# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Import and export users and customers <= 2.5.11 - Authenticated (Custom+) Privilege Escalation via Non-Atomic Cron Settings Save](https://agentprime.io/advisories/CVE-2026-120554.md)
  `CVE-2026-120554` · CVE record: carazo Import and export users and customers · CVSS 8.8 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [IRISPowerscan Insecure default privilege assignment for installation account](https://agentprime.io/advisories/CVE-2026-94460.md)
  `CVE-2026-94460` · CVE record: I.R.I.S S.A. IRISPowerscan · CVSS 7.2 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [WordPress WCFM Marketplace plugin <= 3.8.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-62000.md)
  `CVE-2026-62000` · CVE record: WC Lovers WCFM Marketplace · CVSS 7.5 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [About Time Technologies｜Herowatch Go Server - Insecure Direct Object Reference](https://agentprime.io/advisories/CVE-2026-121817.md)
  `CVE-2026-121817` · CVE record: About Time Technologies Herowatch Go Server · CVSS 8.7 High · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Unvalidated user pointers in RTIO syscall verifiers allow a user-mode thread to write kernel memory](https://agentprime.io/advisories/CVE-2026-16511.md)
  `CVE-2026-16511` · CVE record: zephyrproject zephyr · CVSS 8.8 High · Not analysed yet · Published 4 Nov 2026 · Tags: Memory corruption, Broken access control
- [Premium Packages < 7.3.1 - Subscriber+ Guest Order Takeover](https://agentprime.io/advisories/CVE-2026-118407.md)
  `CVE-2026-118407` · CVE record: Unknown Premium Packages · CVSS 5.4 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Premium Packages < 7.3.1 - Unauthenticated Guest Order Status Disclosure](https://agentprime.io/advisories/CVE-2026-118403.md)
  `CVE-2026-118403` · CVE record: Unknown Premium Packages · CVSS 3.7 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [WP Roster < 2.36 - Unauthenticated Roster Data Modification](https://agentprime.io/advisories/CVE-2026-115257.md)
  `CVE-2026-115257` · CVE record: Unknown WP Roster · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [WPvivid Backup & Migration < 0.9.137 - Admin+ Arbitrary Database Table Deletion via Snapshot ID](https://agentprime.io/advisories/CVE-2026-115241.md)
  `CVE-2026-115241` · CVE record: Unknown WPvivid — Backup, Migration & Staging · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Essential Real Estate 4.4.3 - 5.3.4 - Subscriber+ Arbitrary Media Attachment Deletion via IDOR](https://agentprime.io/advisories/CVE-2026-110964.md)
  `CVE-2026-110964` · CVE record: Unknown Essential Real Estate · CVSS 6.5 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [FV Flowplayer Video Player 7.4.44.727 - 7.5.55.7212 - Contributor+ Bulk Video Record Disclosure and Modification via Migration Wizard](https://agentprime.io/advisories/CVE-2026-108068.md)
  `CVE-2026-108068` · CVE record: Unknown FV Flowplayer Video Player · CVSS 3.8 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [FV Flowplayer Video Player < 7.5.56.7212 - Contributor+ Arbitrary Video and Meta Record Deletion, Video Modification and Meta Disclosure via IDOR](https://agentprime.io/advisories/CVE-2026-108067.md)
  `CVE-2026-108067` · CVE record: Unknown FV Flowplayer Video Player · CVSS 3.8 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Booking Package < 1.7.34 - Unauthenticated Payment Bypass](https://agentprime.io/advisories/CVE-2026-106000.md)
  `CVE-2026-106000` · CVE record: Unknown Booking Package · CVSS 5.3 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Unpublished Product Purchase via mollie_paypal_create_order](https://agentprime.io/advisories/CVE-2026-101166.md)
  `CVE-2026-101166` · CVE record: Unknown Mollie Payments for WooCommerce · CVSS 3.7 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Mollie Payments for WooCommerce < 8.2.0 - Unauthenticated Payment Surcharge Bypass via update_surcharge_order_pay](https://agentprime.io/advisories/CVE-2026-101165.md)
  `CVE-2026-101165` · CVE record: Unknown Mollie Payments for WooCommerce · CVSS 3.7 Low · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Linksys E5600 Factory Quality Control fqc.cgi information disclosure](https://agentprime.io/advisories/CVE-2026-121618.md)
  `CVE-2026-121618` · CVE record: Linksys E5600 · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Information disclosure, Broken access control
- [Missing authorization in ASUS Armoury Crate](https://agentprime.io/advisories/CVE-2026-110464.md)
  `CVE-2026-110464` · CVE record: ASUS Armoury Crate · CVSS 6.9 Medium · Not analysed yet · Published 4 Nov 2026 · Tags: Broken access control
- [Quest Foglight for Databases Incorrect Permission Assignment Local Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-92200.md)
  `CVE-2026-92200` · CVE record: Quest Foglight for Databases · CVSS 7.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Quest Foglight for Databases runScript Incorrect Authorization Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2026-92191.md)
  `CVE-2026-92191` · CVE record: Quest Foglight for Databases · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [MLflow Tracking Server Issues Missing Authorization Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-118626.md)
  `CVE-2026-118626` · CVE record: MLflow MLflow · CVSS 5.4 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [MLflow Tracking Server Missing Authorization Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2026-118625.md)
  `CVE-2026-118625` · CVE record: MLflow MLflow · CVSS 6.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [MLflow Tracking Server Jobs Missing Authorization Information Disclosure Vulnerability](https://agentprime.io/advisories/CVE-2026-118624.md)
  `CVE-2026-118624` · CVE record: MLflow MLflow · CVSS 5.4 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [InfiniFlow RAGFlow Text To SQL Retrieval sql.go RunSQL authorization](https://agentprime.io/advisories/CVE-2026-121585.md)
  `CVE-2026-121585` · CVE record: InfiniFlow RAGFlow · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Sanluan PublicCMS TradePaymentService.java TradePaymentService.pendingRefund authorization](https://agentprime.io/advisories/CVE-2026-121583.md)
  `CVE-2026-121583` · CVE record: Sanluan PublicCMS · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Umami Record API Endpoint route.ts authorization](https://agentprime.io/advisories/CVE-2026-121582.md)
  `CVE-2026-121582` · CVE record: Umami · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [ZaneOps 1.14.0 before 1.15.2 Cross-Workspace Information Disclosure via ReviewPreviewEnvDeployAPIView](https://agentprime.io/advisories/CVE-2026-121734.md)
  `CVE-2026-121734` · CVE record: zane-ops zane-ops · CVSS 6.0 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [RosarioSIS before 12.9 Improper Authorization via Student Billing Mass Assignment](https://agentprime.io/advisories/CVE-2026-121732.md)
  `CVE-2026-121732` · CVE record: francoisjacquet RosarioSIS · CVSS 2.1 Low · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [emailflare before commit cf31f33 Missing Authorization via Inbox Compose Endpoint](https://agentprime.io/advisories/CVE-2026-121730.md)
  `CVE-2026-121730` · CVE record: 0xdps emailflare · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [emailflare before commit cf31f33 Missing Authorization via /api/keys Routes](https://agentprime.io/advisories/CVE-2026-121729.md)
  `CVE-2026-121729` · CVE record: 0xdps emailflare · CVSS 7.2 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [SourceHut meta.sr.ht 0.56.11 before 0.89.0 Registration Authorization Bypass via /register/step2](https://agentprime.io/advisories/CVE-2026-121728.md)
  `CVE-2026-121728` · CVE record: SourceHut meta.sr.ht · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [miroslavpejic85 MiroTalk P2P Socket I/O server.js CheckPassword access control](https://agentprime.io/advisories/CVE-2026-121539.md)
  `CVE-2026-121539` · CVE record: miroslavpejic85 MiroTalk P2P · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Privilege escalation, Broken access control
- [Tanium addressed an improper access controls vulnerability in Enforce.](https://agentprime.io/advisories/CVE-2026-116661.md)
  `CVE-2026-116661` · CVE record: Tanium Enforce · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Tanium addressed an improper access controls vulnerability in Discover.](https://agentprime.io/advisories/CVE-2026-116667.md)
  `CVE-2026-116667` · CVE record: Tanium Discover · CVSS 4.2 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Tanium addressed an improper access controls vulnerability in Discover.](https://agentprime.io/advisories/CVE-2026-116664.md)
  `CVE-2026-116664` · CVE record: Tanium Discover · CVSS 3.1 Low · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Tanium addressed an improper access controls vulnerability in Enforce.](https://agentprime.io/advisories/CVE-2026-116663.md)
  `CVE-2026-116663` · CVE record: Tanium Enforce · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Tanium addressed an improper access controls vulnerability in Discover.](https://agentprime.io/advisories/CVE-2026-116669.md)
  `CVE-2026-116669` · CVE record: Tanium Discover · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Bake filesystem path entitlements approval can be skipped in some multi-target builds](https://agentprime.io/advisories/CVE-2026-121541.md)
  `CVE-2026-121541` · CVE record: Docker Docker Buildx · CVSS 5.6 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-120930.md)
  `CVE-2026-120930` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121195.md)
  `CVE-2026-121195` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121169.md)
  `CVE-2026-121169` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121142.md)
  `CVE-2026-121142` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121232.md)
  `CVE-2026-121232` · CVE record: Google Chrome · CVSS 5.1 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121041.md)
  `CVE-2026-121041` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121029.md)
  `CVE-2026-121029` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121225.md)
  `CVE-2026-121225` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121205.md)
  `CVE-2026-121205` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121159.md)
  `CVE-2026-121159` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121085.md)
  `CVE-2026-121085` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121251.md)
  `CVE-2026-121251` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121172.md)
  `CVE-2026-121172` · CVE record: Google Chrome · CVSS 5.4 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121253.md)
  `CVE-2026-121253` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121101.md)
  `CVE-2026-121101` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121111.md)
  `CVE-2026-121111` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121252.md)
  `CVE-2026-121252` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121157.md)
  `CVE-2026-121157` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121222.md)
  `CVE-2026-121222` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121046.md)
  `CVE-2026-121046` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121167.md)
  `CVE-2026-121167` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121091.md)
  `CVE-2026-121091` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121042.md)
  `CVE-2026-121042` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTExLTAzVDIwOjQyOjUxLjY1OTAwMFoiLCJDVkUtMjAyNi0xMjEwNDIiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTExLTA0VDEwOjQ0OjE3LjM2NzAwMFoiLCJDVkUtMjAyNi0xMDAyNTIiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTExLTA0VDEwOjQ0OjE3LjM2NzAwMFoiLCJDVkUtMjAyNi0xMDAyNTIiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.