Broken access control.

WordPress Review Schema plugin 3.1.0 - Broken Access Control vulnerability

• Mamunur Rashid Review Schema
• Broken access control

SiYuan discloses an administrator's open documents and search terms to anonymous readers

• Broken access control

<0.0.0-20260812083335-251596fc0de2 · fixed in 0.0.0-20260812083335-251596fc0de2

WordPress Photo Reviews for WooCommerce plugin <= 1.2.30 - Insecure Direct Object References (IDOR) vulnerability

• VillaTheme Photo Reviews for WooCommerce
• Broken access control

WordPress REST API Log plugin <= 1.7.2 - Insecure Direct Object References (IDOR) vulnerability

• Pete Nelson REST API Log
• Broken access control

WordPress Gratisfaction plugin <= 4.6.3 - Broken Access Control vulnerability

• Apps Mav Gratisfaction
• Broken access control

WordPress WP Project Manager plugin <= 4.0.7 - Broken Access Control vulnerability

• weDevs WP Project Manager
• Broken access control

WordPress Social Boost plugin <= 3.6.2 - Broken Access Control vulnerability

• Apps Mav Social Boost
• Broken access control

WordPress WPFunnels plugin <= 3.13.1 - Insecure Direct Object References (IDOR) vulnerability

• WPFunnels
• Broken access control

WordPress Aruba Migration Tool plugin <= 1.0.4 - Broken Access Control vulnerability

• Aruba.it Aruba Migration Tool
• Broken access control

WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.3 - Insecure Direct Object References (IDOR) vulnerability

• magepeopleteam Bus Ticket Booking with Seat Reservation
• Broken access control

WordPress WP Full Stripe Free plugin <= 8.5.6 - Broken Access Control vulnerability

• Themeisle WP Full Stripe Free
• Broken access control

WordPress ProfileGrid plugin <= 6.0.0.2 - Insecure Direct Object References (IDOR) vulnerability

• Metagauss ProfileGrid
• Broken access control

WordPress WpTravelly plugin <= 2.3.1 - Broken Access Control vulnerability

• Magepeople inc. WpTravelly
• Broken access control

WordPress AFFI – Affiliate Marketing for WooCommerce plugin <= 1.0.9 - Broken Access Control vulnerability

• VillaTheme AFFI – Affiliate Marketing for WooCommerce
• Broken access control

Duplicate Advisory: Ghost: Authorization Bypass in Comment Like Feature

• Broken access control

>=5.9.0, <6.44.1 · fixed in 6.44.1

WordPress Majestic Support plugin <= 1.2.0 - Insecure Direct Object References (IDOR) vulnerability

• Ahmad Majestic Support
• Broken access control

WordPress Majestic Support plugin <= 1.2.0 - Broken Access Control vulnerability

• Ahmad Majestic Support
• Broken access control

WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.20 - Broken Access Control vulnerability

• Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
• Broken access control

WordPress Site Reviews plugin <= 8.3.2 - Broken Access Control vulnerability

• Gemini Labs Site Reviews
• Broken access control

MISP Incomplete Thread Authorization Allows Unauthorized Read and Post Access to Discussions

• MISP
• Broken access control

Obot 0.21.1 through 0.24.1 Authorization Bypass via /mcp-connect-composite/ Route

• obot
• Broken access control

Ghost 5.125.1 before 6.57.1 Information Disclosure via Feedback

• Ghost
• Broken access control

Ghost 5.3.0 before 6.58.0 Unauthenticated Comment Read

• Ghost
• Broken access control

Ghost 4.3.0 before 6.58.0 Incorrect Authorization via Staff Token

• Ghost
• Broken access control

Ghost 4.0.0 before 6.63.0 Restricted Content Bypass

• Ghost
• Broken access control

Ghost 5.3.0 before 6.62.0 Missing Authorization via Post Excerpts

• Ghost
• Broken access control

Ghost 1.0.0 before 6.62.0 Suspension Bypass via Password Reset

• Ghost
• Broken access control

Ghost 5.2.0 before 6.62.0 Unauthenticated Stripe Checkout Account Modification

• Ghost
• Broken access control

Fleet before 4.89.0 Information Disclosure via MDM Command Results

• fleet
• Broken access control

n8n before 2.39.6 and 2.40.x before 2.40.1 Approval Bypass via Send and Wait Node

• n8n
• Broken access control

n8n before 2.39.6 and 2.40.x before 2.40.1 Session Token Leak via Dynamic Credentials

• n8n
• Broken access control

n8n before 1.123.80, 2.39.6, and 2.40.1 Information Disclosure via Credential Test Endpoint

• n8n
• Broken access control

n8n before 1.123.80, 2.39.6, and 2.40.1 Package Install Validation Bypass via PubSub

• n8n
• Broken access control

n8n before 1.123.80 Credential Tampering via Duplicate Node IDs

• n8n
• Broken access control

n8n before 2.39.6 and 2.40.x before 2.40.1 Credential Disclosure via Node-Tool Introspection

• n8n
• Broken access control

Missing Authorization in get_module_detail AJAX Endpoint Allows Cross-Group Module Data Disclosure

• Pandora FMS
• Broken access control

Insecure direct object reference in JetBrains YouTrack

• JetBrains YouTrack
• Broken access control

Missing authorization in JetBrains YouTrack

• JetBrains YouTrack
• Broken access control

Insecure direct object reference in JetBrains YouTrack

• JetBrains YouTrack
• Broken access control

Missing authorization in JetBrains YouTrack

• JetBrains YouTrack
• Broken access control

Incorrect authorization in JetBrains YouTrack

• JetBrains YouTrack
• Broken access control

MISP: Object Distribution ACL Bypass via Event Flattening Exposes Organisation-Only Attributes

• MISP
• Broken access control

LearnPress <= 4.4.8 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'item_id' Parameter

• thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
• Broken access control

Payments for Hubtel < 1.0.2 - Unauthenticated Payment Confirmation Forgery via Delayed Payment Callback

• Payments for Hubtel
• Broken access control

Payments for Hubtel < 1.0.2 - Unauthenticated Order Key Disclosure via IDOR

• Payments for Hubtel
• Broken access control

WP Fusion Lite 3.37.14 - 3.47.14 - Unauthenticated CRM Integration Settings Update

• WP Fusion Lite
• Broken access control

WP Fusion Lite < 3.48.0 - Subscriber+ User Email Disclosure and Cross-User CRM Data Deletion

• WP Fusion Lite
• Broken access control

Comelit 1456B gateway allows low priviledge user to overwrite installer password via unauthorized endpoint

• Comelit Group S.p.A. 1456B Multi-User Gateway
• Broken access control

Redux Framework <= 4.5.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Attachment Deletion via 'attachment_id' Parameter

• davidanderson Redux Framework
• Broken access control

formtools.org Form Tools Ajax actions.php uploadFile unrestricted upload

• formtools.org Form Tools
• Broken access control
• Unrestricted file upload

Improper authorization may allow a general user to perform operations equivalent to those available with administrator privileges

• Hitachi Industrial Equipment Systems Hitachi Coding Software Suite
• Broken access control

Genians, Inc Genian NAC/ZTNA Remote Code Execution

• Genians, Inc Genian NAC 4.0.175 Release
• Genians, Inc Genian NAC 5.0.65 LTS Release
• Path traversal
• Broken access control

Genians, Inc Genian SSL PNS Multi Factor Authentication Bypass

• Genians, Inc Genian SSL PNS (frodo-core)
• Broken access control

Genians, Inc. Genian NAC/ZTNA Improper Access Control on the Internal Interface

• Genians, Inc Genian NAC 5.0.75 LTS Release
• Genians, Inc Genian NAC 5.0.85 Release Stable
• Broken access control
• Authentication bypass

Incorrect authorization in Octopus Deploy Octopus Server

• Octopus Deploy Octopus Server
• Broken access control

David-Crty databasement Snapshot Model snapshots SnapshotPolicy.view access control

• David-Crty databasement
• Privilege escalation
• Broken access control

Simply Schedule Appointments <= 1.6.12.31 - Insecure Direct Object Reference to Authenticated (Subscriber+) Sensitive Information Disclosure via 'complete_group' Parameter

• croixhaug Simply Schedule Appointments
• Broken access control

Simply Schedule Appointments <= 1.6.12.32 - Missing Authorization to Unauthenticated Sensitive Information Exposure and Arbitrary Appointment Deletion via 'recursive' Parameter on the appointment_typ…

• croixhaug Simply Schedule Appointments
• Broken access control

immich-app Immich Shared Link Preview access.ts checkSharedLinkAccess improper authorization

• Immich
• Privilege escalation
• Broken access control

RAGFlow 0.24.0 contains improper access control in get_dataset (api/apps/evaluation_app).

• Broken access control