Advisories · Weakness
Broken access control.
Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 2.7 Low
Image Photo Gallery Final Tiles Grid < 3.6.14 - Contributor+ Arbitrary Gallery Cloning, Image Modification and Post Meta Update via IDOR
- Image Photo Gallery Final Tiles Grid
- Broken access control
- CVSS 5.4 Medium
Incorrect authorization in Stump
- Stump
- Broken access control
- CVSS 7.0 High
Incorrect permission assignment in Brocade Fabric OS
- Brocade Fabric OS
- Broken access control
- CVSS 5.4 Medium
Rubygem-katello: katello: katello: katello flatpak remote repositories api cross-organization authorization bypass
- Red Hat Hardened Images
- Red Hat Satellite 6
- Broken access control
- CVSS 4.3 Medium
Rubygem-katello: katello: katello: katello docker tags repositories api cross-organization authorization bypass
- Red Hat Hardened Images
- Red Hat Satellite 6
- Broken access control
- CVSS 5.1 Medium
Missing authorization in Brocade Fabric OS
- Brocade Fabric OS
- Broken access control
- CVSS 8.7 High
Incorrect authorization in Octopus Deploy Octopus Server
- Octopus Deploy Octopus Server
- Broken access control
- CVSS 5.4 Medium
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
- Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
- Broken access control
- CVSS 7.6 High
AsyncHttpClient: Connection pool key omits the authenticated principal, so an NTLM or Negotiate connection is reused across identities
- AsyncHttpClient async-http-client
- Broken access control
- CWE-346
-
Improper Access Control in Splunk Enterprise
- Splunk Enterprise
- Broken access control
- CVSS 6.3 Medium
Incorrect Permission Assignment for App Key Value Store Collections in Splunk Secure Gateway
- Splunk Enterprise
- Splunk Secure Gateway
- Broken access control
- CVSS 4.3 Medium
Authorization Bypass in SPL2 Module Permissions in Splunk Enterprise
- Splunk Enterprise
- Broken access control
- CVSS 4.3 Medium
Improper Authorization in Search Job Listings through the REST API in Splunk Enterprise
- Splunk Enterprise
- Broken access control
- CVSS 4.3 Medium
Missing Access Control through the REST API in Splunk Secure Gateway
- Splunk Enterprise
- Splunk Secure Gateway
- Broken access control
- CVSS 6.5 Medium
Improper Access Control in Search Job Retrieval through the REST API in Splunk Enterprise
- Splunk Enterprise
- Broken access control
- CVSS 6.5 Medium
Improper Access Control through REST API Endpoints in Splunk Secure Gateway
- Splunk Enterprise
- Splunk Secure Gateway
- Broken access control
- CVSS 4.3 Medium
Improper Authorization through the REST API in Splunk Enterprise
- Splunk Enterprise
- Broken access control
- CVSS 5.4 Medium
Langflow : Cross-user flow access and vertex execution via deprecated /api/v1/build/{flow_id}/vertices endpoints
- Broken access control
>=1.0.0, <1.10.1 · fixed in 1.10.1
GHSA-gh98-4phw-6fmw · CVE-2026-105698 - CVSS 7.1 High
Langflow has Authenticated Cross-Project File Disclosure via Unscoped MCP Resource Handlers
- Broken access control
>=1.6.8, <1.9.1 · fixed in 1.9.1
GHSA-4hmc-cfm3-w43c · CVE-2026-105699 - CVSS 7.1 High
Payload has a tenant authorization bypass in Multi-Tenant Plugin
- Broken access control
<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34
GHSA-p96c-xwx8-3cqj · CVE-2026-105860 - CVSS 5.3 Medium
@payloadcms/plugin-multi-tenant has a cross-tenant create issue
- Broken access control
<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34
GHSA-xhm9-gwgw-3q2q · CVE-2026-105864 - CVSS 7.1 High
Payload: Client uploads could overwrite S3 objects
- Broken access control
<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34
GHSA-7vg8-29qx-jgj8 · CVE-2026-105867 - CVSS 9.8 CriticalCritical · CVSS 9+
Payload: Unauthorized update to collection documents
- Broken access control
<3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34
GHSA-f7hx-52q9-hcrf · CVE-2026-105859 - CVSS 9.2 CriticalCritical · CVSS 9+
Payload authentication token field handling issue
- Authentication bypass
- Broken access control
>=3.0.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34
GHSA-66wr-7vmr-p5jq · CVE-2026-105863 - CVSS 5.3 Medium
Ghost: Editors Could Promote Staff Users to Their Own Role
- Privilege escalation
- Broken access control
>=0.5.0, <6.64.0 · fixed in 6.64.0
GHSA-4pvx-fwjj-8gpc · CVE-2026-104412 - CVSS 4.8 Medium
Backstage: Inconsistent credential enforcement for overlapping proxy routes
- Broken access control
>=0.5.0, <0.6.18 · fixed in 0.6.18
GHSA-472h-9c5j-prrr · CVE-2026-106456 - CVSS 6.5 Medium
Backstage: Inconsistent repository filtering in Bitbucket Server catalog event updates
- Broken access control
>=0.4.0, <0.5.15 · fixed in 0.5.15
GHSA-c36c-cf6r-ghgj · CVE-2026-106458 - CVSS 6.3 Medium
Missing authorization checks in Amazon Athena engine version 3 request handling
- AWS Amazon Athena
- Broken access control
- CWE-424
- CVSS 6.5 Medium
Ghost: Authorization Issue Allowed Author Role to Delete any Post
- Broken access control
>=5.81.0, <6.60.0 · fixed in 6.60.0
GHSA-x3mg-q38v-m562 · CVE-2026-105680 - CVSS 7.5 High
mppx-condition-gate: Free-access path grants on a self-declared wallet without proving control
- Authentication bypass
- Broken access control
<3.0.0 · fixed in 3.0.0
GHSA-jg6q-3qfh-r9f8 · CVE-2026-104891 - CVSS 4.3 Medium
Backstage has incorrect authorization in search engine permission filtering
- Broken access control
- CWE-754
<2.1.6 · fixed in 2.1.6
GHSA-9325-vq29-gp3v · CVE-2026-106562 - CVSS 5.3 Medium
Backstage: Improper entity validation in deprecated Kubernetes services endpoint
- Broken access control
- CWE-20
<0.21.8 · fixed in 0.21.8
GHSA-r9ph-3637-55px · CVE-2026-106563 - CVSS 5.0 Medium
Backstage has a sensitive information disclosure in Kubernetes resource queries
- Information disclosure
- Broken access control
<0.21.9 · fixed in 0.21.9
GHSA-p795-mqf2-36mf · CVE-2026-106561 - CVSS 6.4 Medium
Backstage's scaffolder credential handling may allow unintended GitHub authentication fallback
- Broken access control
- CWE-441
<4.1.0 · fixed in 4.1.0
GHSA-29gx-h2m3-xw44 · CVE-2026-106462 - CVSS 5.4 Medium
Backstage has improper authorization in GitLab organizational user ingestion
- Broken access control
<0.8.7 · fixed in 0.8.7
GHSA-gp6m-x9vw-5c5x · CVE-2026-106463 - CVSS 6.5 Medium
Backstage: Improper authorization enforcement for TechDocs static content
- Path traversal
- Broken access control
<2.2.4 · fixed in 2.2.4
GHSA-rg9r-hr7g-5gc2 · CVE-2026-106489 - CVSS 7.6 High
Backstage: Improper preservation of access restrictions during service credential delegation
- Privilege escalation
- Broken access control
<0.17.8 · fixed in 0.17.8
GHSA-cq7v-rfgc-5c7v · CVE-2026-106492 - CVSS 3.1 Low
Backstage: Inconsistent enforcement of allowed location types during catalog processing
- Path traversal
- Broken access control
<3.9.1 · fixed in 3.9.1
GHSA-pcmq-25r3-5w9v · CVE-2026-106496 - CVSS 7.7 High
Backstage: Improper URL validation in catalog entity placeholder resolution
- Broken access control
- Server-side request forgery (SSRF)
<3.9.1 · fixed in 3.9.1
GHSA-qgvj-qcf8-xq73 · CVE-2026-106498 - CVSS 8.1 High
Backstage: Scaffolder action input authorization bypass
- Broken access control
- CWE-178
<3.3.1 || >=3.4.0, <3.4.1 || >=4.0.0, <4.0.3 || >=4.0.4, <4.1.0 · fixed in 3.3.1, 3.4.1, 4.0.3, 4.1.0
GHSA-hmp2-4m7g-22cv · CVE-2026-106503 - CVSS 4.3 Medium
Backstage: Incorrect authorization in scaffolder task listing
- Broken access control
<4.1.0 · fixed in 4.1.0
GHSA-7hfw-grcm-cqm6 · CVE-2026-106461 - CVSS 7.5 High
WordPress Forminator plugin <= 1.57.2 - Broken Access Control vulnerability
- WPMU DEV Forminator
- Broken access control
- CVSS 7.1 High
Payload: Field-level write access bypass in Payload on MongoDB
- Broken access control
<3.87.0 || >=4.0.0-canary.0, <4.0.0-canary.20 · fixed in 3.87.0, 4.0.0-canary.20
GHSA-4ww4-68q3-h7g5 · CVE-2026-106100 - CVSS 8.8 High
Cisco Meraki Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities
- Cisco Campus Gateway Software
- Cisco Meraki MR Wireless Access Points Software
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Cisco Application Policy Infrastructure Controller Hardening Release: October 2026 - Improper Access Control Vulnerabilities
- Cisco Application Policy Infrastructure Controller (APIC)
- Broken access control
- CVSS 8.4 High
Quasar Framework: Development TLS private keys are cached with overly permissive filesystem permissions
- Broken access control
<3.3.0 · fixed in 3.3.0
GHSA-fh39-c73x-5pjv · CVE-2026-106105 - CVSS 9.8 CriticalCritical · CVSS 9+
Cisco NX-OS Software Security Hardening Release: October 2026 - Improper Access Control Vulnerabilities
- Cisco NX-OS Software
- Cisco NX-OS System Software in ACI Mode
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
Cisco Smart Software Manager On-Prem Arbitrary Account Password Reset Vulnerability
- Cisco License On-Prem
- Broken access control
- CVSS 5.8 Medium
Cisco Nexus 9000 Series Fabric Switches in ACI Mode Policy-Based Redirect Endpoint Group Contract Bypass Vulnerability
- Cisco NX-OS System Software in ACI Mode
- Broken access control
- CVSS 4.0 Medium
ImageMagick: Policy Bypass in CUT encoder
- ImageMagick
- Broken access control
- Denial of service
- CVSS 7.1 High
Gophish through 0.12.1 Object Takeover via Client-Supplied ID on API Create Endpoints
- gophish
- Broken access control
- CVSS 7.1 High
PraisonAI: Platform members can delete owner issue dependencies through member-owned related issues
- Broken access control
<0.1.9 · fixed in 0.1.9
GHSA-mxmx-rh57-jx58 · CVE-2026-61441 - CVSS 6.9 Medium
PraisonAI: AgentMail webhook lacks signature verification, allowing unauthenticated message injection and sender spoofing
- Authentication bypass
- Broken access control
<4.6.78 · fixed in 4.6.78
GHSA-qj9c-59p6-8cgx · CVE-2026-61428 - CVSS 7.1 High
Actual Sync Server: CORS Proxy GitHub API Allowlist Prefix Bypass Leaks Private Repositories Through the Server GitHub Token
- Information disclosure
- Broken access control
<26.7.0 · fixed in 26.7.0
GHSA-m62c-5q34-f3cf · CVE-2026-57449 - CVSS 6.5 Medium
wger: Cross-User Data Corruption via Missing Ownership Check on WorkoutLog.slot_entry
- Broken access control
<=2.1 · no fixed version yet
GHSA-rjpf-7pf5-q54x · CVE-2026-46438 - CVSS 7.1 High
wger: cross-tenant admin notes/contracts leak via gym=None bypass (5 views)
- Broken access control
<=2.1 · no fixed version yet
GHSA-c72h-82w6-rqfp · CVE-2026-43976 - CVSS 5.3 Medium
MISP Correlation Engine Fails to Refresh When Event Distribution or Sharing Group Changes
- MISP
- Broken access control
- CWE-665
- CVSS 5.3 Medium
Obot 0.26.0 before 0.26.2 Authorization Bypass via vMCP Profile Prompts and Resources
- obot
- Broken access control
- CVSS 5.3 Medium
WordPress WP Rentals theme <= 3.14.2 - Broken Access Control vulnerability
- sc Internet Vivoo WP Rentals
- Broken access control
- CVSS 4.3 Medium
WordPress Booktics plugin <= 1.0.27 - Broken Access Control vulnerability
- Arraytics Booktics
- Broken access control