bypass - SA-CONTRIB-2026-256](https://agentprime.io/advisories/CVE-2026-118541.md)
  `CVE-2026-118541` · CVE record: Drupal Commerce Core · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Commerce Core - Moderately critical - Access bypass - SA-CONTRIB-2026-257](https://agentprime.io/advisories/CVE-2026-118542.md)
  `CVE-2026-118542` · CVE record: Drupal Commerce Core · CVSS 2.7 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Commerce License - Moderately critical - Access bypass - SA-CONTRIB-2026-260](https://agentprime.io/advisories/CVE-2026-118555.md)
  `CVE-2026-118555` · CVE record: Drupal Commerce License · CVSS 6.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Commerce Shipping - Moderately critical - Access bypass - SA-CONTRIB-2026-261](https://agentprime.io/advisories/CVE-2026-118556.md)
  `CVE-2026-118556` · CVE record: Drupal Commerce Shipping · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Commerce Shipping - Less critical - Access bypass - SA-CONTRIB-2026-262](https://agentprime.io/advisories/CVE-2026-118557.md)
  `CVE-2026-118557` · CVE record: Drupal Commerce Shipping · CVSS 2.7 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [AI (Artificial Intelligence) - Moderately critical - Information disclosure - SA-CONTRIB-2026-268](https://agentprime.io/advisories/CVE-2026-118548.md)
  `CVE-2026-118548` · CVE record: Drupal AI (Artificial Intelligence) · CVSS 3.7 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Fasttoggle - Moderately critical - Access bypass - SA-CONTRIB-2026-282](https://agentprime.io/advisories/CVE-2026-118569.md)
  `CVE-2026-118569` · CVE record: Drupal Fasttoggle · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [S3 File System - Moderately critical - Access bypass - SA-CONTRIB-2026-279](https://agentprime.io/advisories/CVE-2026-118574.md)
  `CVE-2026-118574` · CVE record: Drupal S3 File System · CVSS 5.6 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Bulk Update User Roles - Moderately critical - Incorrect authorization - SA-CONTRIB-2026-280](https://agentprime.io/advisories/CVE-2026-118567.md)
  `CVE-2026-118567` · CVE record: Drupal Bulk Update User Roles · CVSS 4.7 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-288](https://agentprime.io/advisories/CVE-2026-118583.md)
  `CVE-2026-118583` · CVE record: Drupal Field Permissions · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Field Permissions - Moderately critical - Access bypass - SA-CONTRIB-2026-289](https://agentprime.io/advisories/CVE-2026-118584.md)
  `CVE-2026-118584` · CVE record: Drupal Field Permissions · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [OAuth2 Token Manager - Critical - Access bypass - SA-CONTRIB-2026-290](https://agentprime.io/advisories/CVE-2026-118573.md)
  `CVE-2026-118573` · CVE record: Drupal OAuth2 Token Manager · CVSS 4.8 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Improper authorization in Apple Xcode](https://agentprime.io/advisories/CVE-2026-112602.md)
  `CVE-2026-112602` · CVE record: Apple Xcode · CVSS 3.3 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Keycloak-services: keycloak-services: authorization bypass via uma resource registration idor](https://agentprime.io/advisories/CVE-2026-118947.md)
  `CVE-2026-118947` · CVE record: Red Hat Red Hat Build of Keycloak and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-119272.md)
  `CVE-2026-119272` · CVE record: Google Chrome · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-119269.md)
  `CVE-2026-119269` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-76031.md)
  `CVE-2026-76031` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-76030.md)
  `CVE-2026-76030` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-76028.md)
  `CVE-2026-76028` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-76025.md)
  `CVE-2026-76025` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Skuul School Management System through version 2.6.5 is vulnerable to incorrect access control in the ResultChecker::checkResult method.](https://agentprime.io/advisories/CVE-2026-117028.md)
  `CVE-2026-117028` · CVE record · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [SOCFortress CoPilot: Stored case-report template injection permits backend code execution](https://agentprime.io/advisories/CVE-2026-61707.md)
  `CVE-2026-61707` · CVE record: socfortress CoPilot · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Code injection, Broken access control
- [WeGIA: Systemic IDOR + Missing CSRF — extract($\_REQUEST) in All Controle Classes](https://agentprime.io/advisories/CVE-2026-61671.md)
  `CVE-2026-61671` · CVE record: LabRedesCefetRJ WeGIA · CVSS 8.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [Incorrect Authorization](https://agentprime.io/advisories/CVE-2026-119317.md)
  `CVE-2026-119317` · CVE record: Tenable, Inc. Plugin Feed · CVSS 6.0 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Bricks Theme Broken Access Control via load_popup_content](https://agentprime.io/advisories/CVE-2026-119325.md)
  `CVE-2026-119325` · CVE record: Bricks Bricks Theme · CVSS 7.5 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Sandbox Escape via Table Rotation in ServiceNow AI Platform](https://agentprime.io/advisories/CVE-2026-103093.md)
  `CVE-2026-103093` · CVE record: ServiceNow ServiceNow AI Platform · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Domain Separation Bypass in ServiceNow AI Platform](https://agentprime.io/advisories/CVE-2026-6877.md)
  `CVE-2026-6877` · CVE record: ServiceNow ServiceNow AI Platform · CVSS 5.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Improper access control in Ubiquiti Inc WiFiman Desktop for macOS](https://agentprime.io/advisories/CVE-2026-119251.md)
  `CVE-2026-119251` · CVE record: Ubiquiti Inc WiFiman Desktop for macOS · CVSS 6.7 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Nomad vulnerable to cross-namespace information disclosure in multiple endpoints](https://agentprime.io/advisories/CVE-2026-102260.md)
  `CVE-2026-102260` · CVE record: HashiCorp Nomad and 1 more · CVSS 4.3 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Vite: \`server.fs.deny\` bypassed with queries](https://agentprime.io/advisories/GHSA-8g5g-mxqh-grgj.md)
  `GHSA-8g5g-mxqh-grgj`, `CVE-2026-118662` · npm `vite`: affected `>=6.4.4, <6.4.5`, fixed in `6.4.5` · CVSS 6.9 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control, CWE-180
- [Shopify App: Token exchange shop context confusion may allow cross-shop authorization bypass in affected apps](https://agentprime.io/advisories/GHSA-6j52-38f8-qhxr.md)
  `GHSA-6j52-38f8-qhxr`, `CVE-2026-63414` · RubyGems `shopify_app`: affected `>=22.1.0, <23.0.3`, fixed in `23.0.3` · CVSS 7.6 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [cert-manager: Direct ACME Challenge resources can bypass Issuer DNS01 solver policy and use ClusterIssuer DNS credentials](https://agentprime.io/advisories/GHSA-8rvj-mm4h-c258.md)
  `GHSA-8rvj-mm4h-c258`, `BIT-cert-manager-2026-62290`, `CVE-2026-62290`, `GO-2026-6889` · Go `github.com/cert-manager/cert-manager`: affected `>=1.18.0, <1.19.6 || >=1.20.0-alpha.0, <1.20.3`, fixed in `1.19.6`, `1.20.3` · CVSS 7.3 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Keycloak allows unauthorized access to resources via uma permission ticket bypass](https://agentprime.io/advisories/GHSA-w3p3-7cjg-vgfw.md)
  `GHSA-w3p3-7cjg-vgfw`, `BIT-keycloak-2026-9799`, `CVE-2026-9799` · Maven `org.keycloak:keycloak-services`: affected `<26.6.4`, fixed in `26.6.4` · CVSS 4.6 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in issuer resolution in AWS Private CA Connector for Kubernetes](https://agentprime.io/advisories/CVE-2026-119115.md)
  `CVE-2026-119115` · CVE record: AWS aws-privateca-issuer · CVSS 8.4 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [@eeacms/volto-chatbot has Unauthenticated Danswer API Confused Deputy Proxy](https://agentprime.io/advisories/GHSA-w9x9-j56r-h98r.md)
  `GHSA-w9x9-j56r-h98r` · npm `@eeacms/volto-chatbot`: affected `<2.0.4`, fixed in `2.0.4` · CVSS 8.2 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Kubeflow Pipelines: Missing namespace authorization permits cross-tenant artifact reads](https://agentprime.io/advisories/CVE-2026-118760.md)
  `CVE-2026-118760` · CVE record: kubeflow pipelines · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Broken Object Level Authorization in Users Configuration Endpoint (/centreon/api/latest/configuration/users) – Sensitive Information Disclosure](https://agentprime.io/advisories/CVE-2025-12523.md)
  `CVE-2025-12523` · CVE record: Centreon Centreon · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Broken Function Level Authorization — \`postcommand.php\` allows execution of poller post-restart commands by non-admin users](https://agentprime.io/advisories/CVE-2025-13050.md)
  `CVE-2025-13050` · CVE record: Centreon Centreon · CVSS 5.4 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [ZITADEL 3.0.0 through 3.4.15 and 4.0.0 before 4.19.5 Account Takeover via Device Authorization Approval](https://agentprime.io/advisories/CVE-2026-119129.md)
  `CVE-2026-119129` · CVE record: zitadel zitadel · CVSS 8.6 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Improper Access Control of Web Admin Console in Progress WS_FTP Server](https://agentprime.io/advisories/CVE-2026-90867.md)
  `CVE-2026-90867` · CVE record: Progress Software WS_FTP Server · CVSS 8.1 High · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [Privilege Escalation via Missing Authorization in WS_FTP Manager](https://agentprime.io/advisories/CVE-2026-90863.md)
  `CVE-2026-90863` · CVE record: Progress Software WS_FTP Server · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control
- [WordPress Hotel Booking plugin <= 3.8 - Insecure Direct Object References (IDOR) vulnerability](https://agentprime.io/advisories/CVE-2026-118084.md)
  `CVE-2026-118084` · CVE record: nicdark Hotel Booking · CVSS 6.5 Medium · Not analysed yet · Published 29 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTI5VDE1OjI0OjQxLjA4NTAwMFoiLCJDVkUtMjAyNi0xMTgwODQiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTMwVDAzOjEwOjA3LjA5MzAwMFoiLCJDVkUtMjAyNi0xMDcyNjciXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTMwVDAzOjEwOjA3LjA5MzAwMFoiLCJDVkUtMjAyNi0xMDcyNjciXQ>. Everything for agents: <https://agentprime.io/llms.txt>.