# Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

## Records, newest first (an older page)

- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121164.md)
  `CVE-2026-121164` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121194.md)
  `CVE-2026-121194` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121212.md)
  `CVE-2026-121212` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121116.md)
  `CVE-2026-121116` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121065.md)
  `CVE-2026-121065` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121088.md)
  `CVE-2026-121088` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121220.md)
  `CVE-2026-121220` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121075.md)
  `CVE-2026-121075` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121030.md)
  `CVE-2026-121030` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121040.md)
  `CVE-2026-121040` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121136.md)
  `CVE-2026-121136` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121103.md)
  `CVE-2026-121103` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121183.md)
  `CVE-2026-121183` · CVE record: Google Chrome · CVSS 8.3 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121231.md)
  `CVE-2026-121231` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121255.md)
  `CVE-2026-121255` · CVE record: Google Chrome · CVSS 6.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121039.md)
  `CVE-2026-121039` · CVE record: Google Chrome · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121248.md)
  `CVE-2026-121248` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121193.md)
  `CVE-2026-121193` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121066.md)
  `CVE-2026-121066` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121199.md)
  `CVE-2026-121199` · CVE record: Google Chrome · CVSS 5.5 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121063.md)
  `CVE-2026-121063` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121031.md)
  `CVE-2026-121031` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121062.md)
  `CVE-2026-121062` · CVE record: Google Chrome · No CVSS score · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121102.md)
  `CVE-2026-121102` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121060.md)
  `CVE-2026-121060` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121104.md)
  `CVE-2026-121104` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121071.md)
  `CVE-2026-121071` · CVE record: Google Chrome · CVSS 9.6 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121174.md)
  `CVE-2026-121174` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in Google Chrome](https://agentprime.io/advisories/CVE-2026-121107.md)
  `CVE-2026-121107` · CVE record: Google Chrome · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Certificate Name Authorization Bypass](https://agentprime.io/advisories/CVE-2026-115732.md)
  `CVE-2026-115732` · CVE record: Perforce Puppet Enterprise · CVSS 9.0 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control, CWE-697
- [Headless CMS Plugin REST API post get_required_post_data information disclosure](https://agentprime.io/advisories/CVE-2026-121509.md)
  `CVE-2026-121509` · CVE record: Headless CMS Plugin · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Information disclosure, Broken access control
- [node-opcua: Namespace-Level RBAC Fail-Open - Anonymous Write/Call Bypass via Unbound \`DefaultRolePermissions](https://agentprime.io/advisories/CVE-2026-95860.md)
  `CVE-2026-95860` · CVE record: node-opcua node-opcua · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control, CWE-636, CWE-1188
- [Broken Access Control Leading to Cross-Device Token Issuance in Tapo Cloud MQTT Proxy](https://agentprime.io/advisories/CVE-2026-105821.md)
  `CVE-2026-105821` · CVE record: TP-Link Systems Inc. Tapo Cloud Service · CVSS 8.3 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [traQ: Privilege escalation by OAuth prompt=none request](https://agentprime.io/advisories/CVE-2026-63198.md)
  `CVE-2026-63198` · CVE record: traPtitech traQ · CVSS 7.3 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [NetBox from 2.9.0 before 4.7.4 Authorization Bypass via BulkComponentCreateView](https://agentprime.io/advisories/CVE-2026-116845.md)
  `CVE-2026-116845` · CVE record: netbox-community netbox · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Lightdash 0.2609.0 before 3.137.0 Cross-Project IDOR via RenameService Dashboard Endpoints](https://agentprime.io/advisories/CVE-2026-121631.md)
  `CVE-2026-121631` · CVE record: lightdash lightdash · CVSS 2.3 Low · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [WordPress ClickCease Click Fraud Protection plugin <= 3.3.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-119509.md)
  `CVE-2026-119509` · CVE record: eranfl ClickCease Click Fraud Protection · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-97072.md)
  `CVE-2026-97072` · CVE record: myCred myCred · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [WordPress AnyWhere Elementor plugin <= 1.3.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-114187.md)
  `CVE-2026-114187` · CVE record: WPVibes AnyWhere Elementor · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [WordPress myCred plugin <= 4.0.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-103077.md)
  `CVE-2026-103077` · CVE record: myCred myCred · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-119485.md)
  `CVE-2026-119485` · CVE record: weDevs Dokan · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39777.md)
  `CVE-2026-39777` · CVE record: WC Lovers WCFM Membership · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [WordPress Dokan plugin <= 5.3.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-119487.md)
  `CVE-2026-119487` · CVE record: weDevs Dokan · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [WordPress Forminator plugin <= 1.58.3 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-116859.md)
  `CVE-2026-116859` · CVE record: WPMU DEV Forminator · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [WordPress WCFM Membership plugin <= 2.12.0 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-39743.md)
  `CVE-2026-39743` · CVE record: WC Lovers WCFM Membership · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [WordPress Uncanny Automator plugin <= 7.7.1 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-120846.md)
  `CVE-2026-120846` · CVE record: Uncanny Owl Uncanny Automator · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect Authorization in Elasticsearch Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-115298.md)
  `CVE-2026-115298` · CVE record: Elastic Elasticsearch · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-115295.md)
  `CVE-2026-115295` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Authorization Bypass Through User-Controlled Key in Kibana Leading to Information Disclosure](https://agentprime.io/advisories/CVE-2026-115292.md)
  `CVE-2026-115292` · CVE record: Elastic Kibana · CVSS 4.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [WordPress Better Search plugin <= 4.5.2 - Broken Access Control vulnerability](https://agentprime.io/advisories/CVE-2026-119495.md)
  `CVE-2026-119495` · CVE record: WebberZone Better Search · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [AshAuthentication TOTP setup lets a user install their own authenticator secret on another user's account](https://agentprime.io/advisories/GHSA-gx67-694c-655c.md)
  `GHSA-gx67-694c-655c`, `CVE-2026-119215`, `EEF-CVE-2026-119215` · Hex `ash_authentication`: affected `>=5.0.0-rc.0, <5.0.0-rc.16`, fixed in `5.0.0-rc.16` · CVSS 7.6 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Incorrect authorization in NVIDIA Slurm](https://agentprime.io/advisories/CVE-2026-65140.md)
  `CVE-2026-65140` · CVE record: NVIDIA Slurm · CVSS 5.7 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [Missing authorization in NVIDIA Slurm](https://agentprime.io/advisories/CVE-2026-65107.md)
  `CVE-2026-65107` · CVE record: NVIDIA Slurm · CVSS 6.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [CTFd 3.1.0 before 3.8.7 Information Disclosure via /api/v1/teams Endpoint](https://agentprime.io/advisories/CVE-2026-121562.md)
  `CVE-2026-121562` · CVE record: CTFd CTFd · CVSS 6.9 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [LogChimp before 0.9.3 Authorization Bypass via PATCH /api/v1/posts](https://agentprime.io/advisories/CVE-2026-121560.md)
  `CVE-2026-121560` · CVE record: logchimp logchimp · CVSS 7.1 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [AuditPilot before commit 4669c93 RAG Project-Scope Authorization Bypass via project_id](https://agentprime.io/advisories/CVE-2026-121558.md)
  `CVE-2026-121558` · CVE record: Ricky-7-Yan intelligent-audit-system · CVSS 2.3 Low · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [FastBee through 2.1.0 IDOR via /iot/product By-ID Endpoints](https://agentprime.io/advisories/CVE-2026-121556.md)
  `CVE-2026-121556` · CVE record: beecue FastBee · CVSS 8.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [domain-admin before 1.6.79 Missing Authorization via getGroupUserList](https://agentprime.io/advisories/CVE-2026-121552.md)
  `CVE-2026-121552` · CVE record: dromara domain-admin · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [smart-sso through 2.0.1 Incorrect Authorization in PermissionFilter Enables Admin Escalation](https://agentprime.io/advisories/CVE-2026-121543.md)
  `CVE-2026-121543` · CVE record: a466350665 smart-sso · CVSS 8.7 High · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control
- [DbGate before 7.3.3 Missing Authorization via /connections/test and /connections/save](https://agentprime.io/advisories/CVE-2026-121455.md)
  `CVE-2026-121455` · CVE record: dbgate dbgate · CVSS 5.3 Medium · Not analysed yet · Published 3 Nov 2026 · Tags: Broken access control

Newest: <https://agentprime.io/advisories/tag/access-control.md>
Older: <https://agentprime.io/advisories/tag/access-control.md?cursor=WyIyMDI2LTExLTAzVDE1OjE3OjAzLjgxNjAwMFoiLCJDVkUtMjAyNi0xMjE0NTUiXQ>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=access-control&cursor=WyIyMDI2LTExLTAzVDIwOjQyOjUxLjY1OTAwMFoiLCJDVkUtMjAyNi0xMjEwNDIiXQ>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/access-control/?cursor=WyIyMDI2LTExLTAzVDIwOjQyOjUxLjY1OTAwMFoiLCJDVkUtMjAyNi0xMjEwNDIiXQ>. Everything for agents: <https://agentprime.io/llms.txt>.