# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [LORIS has incorrect access checks in issue_tracker](https://agentprime.io/advisories/CVE-2026-55146.md)
  `CVE-2026-55146` · CVE record: aces Loris · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [LORIS has incorrect access checks in API for Imaging Browser](https://agentprime.io/advisories/CVE-2026-55147.md)
  `CVE-2026-55147` · CVE record: aces Loris · CVSS 6.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Shopper: customer detail IDOR exposes administrator and staff records](https://agentprime.io/advisories/CVE-2026-62991.md)
  `CVE-2026-62991` · CVE record: shopperlabs shopper · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Shopper: missing variant-delete authorization permits destructive single and bulk actions](https://agentprime.io/advisories/CVE-2026-62989.md)
  `CVE-2026-62989` · CVE record: shopperlabs shopper · CVSS 8.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser](https://agentprime.io/advisories/CVE-2026-62967.md)
  `CVE-2026-62967` · CVE record: sinamics ztnet · CVSS 8.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Filecoin Pin: Fork bypass in the privileged GitHub Actions workflow](https://agentprime.io/advisories/CVE-2026-58412.md)
  `CVE-2026-58412` · CVE record: filecoin-project filecoin-pin · CVSS 8.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization](https://agentprime.io/advisories/CVE-2026-119337.md)
  `CVE-2026-119337` · CVE record: infiniflow ragflow · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [pgAdmin 4: Non-administrators can share a server with every user](https://agentprime.io/advisories/CVE-2026-116248.md)
  `CVE-2026-116248` · CVE record: pgadmin.org pgAdmin 4 · CVSS 6.0 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [pgAdmin 4: Connection services are not restricted in server mode](https://agentprime.io/advisories/CVE-2026-116245.md)
  `CVE-2026-116245` · CVE record: pgadmin.org pgAdmin 4 · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Hard-coded credentials, Broken access control
- [pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username](https://agentprime.io/advisories/CVE-2026-116239.md)
  `CVE-2026-116239` · CVE record: pgadmin.org pgAdmin 4 · CVSS 8.9 High · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, Broken access control
- [pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks](https://agentprime.io/advisories/CVE-2026-116238.md)
  `CVE-2026-116238` · CVE record: pgadmin.org pgAdmin 4 · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, Broken access control
- [Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API](https://agentprime.io/advisories/CVE-2026-119330.md)
  `CVE-2026-119330` · CVE record: immich-app immich · CVSS 3.5 Low · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers](https://agentprime.io/advisories/CVE-2026-119329.md)
  `CVE-2026-119329` · CVE record: immich-app immich · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Secret Server JWT issuance error](https://agentprime.io/advisories/CVE-2026-115830.md)
  `CVE-2026-115830` · CVE record: Delinea Secret Server (On-Prem) · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Secret Server device validation error](https://agentprime.io/advisories/CVE-2026-115828.md)
  `CVE-2026-115828` · CVE record: Delinea Secret Server (On-Prem) · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [MyTube: Visitor Can Access Hidden Video Metadata and Content](https://agentprime.io/advisories/CVE-2026-62301.md)
  `CVE-2026-62301` · CVE record: franklioxygen MyTube · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [HotCRP: comment-author search exposes anonymous commenter identities](https://agentprime.io/advisories/CVE-2026-55493.md)
  `CVE-2026-55493` · CVE record: kohler hotcrp · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Unauthenticated Stack Buffer Overflow in Sentinel Keys Server](https://agentprime.io/advisories/CVE-2026-78403.md)
  `CVE-2026-78403` · CVE record: Thalesgroup Sentinel Keys Server · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Memory corruption, Broken access control
- [NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid](https://agentprime.io/advisories/CVE-2026-120007.md)
  `CVE-2026-120007` · CVE record: NodeBB NodeBB · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-116862.md)
  `CVE-2026-116862` · CVE record: Acato WP REST Cache · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-116853.md)
  `CVE-2026-116853` · CVE record: Nexcess GiveWP · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability](https://agentprime.io/advisories/CVE-2026-116410.md)
  `CVE-2026-116410` · CVE record: masteriyo Masteriyo - LMS · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-116401.md)
  `CVE-2026-116401` · CVE record: RealMag777 HUSKY · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerability](https://agentprime.io/advisories/CVE-2026-107868.md)
  `CVE-2026-107868` · CVE record: YITHEMES YITH WooCommerce Product Add-Ons · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-54850.md)
  `CVE-2026-54850` · CVE record: magepeopleteam Booking and Rental Manager · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Hydra: Deposit Claim omits Head state-token spending requirement](https://agentprime.io/advisories/CVE-2026-62162.md)
  `CVE-2026-62162` · CVE record: cardano-scaling hydra · CVSS 8.2 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62056.md)
  `CVE-2026-62056` · CVE record: WP ManageNinja LLC Fluent CRM · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62023.md)
  `CVE-2026-62023` · CVE record: Unlimited Elements Unlimited Elements For Elementor (Free Widgets, Addons, Templates) · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62019.md)
  `CVE-2026-62019` · CVE record: Liquid Web / StellarWP BookIt · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-104674.md)
  `CVE-2026-104674` · CVE record: Arraytics Booktics · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62047.md)
  `CVE-2026-62047` · CVE record: Liquid Web / StellarWP Event Tickets · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()](https://agentprime.io/advisories/CVE-2026-73322.md)
  `CVE-2026-73322` · CVE record: Apache Software Foundation Apache Pinot · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62122.md)
  `CVE-2026-62122` · CVE record: Arraytics Booktics · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload](https://agentprime.io/advisories/CVE-2026-119620.md)
  `CVE-2026-119620` · CVE record: 37954679 cak-filemanagement-system · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control, Unrestricted file upload
- [Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2026-69446.md)
  `CVE-2026-69446` · CVE record: Microsoft Microsoft Edge (Chromium-based) · CVSS 4.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [changelog.com before commit 7b35e829 Missing Authorization via Preview Routes](https://agentprime.io/advisories/CVE-2026-119763.md)
  `CVE-2026-119763` · CVE record: thechangelog changelog.com · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via…](https://agentprime.io/advisories/CVE-2026-109592.md)
  `CVE-2026-109592` · CVE record: wordpressdotorg OpenStation – Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter](https://agentprime.io/advisories/CVE-2026-97638.md)
  `CVE-2026-97638` · CVE record: wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter](https://agentprime.io/advisories/CVE-2026-107630.md)
  `CVE-2026-107630` · CVE record: saadiqbal Email Templates Customizer and Designer for WordPress and WooCommerce · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion](https://agentprime.io/advisories/CVE-2025-8574.md)
  `CVE-2025-8574` · CVE record: tigroumeow Database Cleaner: Cleanup, Optimization & Repair · CVSS 8.7 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint](https://agentprime.io/advisories/CVE-2026-13747.md)
  `CVE-2026-13747` · CVE record: tigroumeow Meow Gallery · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery](https://agentprime.io/advisories/CVE-2026-61826.md)
  `CVE-2026-61826` · CVE record: morpheus65535 bazarr · CVSS 10.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 30 Oct 2026 · Tags: Cross-site request forgery (CSRF), Broken access control
- [SecureDrop: API session token reuse against the Journalist Interface web UI](https://agentprime.io/advisories/CVE-2026-50000.md)
  `CVE-2026-50000` · CVE record: freedomofpress securedrop · CVSS 5.0 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Frappe LMS allows unpublished certificate access](https://agentprime.io/advisories/CVE-2026-61806.md)
  `CVE-2026-61806` · CVE record: frappe lms · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Frappe LMS: Quiz result manipulation and cross-user submission forgery](https://agentprime.io/advisories/CVE-2026-61805.md)
  `CVE-2026-61805` · CVE record: frappe lms · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [ZAC: Missing per-zaaktype authorization on by-ID decision and process reads](https://agentprime.io/advisories/CVE-2026-55551.md)
  `CVE-2026-55551` · CVE record: infonl dimpact-zaakafhandelcomponent · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Incorrect authorization in OpenStack keystonemiddleware](https://agentprime.io/advisories/CVE-2026-115642.md)
  `CVE-2026-115642` · CVE record: OpenStack keystonemiddleware · CVSS 8.3 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62055.md)
  `CVE-2026-62055` · CVE record: Liquid Web / StellarWP Event Tickets · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-119367.md)
  `CVE-2026-119367` · CVE record: Liquid Web / StellarWP The Events Calendar · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Zuke: Command-form registry descriptors bypass the MCP launch policy](https://agentprime.io/advisories/CVE-2026-119287.md)
  `CVE-2026-119287` · CVE record: zuke-build zuke · CVSS 8.0 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62141.md)
  `CVE-2026-62141` · CVE record: WP ManageNinja LLC Fluent CRM · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route](https://agentprime.io/advisories/CVE-2026-119710.md)
  `CVE-2026-119710` · CVE record: pipeshub-ai pipeshub-ai · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name](https://agentprime.io/advisories/CVE-2026-119708.md)
  `CVE-2026-119708` · CVE record: colinin abp-next-admin · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [SonicJS through 3.0.0 Missing Authorization in Content Write API](https://agentprime.io/advisories/CVE-2026-119707.md)
  `CVE-2026-119707` · CVE record: SonicJs-Org sonicjs · CVSS 7.1 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation](https://agentprime.io/advisories/CVE-2026-119702.md)
  `CVE-2026-119702` · CVE record: WPGraphQL WPGraphQL · CVSS 6.9 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-116407.md)
  `CVE-2026-116407` · CVE record: Webba Plugins Webba Booking · CVSS 5.4 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-119368.md)
  `CVE-2026-119368` · CVE record: Liquid Web / StellarWP The Events Calendar · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [WordPress JetFormBuilder plugin <= 3.6.7.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-119482.md)
  `CVE-2026-119482` · CVE record: Crocoblock JetFormBuilder · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Collabora Online: Read-only session authorization bypass permits live document edits](https://agentprime.io/advisories/CVE-2026-46499.md)
  `CVE-2026-46499` · CVE record: CollaboraOnline online · CVSS 4.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression)](https://agentprime.io/advisories/CVE-2026-61739.md)
  `CVE-2026-61739` · CVE record: socfortress CoPilot · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Authentication bypass, Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTMwVDE0OjUwOjIzLjI5MjAwMFoiLCJDVkUtMjAyNi02MTczOSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTEwLTMwVDIxOjMzOjU1Ljg5NDAwMFoiLCJDVkUtMjAyNi02MzExNSJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTEwLTMwVDIxOjMzOjU1Ljg5NDAwMFoiLCJDVkUtMjAyNi02MzExNSJd>. Everything for agents: <https://agentprime.io/llms.txt>.