Broken access control.

Vikunja: Webhooks and link shares survive every revocation path, so a removed collaborator keeps a live feed

• Authentication bypass
• Broken access control

>=0.22.0, <=2.6.0 · no fixed version yet

Vikunja: Saved filter creation with an empty filter string recalculates task positions across all tenants

• Broken access control

>=1.0.0-rc0, <2.7.0 · fixed in 2.7.0

Vikunja: Task relation deletion does not check read access to the other task, allowing cross-project relation removal

• Broken access control

>=0.9, <2.6.0 · fixed in 2.6.0

Vikunja: Cross-project task disclosure through subtask expansion

• Information disclosure
• Broken access control

<2.6.0 · fixed in 2.6.0

Vikunja: CalDAV relation creation bypasses TaskRelation.CanCreate, allowing an unauthorized write into any task by known UID

• Broken access control

<2.6.0 · fixed in 2.6.0

Contao: Improper access control in the preview links module

• Broken access control

>=5.7.1, <5.7.12 · fixed in 5.7.12

Contao: Improper access control in the table access voter

• Broken access control
• CWE-524

>=5.7.0, <5.7.12 · fixed in 5.7.12

Vikunja: Link-share token can enumerate users through the v2 API

• Information disclosure
• Broken access control

<2.6.0 · fixed in 2.6.0

Vikunja: Any user can enumerate every team and its members by attaching arbitrary teams to a throwaway project

• Information disclosure
• Broken access control

<2.6.0 · fixed in 2.6.0

Vikunja: API token scopes bypassed via task expand parameter (comments, reactions, time entry counts)

• Broken access control

>=1.0.0, <2.6.0 · fixed in 2.6.0

Vikunja: Cross-tenant task-position rows can be injected into arbitrary project views via the unvalidated project_view_id in the task position endpoint (v1 and v2)

• Broken access control

<2.6.0 · fixed in 2.6.0

Vikunja: Read-only project members can obtain any link share's access hash via the single-share read endpoint (v1 and v2) and escalate to the share's permission level

• Information disclosure
• Broken access control

<2.6.0 · fixed in 2.6.0

Astron Agent: Unsandboxed code-node leads to cross-tenant RCE

• iflytek astron-agent
• Code injection
• Authentication bypass

Vikunja: Link-share principal-type confusion enables cross-account team removal, bot takeover, and roster disclosure

• Broken access control
• Memory corruption

<2.5.0 · fixed in 2.5.0

pacioli: A submit consent marker licensed cancellation of caller-named pre-existing documents

• Broken access control

>=0.9.6, <0.10.0 · fixed in 0.10.0

Vikunja: Link-share token reads any tenant's kanban buckets and enumerates usernames/IDs instance-wide (BOLA)

• Broken access control

>=0.24.0, <2.4.0 · fixed in 2.4.0

Vikunja: Link-share principal ID collision allows cross-account API token issuance and management

• Broken access control

>=0.22.0, <2.4.0 · fixed in 2.4.0

CiviForm: Trusted-Intermediary IDOR discloses any citizen's name and email

• civiform
• Broken access control

Jexactyl: Free-billing order endpoint renews and unsuspends arbitrary servers by ID (missing ownership check)

• Jexactyl
• Broken access control

Improper authorization in query resolvers for SQL-backed models in AWS Amplify API Category

• aws-amplify/graphql-index-transformer
• aws-amplify/graphql-api-construct
• Broken access control

MariaDB: database privilege escalation via user / role name collision in the acl cache

• MariaDB server
• Broken access control
• CWE-706

Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up

• Broken access control

>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728074433-a3999bd78a3b · fixed in 1.9.10-0.20260728074433-a3999bd78a3b

0xJacky/nginx-ui /api/nodes Leaks Cluster Node Tokens and Allows Cross-Node Impersonation as initUser

• Information disclosure
• Broken access control

>=1.9.10-0.20250517140552-daee3ac7ade1, <1.9.10-0.20260728091109-0ecbd106c37b · fixed in 1.9.10-0.20260728091109-0ecbd106c37b

MariaDB: Insecure $HOME in MariaDB rpm packages

• MariaDB server
• Broken access control

ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via Workflow Delete Endpoint

• ageerle ruoyi-ai
• Broken access control

ruoyi-ai 3.0.0 through 3.1.0 Missing Authorization via /workflow/search

• ageerle ruoyi-ai
• Broken access control

MOVO through 0.2.3 Authorization Bypass via Document Endpoints

• MOVO
• Broken access control

Missing authorization in illumos zonestatd allows local users to disrupt zonestat and enumerate running zones

• illumos-gate
• OmniOS
• Broken access control

Missing authorization in illumos ipmgmtd allows local users to change persistent IPMP group membership

• illumos-gate
• OmniOS
• Broken access control

Strawberry GraphQL: Synchronous permission checks can treat an awaitable authorization result as truthy

• Broken access control

>=0.217.0, <0.326.1 · fixed in 0.326.1

WordPress Before After Image Comparison – Image comparison for WP plugin <= 1.1.21 - Broken Access Control vulnerability

• bPlugins Before After Image Comparison – Image comparison for WP
• Broken access control

WordPress Th Shop Mania theme <= 1.9.1 - Broken Access Control vulnerability

• ThemeHunk Th Shop Mania
• Broken access control

Envira Gallery Lite < 1.16.2 Missing Authorization via Gallery Conversion REST Endpoint

• Syed Balkhi Envira Gallery
• Broken access control

WordPress Asgaros Forum plugin <= 3.4.0 - Broken Access Control vulnerability

• Asgaros Forum
• Broken access control

WordPress Restrict User Access – Membership Plugin with Force plugin <= 2.8.1 - Broken Access Control vulnerability

• DEV Institute Restrict User Access – Membership Plugin with Force
• Broken access control

WordPress WP Event Manager plugin <= 3.4.1 - Broken Access Control vulnerability

• Ashok Dudhat WP Event Manager
• Broken access control

WordPress Scripts n Styles plugin <= 3.5.8 - Broken Access Control vulnerability

• unFocus Projects Scripts n Styles
• Broken access control

WordPress AI Translation for Polylang plugin <= 1.6.2 - Broken Access Control vulnerability

• Cool Plugins AI Translation for Polylang
• Broken access control

Livees Checkout 6.8 - 7.0.2 - Unauthenticated Order Status Change, Order Note Injection & Order Key Disclosure

• Livees Checkout
• Broken access control

Shipping for Nova Poshta 1.18.7 - 1.19.8 - Unauthenticated Order Shipment Record Deletion

• Shipping for Nova Poshta
• Broken access control

WordPress User Registration plugin <= 5.2.7 - Broken Access Control vulnerability

• ThemeGrill User Registration
• Broken access control

WordPress Deposits and Partial Payments for WooCommerce plugin <= 4.0.1 - Broken Access Control vulnerability

• Magepeople inc. Deposits and Partial Payments for WooCommerce
• Broken access control

WordPress 워드프레스 결제 심플페이 plugin <= 5.5.17 - Settings Change vulnerability

• codemstory 워드프레스 결제 심플페이
• Broken access control

WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability

• TMS Amelia
• Broken access control

WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

• properfraction ProfilePress
• Broken access control

WordPress ProfilePress plugin <= 4.17.3 - Broken Access Control vulnerability

• properfraction ProfilePress
• Broken access control

Incorrect authorization in Dell Secure Connect Gateway (SCG) Policy Manager

• Dell Secure Connect Gateway (SCG) Policy Manager
• Broken access control

Incorrect permission assignment in Dell Secure Connect Gateway (SCG) Policy Manager

• Dell Secure Connect Gateway (SCG) Policy Manager
• Broken access control

Insecure direct object reference in Dell Secure Connect Gateway (SCG) Policy Manager

• Dell Secure Connect Gateway (SCG) Policy Manager
• Broken access control

Insecure direct object reference in Dell Secure Connect Gateway (SCG) Policy Manager

• Dell Secure Connect Gateway (SCG) Policy Manager
• Broken access control

Missing authorization in Dell Secure Connect Gateway (SCG) Policy Manager

• Dell Secure Connect Gateway (SCG) Policy Manager
• Broken access control

WordPress WP Rocket plugin < 3.23.5 - Broken Access Control vulnerability

• WP Media WP Rocket
• Broken access control

ARM64 MMU can assign an in-use ASID to a new memory domain, breaking user-mode memory isolation

• zephyr
• Broken access control

Ash.count, Ash.exists and Ash.aggregate skip related resources' read policies in filters and sorts

• Broken access control

>=2.6.0, <3.34.6 · fixed in 3.34.6

Code Snippets < 3.10.0 - Admin+ Network-Scoped Snippet Activation and Deactivation via update_code_snippet

• Code Snippets
• Broken access control

UnitechPay <= 1.0.6.3 - Unauthenticated Order Payment Bypass via Unsigned Webhook

• UnitechPay
• Broken access control

Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update

• Social Web Suite
• Broken access control

SKU Error Fixer for WooCommerce <= 1.0 - Unauthenticated Orphaned Product Variation Deletion

• SKU Error Fixer for WooCommerce
• Broken access control

SendPress Newsletters <= 1.26.1.20 - Subscriber+ Mailing List Sync and Newsletter Queueing

• SendPress Newsletters
• Broken access control

Ops Manager Improper Authorization in Daily Host Monitoring Retrieval

• MongoDB Ops Manager
• Broken access control