# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories](https://agentprime.io/advisories/GHSA-fgxm-5hvv-x4vh.md)
  `GHSA-fgxm-5hvv-x4vh`, `GO-2026-6892` · Go `github.com/charmbracelet/soft-serve`: affected `>=0.5.0, <0.12.3`, fixed in `0.12.3` · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure, Broken access control
- [WordPress Timetics plugin <= 1.0.65 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-116860.md)
  `CVE-2026-116860` · CVE record: Arraytics Timetics · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plus](https://agentprime.io/advisories/CVE-2026-119682.md)
  `CVE-2026-119682` · CVE record: ManageEngine SharePoint Manager Plus · CVSS 7.9 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)](https://agentprime.io/advisories/CVE-2026-61708.md)
  `CVE-2026-61708` · CVE record: socfortress CoPilot · CVSS 8.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft](https://agentprime.io/advisories/CVE-2026-112905.md)
  `CVE-2026-112905` · CVE record: givanz Vvveb · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center Scheduled-Task APIs](https://agentprime.io/advisories/CVE-2026-119665.md)
  `CVE-2026-119665` · CVE record: MGdaasLab WHartTest · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update](https://agentprime.io/advisories/CVE-2026-119664.md)
  `CVE-2026-119664` · CVE record: wannabespace tamery · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create](https://agentprime.io/advisories/CVE-2026-119663.md)
  `CVE-2026-119663` · CVE record: wannabespace tamery · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries](https://agentprime.io/advisories/CVE-2026-119661.md)
  `CVE-2026-119661` · CVE record: star7th ShowDoc · CVSS 2.3 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Blossom through 1.17.1 Authorization Bypass via Folder Endpoints](https://agentprime.io/advisories/CVE-2026-119659.md)
  `CVE-2026-119659` · CVE record: blossom-editor Blossom · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/\<domain_name>/update](https://agentprime.io/advisories/CVE-2026-119658.md)
  `CVE-2026-119658` · CVE record: PowerDNS-Admin PowerDNS-Admin · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations](https://agentprime.io/advisories/CVE-2026-119657.md)
  `CVE-2026-119657` · CVE record: zyx0814 FilePress · CVSS 2.3 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization](https://agentprime.io/advisories/CVE-2026-119654.md)
  `CVE-2026-119654` · CVE record: devlive-community DataCap · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path](https://agentprime.io/advisories/CVE-2026-119653.md)
  `CVE-2026-119653` · CVE record: admpub nging · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [HuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure](https://agentprime.io/advisories/CVE-2026-119652.md)
  `CVE-2026-119652` · CVE record: HuLaSpark HuLa-Server · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion](https://agentprime.io/advisories/CVE-2026-119651.md)
  `CVE-2026-119651` · CVE record: HuLaSpark HuLa-Server · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController](https://agentprime.io/advisories/CVE-2026-119650.md)
  `CVE-2026-119650` · CVE record: HuLaSpark HuLa-Server · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check](https://agentprime.io/advisories/CVE-2026-119649.md)
  `CVE-2026-119649` · CVE record: OrchardCMS Orchard · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail](https://agentprime.io/advisories/CVE-2026-119648.md)
  `CVE-2026-119648` · CVE record: TencentBlueKing bk-cmdb · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}](https://agentprime.io/advisories/CVE-2026-119647.md)
  `CVE-2026-119647` · CVE record: dromara RuoYi-Vue-Plus · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API](https://agentprime.io/advisories/CVE-2026-119646.md)
  `CVE-2026-119646` · CVE record: Open Web Analytics Open Web Analytics · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc](https://agentprime.io/advisories/CVE-2026-119645.md)
  `CVE-2026-119645` · CVE record: easysoft zentaopms · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints](https://agentprime.io/advisories/CVE-2026-119644.md)
  `CVE-2026-119644` · CVE record: blossom-editor Blossom · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API](https://agentprime.io/advisories/CVE-2026-112347.md)
  `CVE-2026-112347` · CVE record: Themeum Kirki · CVSS 7.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Incorrect permission assignment in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-111499.md)
  `CVE-2026-111499` · CVE record: Dell OpenManage Enterprise · CVSS 5.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id](https://agentprime.io/advisories/CVE-2026-119598.md)
  `CVE-2026-119598` · CVE record: iluobei miaomiaowu · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download](https://agentprime.io/advisories/CVE-2026-119596.md)
  `CVE-2026-119596` · CVE record: HDInnovations UNIT3D · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint](https://agentprime.io/advisories/CVE-2026-119576.md)
  `CVE-2026-119576` · CVE record: ArcadeData arcadedb · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret](https://agentprime.io/advisories/CVE-2026-119573.md)
  `CVE-2026-119573` · CVE record: traefik traefik · CVSS 2.1 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID](https://agentprime.io/advisories/CVE-2026-119571.md)
  `CVE-2026-119571` · CVE record: parse-community parse-server · CVSS 6.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate](https://agentprime.io/advisories/CVE-2026-119038.md)
  `CVE-2026-119038` · CVE record · CVSS 6.1 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Improper access control vulnerability in ESET Encryption products for Windows](https://agentprime.io/advisories/CVE-2026-75882.md)
  `CVE-2026-75882` · CVE record: ESET spol. s.r.o. ESET Endpoint Encryption and 1 more · CVSS 8.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in Protectel](https://agentprime.io/advisories/CVE-2025-68392.md)
  `CVE-2025-68392` · CVE record: ARKETEAM PROTECTELMAJ and 1 more · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update](https://agentprime.io/advisories/CVE-2026-119565.md)
  `CVE-2026-119565` · CVE record: Plausible Plausible Analytics · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems](https://agentprime.io/advisories/CVE-2026-119556.md)
  `CVE-2026-119556` · CVE record: Moodle Project moodle · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback](https://agentprime.io/advisories/CVE-2026-119555.md)
  `CVE-2026-119555` · CVE record: Moodle Project moodle · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions](https://agentprime.io/advisories/CVE-2026-119551.md)
  `CVE-2026-119551` · CVE record: jellyfin jellyfin · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}](https://agentprime.io/advisories/CVE-2026-119550.md)
  `CVE-2026-119550` · CVE record: jellyfin jellyfin · CVSS 5.1 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook](https://agentprime.io/advisories/CVE-2026-119548.md)
  `CVE-2026-119548` · CVE record: getlago lago · CVSS 2.3 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}](https://agentprime.io/advisories/CVE-2026-119547.md)
  `CVE-2026-119547` · CVE record: forgejo forgejo · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation](https://agentprime.io/advisories/CVE-2026-119421.md)
  `CVE-2026-119421` · CVE record: juspay hyperswitch · CVSS 8.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create](https://agentprime.io/advisories/CVE-2026-119414.md)
  `CVE-2026-119414` · CVE record: bitwarden server · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING](https://agentprime.io/advisories/CVE-2026-119377.md)
  `CVE-2026-119377` · CVE record: SQLite SQLite · CVSS 2.0 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass](https://agentprime.io/advisories/CVE-2026-119147.md)
  `CVE-2026-119147` · CVE record: ProFTPD Project ProFTPD · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Broken access control restriction in Cloud Controller API](https://agentprime.io/advisories/CVE-2026-59387.md)
  `CVE-2026-59387` · CVE record: Cloud Foundry CAPI (Cloud Controller API) and 1 more · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Space Developer can extract space-scoped broker credentials](https://agentprime.io/advisories/CVE-2026-59385.md)
  `CVE-2026-59385` · CVE record: Cloud Foundry CAPI (Cloud Foundry Controller) and 1 more · CVSS 2.7 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration](https://agentprime.io/advisories/CVE-2026-110732.md)
  `CVE-2026-110732` · CVE record: tigroumeow AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules](https://agentprime.io/advisories/CVE-2026-118952.md)
  `CVE-2026-118952` · CVE record: Red Hat streams for Apache Kafka 2 and 1 more · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification](https://agentprime.io/advisories/CVE-2026-118101.md)
  `CVE-2026-118101` · CVE record: Unknown BuddyForms · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Fraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer Blacklisting](https://agentprime.io/advisories/CVE-2026-118072.md)
  `CVE-2026-118072` · CVE record: Unknown Fraud Prevention For WooCommerce and EDD · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter](https://agentprime.io/advisories/CVE-2026-119087.md)
  `CVE-2026-119087` · CVE record: keywordrush Content Egg – Affiliate Product Importer & Price Comparison · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action](https://agentprime.io/advisories/CVE-2026-119059.md)
  `CVE-2026-119059` · CVE record: keywordrush Content Egg – Affiliate Product Importer & Price Comparison · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192](https://agentprime.io/advisories/CVE-2026-107249.md)
  `CVE-2026-107249` · CVE record: Drupal Block AJAX · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194](https://agentprime.io/advisories/CVE-2026-107251.md)
  `CVE-2026-107251` · CVE record: Drupal Entity Reference Manager (Merge entities) · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Actstream - Critical - Access bypass - SA-CONTRIB-2026-198](https://agentprime.io/advisories/CVE-2026-107257.md)
  `CVE-2026-107257` · CVE record: Drupal Actstream · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199](https://agentprime.io/advisories/CVE-2026-107258.md)
  `CVE-2026-107258` · CVE record: Drupal Inline Entity Form Dialog · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202](https://agentprime.io/advisories/CVE-2026-107263.md)
  `CVE-2026-107263` · CVE record: Drupal Gutenberg · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205](https://agentprime.io/advisories/CVE-2026-107266.md)
  `CVE-2026-107266` · CVE record: Drupal Views Share · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206](https://agentprime.io/advisories/CVE-2026-96389.md)
  `CVE-2026-96389` · CVE record: Drupal Xray Audit · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208](https://agentprime.io/advisories/CVE-2026-107267.md)
  `CVE-2026-107267` · CVE record: Drupal DKAN · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTMwVDAzOjEwOjA3LjA5MzAwMFoiLCJDVkUtMjAyNi0xMDcyNjciXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTMwVDE0OjUwOjIzLjI5MjAwMFoiLCJDVkUtMjAyNi02MTczOSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTMwVDE0OjUwOjIzLjI5MjAwMFoiLCJDVkUtMjAyNi02MTczOSJd>. Everything for agents: <https://agentprime.io/llms.txt>.