# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [OpenCSG CSGHub through v2.6.0-ce Unauthenticated Private Repository File Read via Resolve Route](https://agentprime.io/advisories/CVE-2026-120426.md)
  `CVE-2026-120426` · CVE record: OpenCSG CSGHub · CVSS 8.7 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Chatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint](https://agentprime.io/advisories/CVE-2026-120425.md)
  `CVE-2026-120425` · CVE record: munafio Chatify · CVSS 7.1 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Product Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAX](https://agentprime.io/advisories/CVE-2026-120318.md)
  `CVE-2026-120318` · CVE record: Codeixer Product Gallery Slider & Additional Variation Images for WooCommerce · CVSS 8.6 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Apache Syncope: Delegated administration boundaries can be bypassed for Realm update](https://agentprime.io/advisories/CVE-2026-113511.md)
  `CVE-2026-113511` · CVE record: Apache Software Foundation Apache Syncope · No CVSS score · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Warracker before 1.0.4 Missing Authorization via Paperless-ngx Document Linking](https://agentprime.io/advisories/CVE-2026-120463.md)
  `CVE-2026-120463` · CVE record: sassanix Warracker · CVSS 6.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's eta-register](https://agentprime.io/advisories/CVE-2026-92886.md)
  `CVE-2026-92886` · CVE record: TÜBİTAK BİLGEM Software Technologies Research Institute eta-register · CVSS 7.8 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Incorrect permission assignment in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-91904.md)
  `CVE-2026-91904` · CVE record: Dell OpenManage Enterprise · CVSS 5.5 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Incorrect permission assignment in Dell OpenManage Enterprise](https://agentprime.io/advisories/CVE-2026-91906.md)
  `CVE-2026-91906` · CVE record: Dell OpenManage Enterprise · CVSS 5.5 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions](https://agentprime.io/advisories/CVE-2025-11969.md)
  `CVE-2025-11969` · CVE record: WSO2 WSO2 API Manager and 4 more · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Incorrect permission assignment in MediaTek, Inc. MediaTek chipset](https://agentprime.io/advisories/CVE-2026-68591.md)
  `CVE-2026-68591` · CVE record: MediaTek, Inc. MediaTek chipset · CVSS 6.7 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [samanhappy MCPHub passthroughHeaders.ts information disclosure](https://agentprime.io/advisories/CVE-2026-120323.md)
  `CVE-2026-120323` · CVE record: samanhappy MCPHub · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure, Broken access control
- [Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization](https://agentprime.io/advisories/CVE-2026-120319.md)
  `CVE-2026-120319` · CVE record: Sanluan PublicCMS · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component](https://agentprime.io/advisories/CVE-2026-82705.md)
  `CVE-2026-82705` · CVE record: Apache Software Foundation Apache Wicket · CVSS 6.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Apache Wicket: A listener is invoked on a page instance the request itself created and never configured](https://agentprime.io/advisories/CVE-2026-82704.md)
  `CVE-2026-82704` · CVE record: Apache Software Foundation Apache Wicket · CVSS 6.9 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke](https://agentprime.io/advisories/CVE-2026-82558.md)
  `CVE-2026-82558` · CVE record: Apache Software Foundation Apache Wicket · CVSS 2.3 Low · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission](https://agentprime.io/advisories/CVE-2026-82557.md)
  `CVE-2026-82557` · CVE record: Apache Software Foundation Apache Wicket · CVSS 6.9 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource](https://agentprime.io/advisories/CVE-2026-82115.md)
  `CVE-2026-82115` · CVE record: Apache Software Foundation Apache Wicket · CVSS 6.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [ag-ui-protocol ag-ui HttpAgent http.ts information disclosure](https://agentprime.io/advisories/CVE-2026-120233.md)
  `CVE-2026-120233` · CVE record: ag-ui-protocol ag-ui · CVSS 6.9 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure, Broken access control
- [Oray Pugongying X5 Pro API Authorization run_async_task improper authorization](https://agentprime.io/advisories/CVE-2026-120224.md)
  `CVE-2026-120224` · CVE record: Oray Pugongying X5 Pro · CVSS 9.4 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Privilege escalation, Broken access control
- [Gitea user and organization feed token scope bypass](https://agentprime.io/advisories/CVE-2026-119625.md)
  `CVE-2026-119625` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea private pull request disclosure on project boards](https://agentprime.io/advisories/CVE-2026-119533.md)
  `CVE-2026-119533` · CVE record: Gitea Gitea · CVSS 7.5 High · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea public-only token bypass on bulk organization repository deletion](https://agentprime.io/advisories/CVE-2026-119441.md)
  `CVE-2026-119441` · CVE record: Gitea Gitea · CVSS 7.5 High · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea issue changes on archived repositories through the API](https://agentprime.io/advisories/CVE-2026-118504.md)
  `CVE-2026-118504` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea public-only token bypass in repository and organization creation](https://agentprime.io/advisories/CVE-2026-118395.md)
  `CVE-2026-118395` · CVE record: Gitea Gitea · CVSS 7.5 High · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea OAuth2 userinfo private group disclosure to public-only tokens](https://agentprime.io/advisories/CVE-2026-118394.md)
  `CVE-2026-118394` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure, Broken access control
- [Gitea public-only package token access to private OCI blobs](https://agentprime.io/advisories/CVE-2026-117685.md)
  `CVE-2026-117685` · CVE record: Gitea Gitea · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea private issue disclosure through issue dependency timeline events](https://agentprime.io/advisories/CVE-2026-117649.md)
  `CVE-2026-117649` · CVE record: Gitea Gitea · CVSS 3.5 Low · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure, Broken access control
- [Gitea private repository listing to public-only tokens on profiles](https://agentprime.io/advisories/CVE-2026-117646.md)
  `CVE-2026-117646` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea admin API public-only token scope bypass](https://agentprime.io/advisories/CVE-2026-117635.md)
  `CVE-2026-117635` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control, CWE-1259
- [Gitea archived repository release, milestone and label modification](https://agentprime.io/advisories/CVE-2026-116296.md)
  `CVE-2026-116296` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea public-only token bypass through Actions runner registration](https://agentprime.io/advisories/CVE-2026-116289.md)
  `CVE-2026-116289` · CVE record: Gitea Gitea · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Gitea Actions task token private repository enumeration](https://agentprime.io/advisories/CVE-2026-112887.md)
  `CVE-2026-112887` · CVE record: Gitea Gitea · CVSS 4.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure, Broken access control
- [Gitea OAuth2 account auto-linking takeover through the sign-up form](https://agentprime.io/advisories/CVE-2026-120263.md)
  `CVE-2026-120263` · CVE record: Gitea Gitea · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 1 Nov 2026 · Tags: Authentication bypass, Broken access control
- [Gitea Actions fork workflow trust through pull request review commit](https://agentprime.io/advisories/CVE-2026-118386.md)
  `CVE-2026-118386` · CVE record: Gitea Gitea · CVSS 6.5 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields](https://agentprime.io/advisories/CVE-2026-113481.md)
  `CVE-2026-113481` · CVE record: Unknown Media Library Assistant · CVSS 4.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing](https://agentprime.io/advisories/CVE-2026-107343.md)
  `CVE-2026-107343` · CVE record: Unknown Kali Forms — Contact Form & Drag-and-Drop Builder · CVSS 4.3 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Broken access control
- [Presenton Desktop Authentication Middleware app_data information disclosure](https://agentprime.io/advisories/CVE-2026-120192.md)
  `CVE-2026-120192` · CVE record: Presenton · CVSS 6.9 Medium · Not analysed yet · Published 1 Nov 2026 · Tags: Information disclosure, Broken access control
- [Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes](https://agentprime.io/advisories/CVE-2026-120200.md)
  `CVE-2026-120200` · CVE record: gnmyt Nexterm · CVSS 5.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [LearnHouse before 1.1.1 Missing Authorization via Assignment Submissions API](https://agentprime.io/advisories/CVE-2026-120199.md)
  `CVE-2026-120199` · CVE record: learnhouse learnhouse · CVSS 5.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access](https://agentprime.io/advisories/CVE-2026-118598.md)
  `CVE-2026-118598` · CVE record: GNOME Epiphany · CVSS 6.5 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux\_\<opt_name> JavaScript](https://agentprime.io/advisories/CVE-2026-103997.md)
  `CVE-2026-103997` · CVE record: davidanderson Redux Framework · CVSS 6.5 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement](https://agentprime.io/advisories/CVE-2025-11455.md)
  `CVE-2025-11455` · CVE record: tigroumeow Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF · CVSS 4.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [WP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter](https://agentprime.io/advisories/CVE-2026-110023.md)
  `CVE-2026-110023` · CVE record: peterschulznl WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps · CVSS 5.9 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [Product Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings\[default_query\] Parameter](https://agentprime.io/advisories/CVE-2026-11396.md)
  `CVE-2026-11396` · CVE record: woobewoo Product Filter for WooCommerce by WBW · CVSS 5.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate\_\*) AJAX…](https://agentprime.io/advisories/CVE-2026-109386.md)
  `CVE-2026-109386` · CVE record: wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups · CVSS 4.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action](https://agentprime.io/advisories/CVE-2026-116557.md)
  `CVE-2026-116557` · CVE record: murgroland WP Booking System – Booking Calendar · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters](https://agentprime.io/advisories/CVE-2026-89270.md)
  `CVE-2026-89270` · CVE record: popupbuilder Popup Builder – Create highly converting, mobile friendly marketing popups. · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback](https://agentprime.io/advisories/CVE-2026-94361.md)
  `CVE-2026-94361` · CVE record: Unknown Payable Payment Gateway for WooCommerce · CVSS 5.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route](https://agentprime.io/advisories/CVE-2026-118638.md)
  `CVE-2026-118638` · CVE record: Unknown Mapster WP Maps · CVSS 7.5 High · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [Premium Packages < 7.2.2 - Unauthenticated Order Total Manipulation](https://agentprime.io/advisories/CVE-2026-118184.md)
  `CVE-2026-118184` · CVE record: Unknown Premium Packages · CVSS 5.3 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters](https://agentprime.io/advisories/CVE-2026-92294.md)
  `CVE-2026-92294` · CVE record: brainstormforce Spectra Legacy – Gutenberg Blocks · CVSS 6.5 Medium · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers](https://agentprime.io/advisories/CVE-2026-110176.md)
  `CVE-2026-110176` · CVE record: Drupal File Force Download · CVSS 8.7 High · Not analysed yet · Published 31 Oct 2026 · Tags: Broken access control
- [Field Collection for Drupal 7 access bypass via missing parent entity access check](https://agentprime.io/advisories/CVE-2026-77152.md)
  `CVE-2026-77152` · CVE record: Drupal Field Collection for Drupal 7 · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs](https://agentprime.io/advisories/GHSA-wg5q-x4j9-qm54.md)
  `GHSA-wg5q-x4j9-qm54`, `CVE-2026-118759`, `GO-2026-6900` · Go `github.com/kubeflow/pipelines`: affected `<0.0.0-20260904182349-be4723e33727`, fixed in `0.0.0-20260904182349-be4723e33727` · CVSS 7.5 High · Not analysed yet · Published 30 Oct 2026 · Tags: Information disclosure, Broken access control
- [Authlib RFC 7592 examples omit registration-access-token client binding](https://agentprime.io/advisories/GHSA-c73q-w75p-j82v.md)
  `GHSA-c73q-w75p-j82v`, `CVE-2026-116672` · PyPI `authlib`: affected `>=0.15, <1.9.1`, fixed in `1.9.1` · CVSS 8.8 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control, CWE-1188
- [Nuxt: Dot segments in the request path bypass \`server/middleware\` path checks and server route rules on page routes](https://agentprime.io/advisories/GHSA-9v7c-q64q-vv33.md)
  `GHSA-9v7c-q64q-vv33`, `CVE-2026-119200` · npm `nuxt` and 1 more: affected `>=4.6.0, <4.6.3`, fixed in `4.6.3` · CVSS 6.5 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control, CWE-41, CWE-436
- [russh: Agent server never calls \`Agent::confirm\`, so keys added with the confirm constraint (\`ssh-add -c\`) sign without confirmation](https://agentprime.io/advisories/GHSA-vp5q-ff62-jwqv.md)
  `GHSA-vp5q-ff62-jwqv`, `CVE-2026-116794` · crates.io `russh`: affected `<0.65`, fixed in `0.65` · CVSS 8.3 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client](https://agentprime.io/advisories/GHSA-7984-qgvg-3j9c.md)
  `GHSA-7984-qgvg-3j9c`, `CVE-2026-118669` · PyPI `oauthlib`: affected `<4.0.0`, fixed in `4.0.0` · CVSS 8.4 High · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [OpenWISP Controller CA CRL REST API does not scope requests to managed organizations](https://agentprime.io/advisories/GHSA-9gh4-xw24-9xh5.md)
  `GHSA-9gh4-xw24-9xh5`, `CVE-2026-116677` · PyPI `openwisp-controller`: affected `>=1.0.0, <1.3.2`, fixed in `1.3.2` · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control
- [Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser](https://agentprime.io/advisories/CVE-2026-63401.md)
  `CVE-2026-63401` · CVE record: roostorg coop · CVSS 5.3 Medium · Not analysed yet · Published 30 Oct 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTEwLTMwVDIyOjQzOjMxLjk2OTAwMFoiLCJDVkUtMjAyNi02MzQwMSJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTExLTAyVDE0OjI4OjUyLjk1ODAwMFoiLCJDVkUtMjAyNi0xMjA0MjciXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTExLTAyVDE0OjI4OjUyLjk1ODAwMFoiLCJDVkUtMjAyNi0xMjA0MjciXQ>. Everything for agents: <https://agentprime.io/llms.txt>.