Advisories · Weakness
Broken access control.
Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 6.5 Medium
Dagu MCP DAG specification read bypasses path containment and workspace isolation
- dagu
- Path traversal
- Broken access control
- CVSS 5.4 Medium
Kubeflow Pipelines: Cross-tenant execution-cache poisoning / output substitution via a namespace-blind cache key in the cache webhook (multi-user)
- kubeflow pipelines
- Broken access control
- CWE-345
- CVSS 9.6 CriticalCritical · CVSS 9+
Kubeflow Pipelines API server lacks authorization for shared pipeline uploads
- kubeflow pipelines
- Broken access control
- CVSS 7.2 High
Kubeflow Pipelines: RBAC bypass on shared pipelines allows any authenticated user to delete or modify global pipelines
- kubeflow pipelines
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Insecure direct object reference (IDOR) vulnerability in the MatchPoint API
- TPC Software Matchpoint
- Broken access control
- CVSS 9.0 CriticalCritical · CVSS 9+
Cronicle: Privilege Escalation via Arbitrary Environment Variable Injection through Event Params (Incomplete Fix for CVE-2026-39401)
- jhuckaby Cronicle
- Other injection
- Broken access control
- CVSS 9.6 CriticalCritical · CVSS 9+
OpenEMR: Missing Write ACL Allows Unauthorized Document Reassignment
- openemr
- Broken access control
- CVSS 6.5 Medium
OpenEMR: Missing authorization in person-search AJAX leaks patient demographics (name, DOB, phone, email)
- openemr
- Broken access control
- CVSS 5.4 Medium
OpenEMR: Weno `file_download.php`: missing ACL/CSRF truncates the e-prescribing pharmacy directory
- openemr
- Broken access control
- CVSS 6.5 Medium
OpenEMR: Missing authorization on QRDA Category I/III download endpoints
- openemr
- Broken access control
- CVSS 8.1 High
OpenEMR: Broken Access Control in controller.php Enables Insurance Routing Credential Hijack and PHI Enumeration
- openemr
- Broken access control
- CVSS 7.1 High
OpenEMR: Missing authorization in DORN `compendium_install.php` — non-admin destructive lab-compendium reinstall
- openemr
- Broken access control
- CVSS 6.5 Medium
OpenEMR: Missing authorization in payment patient-search AJAX leaks patient directory and dates of birth
- openemr
- Broken access control
- CVSS 7.1 High
OpenEMR: Arbitrary Patient Recall and Contact Detail Read
- openemr
- Broken access control
- CVSS 7.1 High
OpenEMR: Patient Data Search Without Sufficient ACL
- openemr
- Broken access control
- CVSS 6.5 Medium
OpenEMR: Missing Authorization on Document Template Download Endpoint Allows Any Authenticated User to Read Another Patient's PHI
- openemr
- Broken access control
- CVSS 7.8 High
Incorrect default permissions in Hewlett Packard Enterprise (HPE) HPE Cray Programming Environment
- Hewlett Packard Enterprise (HPE) HPE Cray Programming Environment
- Broken access control
- CVSS 7.1 High
SuiteCRM: V8 API Relationship Delete Bypasses Object-Level Authorization on the Related Record
- SuiteCRM
- Broken access control
- CVSS 7.1 High
SuiteCRM: Mass Assignment in V8 API Allows Modification of Sensitive User Fields (user_hash, external_auth_only)
- SuiteCRM
- Broken access control
- CVSS 7.1 High
SuiteCRM V8 JSON:API processAttributes() Missing ID Filter Allows ACL Bypass and Record Ownership Hijack
- SuiteCRM
- Broken access control
- CVSS 6.5 Medium
SuiteCRM: Authorization Bypass via Document Revision ID Confusion in download.php
- SuiteCRM
- Broken access control
- CVSS 8.1 High
SuiteCRM: Incorrect Access Control in V8 relationship creation via missing edit authorization
- SuiteCRM
- Broken access control
- CVSS 6.5 Medium
SuiteCRM: IDOR in generatePdf Entry Point Allows Record Data Exfiltration
- SuiteCRM
- Broken access control
- CVSS 6.5 Medium
SuiteCRM: Record-level Authorization Bypass via AOR_Reports changeReportPage
- SuiteCRM
- Broken access control
- CVSS 7.1 High
SuiteCRM: Non-admin user creates SchedulersJob: SSRF via cron
- SuiteCRM
- Broken access control
- Server-side request forgery (SSRF)
- CVSS 6.9 Medium
Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6
- tassos.gr Advanced Custom Fields extension for Joomla
- tassos.gr Smile Pack extension for Joomla
- Broken access control
- CVSS 6.9 Medium
Joomla Extension - balbooa.com - Unauthenticated deletion of submission/field files in Gridbox < 2.20.5.0
- balbooa.com Gridbox extension for Joomla
- Broken access control
- CVSS 7.2 High
Incorrect Authorization in Altium 365 Git Service Allows Unauthorized Repository Writes
- Altium 365
- Broken access control
- CWE-20
- CVSS 8.4 High
lxd allows Cross-guest volume hijack via DevLXD device patch
- Broken access control
>=0.0.0-20250721152936-fe86ceb2c3fa, <0.0.0-20260626085133-7cb96ac80a6d · fixed in 0.0.0-20260626085133-7cb96ac80a6d
GHSA-hhf9-qw4v-72xp · CVE-2026-12411 - CVSS 5.9 Medium
HedgeDoc: Missing validation of incoming permission values on change
- hedgedoc
- Broken access control
- CWE-20
- CVSS 8.8 High
Immich: Album Editor can escalate to Owner role and remove Owner-role members via unguarded API endpoints
- immich
- Privilege escalation
- Broken access control
- CVSS 4.3 Medium
Immich calendar heatmap endpoint discloses cross-user activity through broken access control
- immich
- Broken access control
- CWE-1220
- CVSS 8.8 High
OpenHuman: Bearer token leak via process environment variable on macOS (same-UID local RCE primitive)
- tinyhumansai openhuman
- Broken access control
- CWE-526
- CVSS 9.8 CriticalCritical · CVSS 9+
OpenHuman allows remote inbound channel messages to create unapproved shell cron jobs leading to host command execution
- tinyhumansai openhuman
- Command injection
- Broken access control
- CVSS 9.0 CriticalCritical · CVSS 9+
OpenHuman: Yuanbao non-web channel can bypass human approval to execute `node_exec`
- tinyhumansai openhuman
- Code injection
- Broken access control
- CVSS 6.6 Medium
Dnf5daemon-server: dnf5: dnf5daemon-server: missing session-owner check allows foreign d-bus callers to replace another client's resolved transaction
- Red Hat Hardened Images
- Broken access control
- CVSS 6.1 Medium
OpenHuman: Embedded Google Meet webview can silently capture the macOS desktop without a user gesture
- tinyhumansai openhuman
- Broken access control
- Information disclosure
- CVSS 8.1 High
Keycloak-services: keycloak-services: uma protection api resourcetype field not validated — cross-owner resource access
- Red Hat Build of Keycloak
- Red Hat Single Sign-On 7
- Broken access control
- CVSS 6.9 Medium
Content Egg WordPress Plugin < 12.1.0 Unauthenticated Information Disclosure via render-blocks
- keywordrush Content Egg – Affiliate Product Importer & Price Comparison
- Broken access control
- CVSS 5.3 Medium
Meelo through 3.13.1 Missing Authorization on Song, Track and Video Endpoints
- Arthi-chaud Meelo
- Broken access control
- CVSS 6.9 Medium
Chevereto before 4.5.8 Private Album Image Disclosure via get-album-contents
- Chevereto
- Broken access control
- CVSS 2.3 Low
eventyay-exhibition through commit f68888e Cross-Event Attendee Data Disclosure via Lead Creation API
- fossasia eventyay-exhibition
- Broken access control
- CVSS 2.3 Low
SplitPro through 2.1.6 Authorization Bypass via expense.getExpenseDetails
- oss-apps SplitPro
- Broken access control
- CVSS 5.3 Medium
SplitPro through 2.1.6 Authorization Bypass via user.getUserDetails tRPC Query
- oss-apps SplitPro
- Broken access control
-
Apache OFBiz: Unauthenticated HR organization and employee disclosure
- Apache Software Foundation Apache OFBiz
- Information disclosure
- Broken access control
-
Apache OFBiz: Authenticated path traversal and missing authorization check in replaceImageToExistImage
- Apache Software Foundation Apache OFBiz
- Path traversal
- Broken access control
-
Apache OFBiz: Missing authorization - catalog quick-admin product writes
- Apache Software Foundation Apache OFBiz
- Broken access control
-
Apache OFBiz: Authenticated path traversal and missing authorization check in imageCrop and imageRotate services
- Apache Software Foundation Apache OFBiz
- Path traversal
- Broken access control
-
Apache OFBiz: Authorization bypass - self-grant content OWNER
- Apache Software Foundation Apache OFBiz
- Broken access control
-
Apache OFBiz: Missing authorization - search-result bulk catalog mutation
- Apache Software Foundation Apache OFBiz
- Broken access control
- CVSS 4.3 Medium
Apache OFBiz: Unfiltered server-side URL fetch in webtools viewdatafile
- Apache Software Foundation Apache OFBiz
- Broken access control
- Server-side request forgery (SSRF)
- CVSS 7.5 High
Apache OFBiz: Unbounded multi-form row count from a parameter name
- Apache Software Foundation Apache OFBiz
- Denial of service
- Broken access control
- CVSS 7.1 High
Apache OFBiz: webtools xmldsdump exports any entity to any path
- Apache Software Foundation Apache OFBiz
- Path traversal
- Broken access control
-
Apache OFBiz: Unauthenticated disclosure through HR, Catalog, and Order Manager helpers
- Apache Software Foundation Apache OFBiz
- Information disclosure
- Broken access control
- CVSS 8.8 High
Apache OFBiz: Content Manager VIEW-only RCE in updateLayout
- Apache Software Foundation Apache OFBiz
- Broken access control
- CVSS 5.4 Medium
Apache OFBiz: Cross-tenant authorization bypass in mapped-domain login
- Apache Software Foundation Apache OFBiz
- Broken access control
-
Apache OFBiz: Authenticated Code Execution Vulnerability
- Apache Software Foundation Apache OFBiz
- Broken access control
- Code injection
-
Apache OFBiz: Missing Authorization vulnerability
- Apache Software Foundation Apache OFBiz
- Broken access control
-
Apache OFBiz: Missing authorization in payment application services allows view-only users to modify payment allocations
- Apache Software Foundation Apache OFBiz
- Broken access control
-
Apache OFBiz: Missing authorization in updateOrderItems allows view-only users to modify order prices and quantities
- Apache Software Foundation Apache OFBiz
- Broken access control