Broken access control.

InvoicePlane: Failure to Revoke Administrative Privileges After Role Downgrade

• InvoicePlane
• Broken access control

Missing permission check in the Translate sandbox doRemind action

• Wikimedia Foundation Mediawiki - Translate Extension
• Broken access control

RustDesk before 1.5.0 One-Way File Transfer Bypass

• rustdesk
• Broken access control

RustDesk before 1.5.0 Missing Authorization Check on Incoming File Clipboard Messages

• rustdesk
• Broken access control

Knowns Unrestricted Path Traversal leading to out-of-bounds arbitrary .md file read, write, and deletion in MCP Docs + Memory Tools

• Path traversal
• Authentication bypass

<0.30.0 · fixed in 0.30.0

OpenZeppelin Confidential Contracts `VestingWalletConfidential`: a malicious ERC-7984 token is able to extract private data from the vesting wallet

• Broken access control

<0.3.2 || >=0.4.0-rc.0, <0.4.2 || >=0.5.0-rc.0, <0.5.2 · fixed in 0.3.2, 0.4.2, 0.5.2

TDuck survey form through 6.0 Fill-In Restriction Bypass via Authenticated Submission Endpoint

• TDuckCloud tduck-survey-form
• Broken access control

TDuck survey form through 6.0 Missing Authorization in Form Theme Management Endpoints

• TDuckCloud tduck-survey-form
• Broken access control

GLPI: Arbitrary Document Read via Form Context Authorization Bypass

• glpi
• Broken access control

GLPI: Privilege Escalation via authtype API manipulation

• glpi
• Broken access control

GLPI: Unallowed modfication of knowbase items comments and translations

• glpi
• Broken access control

GLPI: Unallowed authentication method update by administrator

• glpi
• Broken access control

GLPI: Unexpected access to update operations through the API

• glpi
• Broken access control

Zammad: Authenticated agents can read AI summary error messages from inaccessible tickets

• zammad
• Broken access control

Zammad: IDOR in External Data Source rendering exposes ticket, user, group, and organization data

• zammad
• Information disclosure
• Broken access control

Zammad: Missing Authorization in TagsController#list Allows Cross-Object Tag Enumeration

• zammad
• Broken access control

Zammad: Channel admins can read unauthorized attachments via signature rich-text body

• zammad
• Broken access control

X-SpringBoot through 6.0 Authorization Bypass via User Management

• yzcheng90 X-SpringBoot
• Broken access control

Zammad: Pending upload deletion bypass via legacy attachment endpoint

• zammad
• Broken access control

Zammad: Cross-User Taskbar Item Access Control Vulnerability

• zammad
• Information disclosure
• Broken access control

Zammad: Missing authorization in GraphQL mutation for suggesting knowledge base answers

• zammad
• Broken access control

Zammad: Incorrect Authorization and Improper Privilege Management

• zammad
• Privilege escalation
• Broken access control

Zammad: Missing authorization check in GitHub + GitLab integration allows cross-ticket data leak

• zammad
• Broken access control

Bludit CMS 3.22.0 Authorization Bypass via list-images/delete-image AJAX Endpoints

• Bludit CMS
• Broken access control

Bludit CMS 3.22.0 Missing Authorization via content-get-list AJAX Endpoint

• Bludit CMS
• Broken access control

Zammad: Titles of knowledge base answers will be shown across all categories via the global search

• zammad
• Information disclosure
• Broken access control

Bludit CMS 3.22.0 Mass Assignment Privilege Escalation via Pages::edit()

• Bludit CMS
• Broken access control

Zammad: Missing authorization on ticket attachment download

• zammad
• Broken access control

Zammad: Incorrect implementation of permission checks in the knowledge base module

• zammad
• Broken access control

RabbitMQ OAuth credential refresh retains revoked runtime tags

• rabbitmq-server
• Broken access control

RabbitMQ: Stored HTML Injection in RabbitMQ Management OAuth Error Handling

• rabbitmq-server
• Broken access control

Missing ownership check on the shared memory object named by the kitty askpass escape code

• Kovid Goyal kitty
• Broken access control

RabbitMQ: Incomplete fix for CVE-2026-44838: `escape_regex_char/1` does not escape `-`, leaving room for an MQTT topic permission bypass

• rabbitmq-server
• Broken access control

RabbitMQ: Web MQTT with PROXY Protocol enabled: a loopback-only user permission bypass

• rabbitmq-server
• Broken access control

RabbitMQ: AMQP 1.0 management `GET /bindings` exposes full binding topology to any authenticated AMQP user without resource/management permission checks

• rabbitmq-server
• Broken access control

Missing authorization in the kitty drag and drop protocol allows a client to obtain dragged file contents without a drop

• Kovid Goyal kitty
• Broken access control

RabbitMQ: Federation upstream skips vhost authorization allowing cross-vhost message access

• rabbitmq-server
• Broken access control

RabbitMQ: AMQP 1.0 management exchange.declare skips alternate-exchange permission check

• rabbitmq-server
• Broken access control

RabbitMQ: protected tag bypass via bulk-delete

• rabbitmq-server
• Broken access control

BerriAI LiteLLM < 1.101.0-rc.1 Tenant Isolation Bypass via Semantic Cache Layer

• BerriAI litellm
• Broken access control

InvoicePlane: Remote Code Execution via Writable Templates Directory

• InvoicePlane
• File inclusion
• Broken access control

InvoicePlane IDOR: Horizontal Privilege Escalation via Password Change Without Authorization Check

• InvoicePlane
• Broken access control

Zimbra Collaboration Suite OnlyOffice Integration Path Traversal Leading to Remote Code Execution via Unauthenticated /downloadas Request

• Zimbra Collaboration Suite (ZCS)
• Path traversal
• Broken access control

Ail Framework Crawler: Missing Cookiejar Authorization Check Allows Cross-Organization Cookiejar Attachment

• ail project ail framework
• Broken access control
• CWE-20

Broken authorization in Akia keyless entry lets an authenticated guest unlock other rooms

• akia
• Broken access control

MasterStudy LMS 1.9 - < 3.7.50 - Subscriber+ Membership Plan Quota and Category Restriction Bypass

• MasterStudy LMS
• Broken access control

Bookly < 28.3 - Unauthenticated Customer PII Update via Verification Bypass

• Bookly
• Broken access control

Modula Image Gallery <= 3.0.1 - Missing Authorization to Unauthenticated Private Gallery Image Disclosure via 'modula_gallery_id' and 'modula_image_id' Parameters

• wpchill Modula Image Gallery – Photo Grid & Video Gallery
• Broken access control

Modula Image Gallery <= 3.0.2 - Missing Authorization to Authenticated (Author+) Arbitrary File Deletion (Non-PHP) via 'file' Parameter

• wpchill Modula Image Gallery – Photo Grid & Video Gallery
• Broken access control

Keycloak-services: keycloak-services: fgap v2 composite-blind role mapping allows privilege escalation

• Red Hat build of Keycloak 26.6.8
• Red Hat Single Sign-On 7
• Broken access control

Private action arguments can be set by user input on the bulk destroy and bulk update paths in Ash

• Broken access control

>=2.17.15, <3.33.11 · fixed in 3.33.11

Online Scheduling and Appointment Booking System <= 28.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Booking Token Disclosure and Deletion via 'order_id' Parameter

• ladela Online Scheduling and Appointment Booking System – Bookly
• Broken access control

Online Scheduling and Appointment Booking System <= 28.2 - Unauthenticated Authorization Bypass via PHP Type Juggling via 'verification_code' Parameter Type Juggling via json_data

• ladela Online Scheduling and Appointment Booking System – Bookly
• Broken access control

Blog2Social: Social Media Auto Post & Scheduler <= 9.1.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Modification via Multiple AJAX Handlers

• pr-gateway Blog2Social: Social Media Auto Post & Scheduler
• Broken access control

Customer Reviews for WooCommerce <= 5.120.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via 'items[][media]' Parameter

• ivole Customer Reviews for WooCommerce
• Broken access control

OpenStation <= 1.1.7 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via AI Copilot Search Endpoint

• allterraindeveloper OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin
• Broken access control

Sanluan PublicCMS exportExcel/exportData SysUserAdminController.java CmsContentAdminController authorization

• Sanluan PublicCMS
• Broken access control

Incorrect authorization in phpIPAM

• phpIPAM
• Broken access control

Lemonldap::NG::Handler versions from 2.0.0 before 2.16.10, from 2.17.0 before 2.21.6, from 2.22.0 before 2.23.4 for Perl allow an equivalent spelling of a path to bypass the locationRules that restri…

• Broken access control
• CWE-180

ningzichun student-management-system cross-site request forgery

• ningzichun student-management-system
• Cross-site request forgery (CSRF)
• Broken access control