Advisories · Weakness

Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-95278 CVE record

CVSS 8.4 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95285 CVE record

CVSS 8.4 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95358 CVE record

CVSS 4.4 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95289 CVE record

CVSS 4.3 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95300 CVE record

CVSS 4.8 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95374 CVE record

CVSS 6.5 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95290 CVE record

CVSS 5.4 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95371 CVE record

CVSS 5.4 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95314 CVE record

CVSS 8.1 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95317 CVE record

CVSS 3.1 Low

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95320 CVE record

CVSS 5.4 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95302 CVE record

CVSS 2.9 Low

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95375 CVE record

CVSS 6.3 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95297 CVE record

CVSS 6.5 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95287 CVE record

CVSS 5.4 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95355 CVE record

CVSS 8.3 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-95301 CVE record

CVSS 8.1 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-102807 CVE record

CVSS 6.0 Medium

OpenClaw before 2026.9.4 Authorization Bypass via MCP App Standalone Ticket
- OpenClaw
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-102806 CVE record

CVSS 6.0 Medium

OpenClaw before 2026.9.5 Sandbox Isolation Bypass via Media Pipelines
- OpenClaw
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-101112 CVE record

CVSS 6.9 Medium

Joomla Extension - balbooa.com - Unauthorized Deletion of Attachments in Balbooa Forms < 2.4.3.4
- balbooa.com Balbooa Forms extension for Joomla
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-102697 CVE record

CVSS 8.5 High

Ollama 0.14.0 before 0.31.2 Experimental Agent Bash Approval Bypass via Prefix-Based Authorization
- ollama
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-92226 CVE record

CVSS 7.0 High

Joomla! Core - [20260913] - Core - Improper ACL checks for varous webservice edit tasks in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-90907 CVE record

CVSS 6.9 Medium

Joomla! Core - [20260902] - Core - Unauthorized user account creation via profile.save controller in Joomla 1.5.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-92223 CVE record

CVSS 5.1 Medium

Joomla! Core - [20260910] - Core - Improper ACL checks for workflow stage changes in Joomla 5.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-90917 CVE record

CVSS 6.9 Medium

Joomla! Core - [20260907] - Core - Improper ACL checks in outputs for tagged items in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-90916 CVE record

CVSS 5.1 Medium

Joomla! Core - [20260906] - Core - Improper ACL checks in content history comparison view in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-90913 CVE record

CVSS 7.0 High

Joomla! Core - [20260903] - Core - Improper ACL checks for access level webservice endpoints in Joomla 4.0.0-5.4.8, 6.0.0-6.1.3
- Joomla! Project Joomla! CMS
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-100240 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

TemplateSandbox does not check read permissions for the page being previewed
- Wikimedia Foundation Mediawiki - TemplateSandbox Extension
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-100289 CVE record

CVSS 5.0 Medium

Missing authorization in Devolutions Server
- Devolutions Server
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-92370 CVE record

CVSS 8.8 High

Remote Session Access Control Bypass Leading to Remote Code Execution
- TeamViewer Full Client
- TeamViewer Host
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-100287 CVE record

CVSS 5.4 Medium

Missing authorization in Devolutions Server
- Devolutions Server
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-93332 CVE record

CVSS 5.4 Medium

Missing authorization in Devolutions Server
- Devolutions Server
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-102568 CVE record

CVSS 6.8 Medium

Pardus Parental Control before 0.7.0 Incorrect Authorization via PPCActivator.py
- pardus-parental-control
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-97395 CVE record

CVSS 8.1 High

Apache Polaris: Allows authorized table writers to redirect server-side Iceberg FileIO requests to attacker-controlled endpoints using operation-scoped storage credentials
- Apache Software Foundation Apache Polaris
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-71897 CVE record

CVSS 4.3 Medium

Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-71898 CVE record

CVSS 4.3 Medium

Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-71899 CVE record

CVSS 6.5 Medium

Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-78214 CVE record

CVSS 5.3 Medium

Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-81569 CVE record

CVSS 4.3 Medium

Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-100758 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Sandbox escape in the DOM: Navigation component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-73598 CVE record

CVSS 7.8 High

Incorrect permission assignment in Dell Secure Connect Gateway (SCG) Policy Manager
- Dell Secure Connect Gateway (SCG) Policy Manager
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-101267 CVE record

CVSS 2.7 Low

Revenue information leak
- pretix
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-87748 CVE record

CVSS 8.8 High

Privilege Escalation via Account Takeover in Interprobe's Qorela DC
- Interprobe Information Technologies Inc. Qorela DC
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-4523 CVE record

CVSS 3.7 Low

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-8937 CVE record

CVSS 4.3 Medium

Missing Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-10518 CVE record

CVSS 4.3 Medium

Incorrect Authorization in GitLab
- GitLab
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-8067 CVE record

CVSS 6.5 Medium

Missing authorization in Hitachi Energy RTU500 series CMU firmware
- Hitachi Energy RTU500 series CMU firmware
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-92142 CVE record

CVSS 8.8 High

Apache Karaf: Authorization bypass in JMX MBean lifecycle operations
- Apache Software Foundation Apache Karaf
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-91085 CVE record

CVSS 6.3 Medium

Apache Karaf: config:install missing ACL entry allows privilege escalation to admin
- Apache Software Foundation Apache Karaf
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-91048 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Apache Karaf: Missing authorization on the jdbc:* shell command scope allows privilege escalation to remote code execution via jdbc:ds-create
- Apache Software Foundation Apache Karaf
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-102293 CVE record

CVSS 6.9 Medium

realjerrytang tacomall api-admin Backend ApiMaApplication.java OrgStaffServiceImpl.add improper authorization
- realjerrytang tacomall
- Privilege escalation
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-102263 CVE record

CVSS 5.1 Medium

mwasikz robo-cafe-rms manage-food.php unrestricted upload
- mwasikz robo-cafe-rms
- Broken access control
- Unrestricted file upload
Not analysed yet 29 Sept 2026
CVE-2026-102261 CVE record

CVSS 5.3 Medium

owen2345 Camaleon CMS Media Crop media_controller.rb crop authorization
- owen2345 Camaleon CMS
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-102249 CVE record

CVSS 6.9 Medium

REBUILD file-editor-save authorization
- REBUILD
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-97685 CVE record

CVSS 7.1 High

LimeSurvey Community Edition 7.3.0 - Cross-survey object authorization bypass in REST survey patch operations
- LimeSurvey
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-102373 CVE record

CVSS 7.1 High

GestSup before 3.2.62 Private Ticket Comment Disclosure via threadedit Parameter
- GestSup
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-79537 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

metatool-ai MetaMCP through 2.4.22 contains an insecure direct object reference (IDOR) in the MCP transport session dispatch.
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-79417 CVE record

CVSS 5.3 Medium

Improper Access Control in ArgusMonitor.sys in Argotronic eGbR ArgusMonitor 7.4.02 and earlier allows local, low-privileged users to bypass device handle access restrictions via a TOCTOU condition in…
- Broken access control
- Race condition
Not analysed yet 29 Sept 2026
CVE-2026-79348 CVE record

CVSS 4.3 Medium

KitchenAsty through 0.3.0 contains a broken object level authorization (IDOR) vulnerability in the reservations API.
- Broken access control
Not analysed yet 29 Sept 2026
CVE-2026-102365 CVE record

CVSS 7.1 High

mall4j through 4.0 Missing Authorization in Admin User Address Endpoints
- gz-yami mall4j
- Broken access control
Not analysed yet 28 Sept 2026