Broken access control.

Nx daemon and plugin worker sockets are accessible to other local users

• Privilege escalation
• Broken access control

>=14.6.0, <22.7.9 || >=23.0.0, <23.1.2 · fixed in 22.7.9, 23.1.2

OpenClaw: Channel read actions could skip target allowlists

• Broken access control

<2026.8.1 · fixed in 2026.8.1

vm2: NodeVM custom resolution bypasses external path boundaries

• Broken access control

<3.12.2 · fixed in 3.12.2

Joplin: Unauthenticated account takeover via an attacker-chosen application-authorisation identifier

• laurent22 joplin
• Authentication bypass
• Weak cryptography or TLS

Dify: IDOR in AppMCPServer PUT Endpoint Allows Modification of Other Apps' MCP Servers

• langgenius dify
• Broken access control

LangGraph SDK custom auth silently ignores actions= on resource decorators

• Broken access control

>=0.1.45, <0.4.4 · fixed in 0.4.4

Bake filesystem entitlement consent is skipped for certain secret and oci-layout definitions

• Docker Buildx
• Broken access control

openSIS Classic 9.3 - Insecure Direct Object Reference (IDOR)

• OS4ED openSIS-Classic
• Broken access control

Quay: quay: global read-only superuser can access build trigger write credentials

• Red Hat Quay 3
• Broken access control

Camunda 7.24.0 < 7.24.15 Incorrect Authorization via SetupResource Endpoint

• Camunda 7
• Broken access control

Penpot: Share-link page-scope escalation: a share-link holder reads pages outside the link's authorized scope via the get-page RPC command

• penpot
• Broken access control

Penpot: Missing authorization in chunked-upload assembly lets another authenticated user consume a victim's upload session

• penpot
• Broken access control

Penpot: Anonymous share-link token disclosure & page-scope bypass via get-view-only-bundle

• penpot
• Broken access control

Penpot: IDOR in Share-Link Deletion Allows Any File Editor to Delete Share-Links They Did Not Create

• penpot
• Broken access control

Penpot: A team admin (non-owner) can remove the team owner via ::delete-team-member — missing owner-protection

• penpot
• Privilege escalation
• Broken access control

Penpot: Share-link page-scope escape — comment RPCs leak comment content, author identity, and all page-ids for pages outside the share scope

• penpot
• Information disclosure
• Broken access control

feelec-yishu feelcrm-os UploadTicketFile Endpoint UploadController.class.php unrestricted upload

• feelec-yishu feelcrm-os
• Broken access control
• Unrestricted file upload

WordPress WC Ukraine Shipping plugin <= 1.23.2 - Broken Access Control vulnerability

• Kirillbdev WC Ukraine Shipping
• Broken access control

Missing authorization in Google Android

• Google Android
• Broken access control

Plane: Pre-auth workspace invitation hijack via email-squat and self-served invitation token leak in Plane

• plane
• Information disclosure
• Authentication bypass

WordPress Scratch & Win – Giveaways and Contests plugin <= 3.0.2 - Broken Access Control vulnerability

• Apps Mav Scratch & Win – Giveaways and Contests
• Broken access control

WordPress RepairBuddy plugin <= 4.1226 - Sensitive Data Exposure vulnerability

• Webful Creations RepairBuddy
• Broken access control

WordPress Cozy Blocks plugin <= 2.2.23 - Insecure Direct Object References (IDOR) vulnerability

• CozyThemes Cozy Blocks
• Broken access control

WordPress AI Chatbot for WordPress – Hyve Lite plugin <= 2.0.2 - Insecure Direct Object References (IDOR) vulnerability

• Themeisle AI Chatbot for WordPress – Hyve Lite
• Broken access control

WordPress Timetics plugin <= 1.0.63 - Broken Access Control vulnerability

• Arraytics Timetics
• Broken access control

WordPress WP User Manager plugin <= 2.9.20 - Privilege Escalation vulnerability

• WP User Manager
• Broken access control

WordPress UsersWP plugin <= 1.2.74 - Broken Access Control vulnerability

• Stiofan UsersWP
• Broken access control

WordPress Lookzy plugin <= 1.1.14 - Broken Access Control vulnerability

• VillaTheme Lookzy
• Broken access control

Plane: Cross-Project Asset Hijacking via 'ProjectBulkAssetEndpoint' (sibling of CVE-2026-46558)

• plane
• Broken access control

Plane: Unauthenticated Project Invitation Email Disclosure Enables Unauthorized Project Join Without Token

• plane
• Information disclosure
• Broken access control

Plane: Issue Attachment Ownership Hijacking via Missing `issue_id` Scope

• plane
• Broken access control

Plane: Broken Access Control - joinProject GraphQL mutation allows self-join into private (secret) projects

• plane
• Broken access control

Plane: asset download endpoints scope file lookups to the workspace (not the project / published entity) → cross-project & unauthenticated private-file disclosure

• plane
• Broken access control

Plane: Cross-Tenant Destructive IDOR: Estimate Point Deletion via Unscoped Primary Key Lookup

• plane
• Broken access control

Plane: Cross-tenant stored XSS in intake enables account takeover

• plane
• Cross-site scripting (XSS)
• Broken access control

Plane: Invitation Hijack in Project Join Flow via Missing Authorization and Email-Only Acceptance

• plane
• Broken access control

Velociraptor privilege escalation via SysmonLogForward client monitoring artifact

• Rapid7 Velociraptor
• Broken access control

Plane: Cross-tenant asset authorization bypass in Plane Spaces public-board endpoints

• plane
• Broken access control

Plane: Disabled User Auto-Reactivation on Login

• plane
• Broken access control

SiYuan: /history/*path and /repo/diff/*path potentially exposing historical snapshots of data/.siyuan/publishAccess.json and data/templates/*

• Information disclosure
• Broken access control

<0.0.0-20260816034002-035bf9a8c311 · fixed in 0.0.0-20260816034002-035bf9a8c311

@orpc/zod: Prototype injection in smart coercion

• Broken access control
• Prototype pollution

<1.14.10 · fixed in 1.14.10

Velociraptor Server Metadata update with Insufficient Permission Check

• Rapid7 Velociraptor
• Broken access control

Plane: Cross-Workspace Asset Duplication IDOR + WorkspaceFileAssetEndpoint and FileAssetEndpoint Missing Authorization

• plane
• Broken access control

Plane: Cross-Tenant Cycle Issue Hijack via IDOR

• plane
• Broken access control

Plane: Cross-workspace member enumeration via /api/workspaces/{slug}/entity-search/

• plane
• Broken access control

Plane: Cross-workspace association destruction and issue mutation/read via unscoped queries in BulkDeleteIssuesEndpoint and SubIssuesEndpoint

• plane
• Broken access control

Plane: Cross-Workspace IDOR in Estimate and Comment Endpoints Allows Read, Modify, and Inject Across Workspaces

• plane
• Broken access control

Plane: Cross-Tenant Issue Relation Creation via IDOR

• plane
• Broken access control

Plane: Cross-Workspace Project Modification via Unscoped Project Lookup

• plane
• Broken access control

WatchEvent API streams another organization's live events

• Rapid7 Velociraptor
• Broken access control

Plane: Workspace cycle and module endpoints missing project-membership filter expose private project metadata to any workspace member

• plane
• Information disclosure
• Broken access control

Plane: Cross-project member roster IDOR in ProjectMemberListCreateAPIEndpoint (missing project scope on reads)

• plane
• Broken access control

Plane: WorkspaceOwnerPermission missing is_active check allows deactivated users to retain owner access

• plane
• Broken access control

Plane: Authorization bypass in workspace-scoped asset download endpoint exposes secret project file assets to non-project workspace users

• plane
• Broken access control

onetwothreeneth HospitalManagementSystem Account Administration controller.php update_subaccount improper authorization

• onetwothreeneth HospitalManagementSystem
• Privilege escalation
• Broken access control

Plane: Project Member can escalate Project Guest to Member via PATCH /project-members/{pk} (BAC / Privilege Escalation)

• plane
• Privilege escalation
• Broken access control

Plane: Cross-Tenant Module Issue Linking via IDOR

• plane
• Broken access control

Joomla Extension - joomlafry.com - Unauthenticated forced execution of published automation tasks in TF Content 2.9.0 - 2.9.4

• joomlafry.com TF Content for Joomla
• Broken access control

Joomla Extension - joomlafry.com - Unauthenticated cross-record publication and mass assignment in TF Content 2.9.0 - 2.9.4

• joomlafry.com TF Content for Joomla
• Broken access control

Joomla Extension - phoca.cz - Authorisation bypass through user-controlled key (IDOR) in Order View in Phoca Cart 5.0.0 - 6.1.8

• phoca.cz Phoca Cart extension for Joomla
• Broken access control