# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API](https://agentprime.io/advisories/CVE-2026-121442.md)
  `CVE-2026-121442` · CVE record: frappe hrms · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API](https://agentprime.io/advisories/CVE-2026-121435.md)
  `CVE-2026-121435` · CVE record: froxlor froxlor · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API](https://agentprime.io/advisories/CVE-2026-121434.md)
  `CVE-2026-121434` · CVE record: froxlor froxlor · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints](https://agentprime.io/advisories/CVE-2026-121430.md)
  `CVE-2026-121430` · CVE record: AzuraCast AzuraCast · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner](https://agentprime.io/advisories/CVE-2026-121418.md)
  `CVE-2026-121418` · CVE record: surrealdb surrealdb · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations](https://agentprime.io/advisories/CVE-2026-121416.md)
  `CVE-2026-121416` · CVE record: surrealdb surrealdb · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession](https://agentprime.io/advisories/CVE-2026-121413.md)
  `CVE-2026-121413` · CVE record: parse-community parse-server · CVSS 2.3 Low · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools](https://agentprime.io/advisories/CVE-2026-121458.md)
  `CVE-2026-121458` · CVE record: CoreBunch Instatic · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Inadequate authorization vulnerability in Alosuite’s user invitation functionality](https://agentprime.io/advisories/CVE-2026-108047.md)
  `CVE-2026-108047` · CVE record: AM System ALO Suite · CVSS 8.6 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Direct Object Reference (IDOR) vulnerability in Alosuite](https://agentprime.io/advisories/CVE-2026-108046.md)
  `CVE-2026-108046` · CVE record: AM System ALO Suite · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering](https://agentprime.io/advisories/CVE-2026-89293.md)
  `CVE-2026-89293` · CVE record: Eclipse Foundation Eclipse Mnestix · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control, CWE-602
- [TYPO3-EXT-SA-2026-038: Broken Access Control in extension "Frontend User Registration" (sf_register)](https://agentprime.io/advisories/PKSA-d3w6-c3np-2vn6.md)
  `PKSA-d3w6-c3np-2vn6`, `CVE-2026-120333` · Packagist `evoweb/sf-register`: affected `<13.2.5 || >=14.0.0, <14.0.3`, fixed in `13.2.5`, `14.0.3` · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [TYPO3-EXT-SA-2026-037: Information Disclosure in extension "Mail" (mail)](https://agentprime.io/advisories/PKSA-b657-vnvm-qnk7.md)
  `PKSA-b657-vnvm-qnk7`, `CVE-2026-120328` · Packagist `mediaessenz/mail`: affected `<3.12.5 || >=4.0.0, <4.2.0`, fixed in `3.12.5`, `4.2.0` · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [TYPO3-EXT-SA-2026-037: Broken Access Control in extension "Mail" (mail)](https://agentprime.io/advisories/PKSA-833v-cnnh-wds7.md)
  `PKSA-833v-cnnh-wds7`, `CVE-2026-120330` · Packagist `mediaessenz/mail`: affected `<3.12.5 || >=4.0.0, <4.2.0`, fixed in `3.12.5`, `4.2.0` · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet](https://agentprime.io/advisories/CVE-2026-121024.md)
  `CVE-2026-121024` · CVE record: AxxonSoft AxxonNet · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege](https://agentprime.io/advisories/CVE-2026-115231.md)
  `CVE-2026-115231` · CVE record: Eclipse Foundation Eclipse ThreadX · CVSS 8.5 High · Not analysed yet · Published 3 Nov 2026 · Tags: Privilege escalation, Broken access control
- [Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)](https://agentprime.io/advisories/CVE-2026-4052.md)
  `CVE-2026-4052` · CVE record: WSO2 WSO2 API Manager and 2 more · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Authentication Bypass](https://agentprime.io/advisories/CVE-2026-16900.md)
  `CVE-2026-16900` · CVE record: Zohocorp Log360 and 1 more · CVSS 7.5 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Improper Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-13594.md)
  `CVE-2026-13594` · CVE record: Zohocorp Log360 and 1 more · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers](https://agentprime.io/advisories/CVE-2025-1397.md)
  `CVE-2025-1397` · CVE record: WSO2 WSO2 Universal Gateway and 4 more · CVSS 4.8 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()](https://agentprime.io/advisories/CVE-2026-104647.md)
  `CVE-2026-104647` · CVE record: Unknown weMail · CVSS 3.8 Low · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation](https://agentprime.io/advisories/CVE-2026-106004.md)
  `CVE-2026-106004` · CVE record: Unknown DT LMS · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [DT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings Update](https://agentprime.io/advisories/CVE-2026-105993.md)
  `CVE-2026-105993` · CVE record: Unknown DT Directory Lite Addon · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary Post Deletion via azt_delete_item](https://agentprime.io/advisories/CVE-2026-115205.md)
  `CVE-2026-115205` · CVE record: Unknown AZEXO Store Locator · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [AI Alt Text Generator <= 2.7.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter](https://agentprime.io/advisories/CVE-2026-120578.md)
  `CVE-2026-120578` · CVE record: migkapa AI Alt Text Generator · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification](https://agentprime.io/advisories/CVE-2026-120561.md)
  `CVE-2026-120561` · CVE record: jetmonsters JetFormBuilder — Dynamic Blocks Form Builder · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters](https://agentprime.io/advisories/CVE-2026-120551.md)
  `CVE-2026-120551` · CVE record: aresit WP Compress – Instant Performance & Speed Optimization · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host](https://agentprime.io/advisories/CVE-2026-120091.md)
  `CVE-2026-120091` · CVE record: Temporal Technologies, Inc. Temporal Server · CVSS 8.7 High · Not analysed yet · Published 2 Nov 2026 · Tags: Command injection, Broken access control, CWE-749, CWE-1188
- [Missing authorization in Google Android XR](https://agentprime.io/advisories/CVE-2026-58873.md)
  `CVE-2026-58873` · CVE record: Google Android XR · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [EchoHS GeekezBrowser Public API status information disclosure](https://agentprime.io/advisories/CVE-2026-120503.md)
  `CVE-2026-120503` · CVE record: EchoHS GeekezBrowser · CVSS 4.8 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Information disclosure, Broken access control
- [Incorrect default permissions in Dell Alienware Command Center (AWCC)](https://agentprime.io/advisories/CVE-2026-91895.md)
  `CVE-2026-91895` · CVE record: Dell Alienware Command Center (AWCC) · CVSS 7.1 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-59005.md)
  `CVE-2026-59005` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-59003.md)
  `CVE-2026-59003` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-58994.md)
  `CVE-2026-58994` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-58989.md)
  `CVE-2026-58989` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-58986.md)
  `CVE-2026-58986` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-58969.md)
  `CVE-2026-58969` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-58951.md)
  `CVE-2026-58951` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-58870.md)
  `CVE-2026-58870` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-58867.md)
  `CVE-2026-58867` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-58866.md)
  `CVE-2026-58866` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-55261.md)
  `CVE-2026-55261` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Android](https://agentprime.io/advisories/CVE-2026-28621.md)
  `CVE-2026-28621` · CVE record: Google Android · CVSS 4.0 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Improper access control in Google Android](https://agentprime.io/advisories/CVE-2026-28588.md)
  `CVE-2026-28588` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Improper access control in Google Android](https://agentprime.io/advisories/CVE-2026-0053.md)
  `CVE-2026-0053` · CVE record: Google Android · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [psqlODBC log files are created with default permissions at a predictable path and follow symbolic links](https://agentprime.io/advisories/CVE-2026-120066.md)
  `CVE-2026-120066` · CVE record: PostgreSQL psqlODBC · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Path traversal, Broken access control
- [Munshi IDOR via Purchase Inquiry Thread Endpoint](https://agentprime.io/advisories/CVE-2026-119734.md)
  `CVE-2026-119734` · CVE record: Petpooja Munshi · CVSS 7.1 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Munshi Missing Authorization in Company Deletion API](https://agentprime.io/advisories/CVE-2026-119733.md)
  `CVE-2026-119733` · CVE record: Petpooja Munshi · CVSS 7.2 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Munshi Broken Object Level Authorization via Invoice Deletion API](https://agentprime.io/advisories/CVE-2026-119732.md)
  `CVE-2026-119732` · CVE record: Petpooja Munshi · CVSS 7.1 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3](https://agentprime.io/advisories/CVE-2026-105605.md)
  `CVE-2026-105605` · CVE record: dj-extensions.com DJ-Classifieds extension for Joomla · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation](https://agentprime.io/advisories/GHSA-j656-3hf2-fvjc.md)
  `GHSA-j656-3hf2-fvjc`, `CVE-2026-61789` · npm `@bytebase/dbhub`: affected `<0.22.6`, fixed in `0.22.6` · CVSS 6.1 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control, CWE-436
- [Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server](https://agentprime.io/advisories/CVE-2026-109142.md)
  `CVE-2026-109142` · CVE record: NLnet Labs Krill · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import](https://agentprime.io/advisories/CVE-2026-109141.md)
  `CVE-2026-109141` · CVE record: NLnet Labs Krill · CVSS 8.4 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own](https://agentprime.io/advisories/CVE-2026-115654.md)
  `CVE-2026-115654` · CVE record: Eclipse Foundation Eclipse ThreadX · CVSS 6.9 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft](https://agentprime.io/advisories/CVE-2026-120489.md)
  `CVE-2026-120489` · CVE record: Outline Outline · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades](https://agentprime.io/advisories/CVE-2026-120487.md)
  `CVE-2026-120487` · CVE record: LaraDashboard LaraDashboard · CVSS 8.6 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch](https://agentprime.io/advisories/CVE-2026-120461.md)
  `CVE-2026-120461` · CVE record: dromara Jpom · CVSS 8.7 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers](https://agentprime.io/advisories/CVE-2026-120460.md)
  `CVE-2026-120460` · CVE record: dromara Jpom · CVSS 8.7 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool](https://agentprime.io/advisories/CVE-2026-120450.md)
  `CVE-2026-120450` · CVE record: LaraDashboard LaraDashboard · CVSS 5.3 Medium · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control
- [DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint](https://agentprime.io/advisories/CVE-2026-120448.md)
  `CVE-2026-120448` · CVE record: doramart DoraCMS · CVSS 8.6 High · Not analysed yet · Published 2 Nov 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTExLTAyVDE0OjI5OjA3LjQ1NTAwMFoiLCJDVkUtMjAyNi0xMjA0NDgiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTExLTAzVDE1OjE3OjAzLjgxNjAwMFoiLCJDVkUtMjAyNi0xMjE0NTUiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTExLTAzVDE1OjE3OjAzLjgxNjAwMFoiLCJDVkUtMjAyNi0xMjE0NTUiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.