Advisories · Weakness
Broken access control.
Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.9 CriticalCritical · CVSS 9+
Microsoft Bookings Elevation of Privilege Vulnerability
- Microsoft Bookings
- Broken access control
- CVSS 7.7 High
Azure Event Grid Spoofing Vulnerability
- Microsoft Azure Event Grid System
- Broken access control
- CVSS 4.3 Medium
Indico: Missing access check in legacy session export API
- Broken access control
<3.3.13 · fixed in 3.3.13
GHSA-6p4f-j8j6-463q · CVE-2026-107395 - CVSS 8.7 High
Hazelcast has an authorization bypass in IMap Predicates API
- Broken access control
>=5.6.0, <5.7.0 || >=5.5.0, <5.7.0 || <5.7.0 · fixed in 5.7.0
GHSA-w294-6q5q-53p8 · CVE-2026-107725 - CVSS 8.8 High
PraisonAI: AgentOS defaults to network-exposed no-auth mode, allowing unauthenticated agent invocation and instruction disclosure
- Information disclosure
- Broken access control
<1.7.3 · fixed in 1.7.3
GHSA-6wjp-v33h-5cvq · CVE-2026-61426 - CVSS 7.1 High
PraisonAI: Platform member PATCH routes allow owner resource rewrites and project lead reassignment delete bypass
- Broken access control
<0.1.9 · fixed in 0.1.9
GHSA-c78w-2q4r-68r7 · CVE-2026-61442 - CVSS 6.9 Medium
PraisonAI: MCP HTTP-stream transport is unauthenticated by default, exposing tool enumeration and an unvalidated tool-call surface
- Authentication bypass
- Broken access control
<4.6.78 · fixed in 4.6.78
GHSA-hc5v-gxvj-58wh · CVE-2026-61427 - CVSS 7.1 High
PraisonAI: Platform members can rewrite shared labels and owner issue labels without owner/admin authorization
- Broken access control
<0.1.9 · fixed in 0.1.9
GHSA-xxgv-vgvj-qvxh · CVE-2026-61440 - CVSS 5.3 Medium
Jivejdon through 5.0 IDOR via subSaveAction Subscription Delete
- banq jivejdon
- Broken access control
- CVSS 5.3 Medium
Jivejdon through commit ee67a65e Missing Authorization via /message/threadToForum/save Thread Move
- banq jivejdon
- Broken access control
- CVSS 5.9 Medium
Security vulnerabilities have been found in IBM Verify Identity Access and IBM Security Verify Access
- IBM Security Verify Access
- IBM Verify Identity Access
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
Missing authorization in Hewlett Packard Enterprise HPE Intelligent Management Center (iMC)
- Hewlett Packard Enterprise HPE Intelligent Management Center (iMC)
- Broken access control
- CVSS 8.5 High
System Informer before 4.0.26241.138 Incorrect Authorization in phsvc ALPC Port
- winsiderss System Informer
- Broken access control
- CVSS 5.3 Medium
Dolibarr before 24.0.2 Incorrect Authorization via updateextrafield.php
- dolibarr
- Broken access control
- CVSS 5.3 Medium
QloApps through 1.7.0 Authorization Bypass via id_hotel in Admin Room Booking
- Webkul QloApps
- Broken access control
- CVSS 7.2 High
Incorrect authorization in OpenStack Mistral
- OpenStack Mistral
- Broken access control
- CVSS 6.0 Medium
Incorrect authorization in OpenStack Mistral
- OpenStack Mistral
- Broken access control
- CVSS 7.1 High
Missing authorization in OpenStack Mistral
- OpenStack Mistral
- Broken access control
- CVSS 6.8 Medium
Insecure Default File Permissions on Cached Credentials in AWS Toolkit for Visual Studio Code
- aws-toolkit-vscode
- Broken access control
- CWE-459
- CVSS 5.4 Medium
Incorrect Authorization in Malcolm
- CISA Malcolm
- Broken access control
- CVSS 8.1 High
Incorrect Authorization in Malcolm
- CISA Malcolm
- Broken access control
- CVSS 6.5 Medium
Authentication Bypass by Spoofing in Malcolm
- CISA Malcolm
- Authentication bypass
- Broken access control
- CVSS 7.4 High
AsyncHttpClient: Pooled connections can still be shared across NTLM, Negotiate and proxy logins
- Broken access control
- CWE-346
>=3.0.0, <3.0.14 || >=2.0.0, <=2.16.1 · fixed in 3.0.14
GHSA-v2j5-22fr-j62r · CVE-2026-107230 - CVSS 6.9 Medium
PraisonAI: Human-in-the-loop tool approval is cached by tool name and silently reused for all subsequent calls with arbitrary arguments
- Broken access control
<1.6.78 · fixed in 1.6.78
GHSA-29r9-67vg-qj56 · CVE-2026-60087 - CVSS 6.5 Medium
Zimbra Collaboration Suite Sieve Notify Filter Action Bypasses Mail Forwarding Restriction via Variable Expansion
- Zimbra Collaboration Suite
- Broken access control
- CVSS 6.5 Medium
Zimbra Collaboration Suite EWS Extension Authorization Bypass via Crafted Composite Folder/Item Identifier
- Zimbra Collaboration Suite
- Broken access control
- CVSS 4.3 Medium
Keycloak-services: keycloak-services: oidc dcr read-modify-write silently disables offline token revocation
- Red Hat build of Keycloak 26.6
- Red Hat build of Keycloak 26.6.8
- Broken access control
- CVSS 6.5 Medium
IDOR in Caz Informatics' Advancity ALMS Cloud
- Caz Informatics Services Trade Inc. Advancity ALMS Cloud
- Broken access control
- CVSS 5.3 Medium
pH7Builder before 18.5.0 Improper Authorization via Note Module delete() Action
- ph7software ph7builder
- Broken access control
- CVSS 6.5 Medium
IBM DataPower Gateway Incorrect Authorization
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Broken access control
- CVSS 7.8 High
World-accessible IPC shared memory with predictable name in TightVNC Server
- GlavSoft TightVNC
- Weak cryptography or TLS
- Broken access control
- CVSS 5.3 Medium
WordPress Creator LMS plugin <= 1.2.21 - Broken Access Control vulnerability
- Creator LMS
- Broken access control
- CVSS 7.4 High
IBM DataPower Gateway Improper Authorization
- IBM DataPower Gateway 10.6CD
- IBM DataPower Gateway 10.6.0
- Broken access control
- CVSS 5.3 Medium
WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability
- Liquid Web / StellarWP Event Tickets
- Broken access control
- CVSS 4.3 Medium
WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability
- Liquid Web / StellarWP Event Tickets
- Broken access control
- CVSS 4.3 Medium
WordPress VillaTheme Core plugin <= 1.0.5 - Broken Access Control vulnerability
- VillaTheme Core
- Broken access control
- CVSS 5.4 Medium
WordPress Event Tickets plugin <= 5.30.0.1 - Broken Access Control vulnerability
- Liquid Web / StellarWP Event Tickets
- Broken access control
- CVSS 5.3 Medium
WordPress Visual Composer Website Builder plugin <= 45.16.3 - Broken Access Control vulnerability
- Visual Composer Website Builder
- Broken access control
- CVSS 6.5 Medium
WordPress Ultimate Post Kit plugin <= 4.5.5 - Broken Access Control vulnerability
- BdThemes Ultimate Post Kit
- Broken access control
- CVSS 5.3 Medium
WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability
- YITH WooCommerce Product Bundles
- Broken access control
- CVSS 6.5 Medium
WordPress HollerBox plugin <= 2.3.14 - Insecure Direct Object References (IDOR) vulnerability
- Groundhogg HollerBox
- Broken access control
- CVSS 5.3 Medium
WordPress GiveWP plugin <= 4.18.0 - Broken Access Control vulnerability
- Liquid Web / StellarWP GiveWP
- Broken access control
- CVSS 7.8 High
Incorrect Default Permissions in hMailServer
- Progressive Robot Ltd hMailServer
- Broken access control
- CVSS 8.8 High
IDOR in AKIN Software's OctoCloud
- AKIN Software Computer Import-Export Industry and Trade Co. Ltd. OctoCloud
- Broken access control
- CVSS 7.8 High
Missing Authorization in hMailServer
- Progressive Robot Ltd hMailServer
- Broken access control
- CVSS 5.3 Medium
Easy Digital Downloads < 3.7.1 - Unauthenticated Account Creation with Registration Disabled
- Easy Digital Downloads
- Broken access control
- CVSS 5.3 Medium
TutorStarter < 4.0.4 - Unauthenticated User Registration Bypass via AJAX
- TutorStarter
- Broken access control
- CVSS 9.1 CriticalCritical · CVSS 9+
Authenticated argument injection in NIOS command line leading to privilege escalation
- Infoblox NIOS
- Command injection
- Privilege escalation
- CVSS 6.5 Medium
Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 7.1 High
Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 7.1 High
Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 8.1 High
Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 8.1 High
Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 6.5 Medium
Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）
- Apache Software Foundation Apache DolphinScheduler
- Broken access control
- CVSS 6.3 Medium
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Forged Wallet Withdrawal Request via IDOR
- Wallet System for WooCommerce
- Broken access control
- CVSS 6.5 Medium
Wallet System for WooCommerce 2.0.0 - 2.7.10 - Subscriber+ Arbitrary Wallet Balance Theft via IDOR
- Wallet System for WooCommerce
- Broken access control
- CVSS 5.3 Medium
BackWPup 3.3 - 5.7.6 - Unauthenticated Backup Job Execution via wp-cron.php
- BackWPup
- Broken access control
- CVSS 5.3 Medium
LatePoint < 5.7.3 - Unauthenticated Customer PII Disclosure via IDOR
- Appointment Booking Plugin
- Broken access control
- CVSS 2.7 Low
LatePoint < 5.6.5 - Agent+ Arbitrary Order, Customer and Transaction Deletion via IDOR
- Appointment Booking Plugin
- Broken access control
- CVSS 3.3 Low
LatePoint < 5.6.9 - Agent+ Cross-Agent Data Disclosure and Modification via Abilities API
- Appointment Booking Plugin
- Broken access control