Broken access control.

Composer: GHSA-gjfg-22fp-rrxx fix bypass via symlinked package bin path

• Path traversal
• Broken access control

>=1.0, <2.2.30 || >=2.3.0, <2.10.3 · fixed in 2.2.30, 2.10.3

Anubis: Policy bypass via client controlled X-Original-URI header

• Broken access control

>=1.22.0, <1.26.0 · fixed in 1.26.0

Apache Traffic Server: SNI to Host header matching policy is not properly enforced

• Apache Software Foundation Apache Traffic Server
• Broken access control

MISP: Soft-Deleted Attributes from Other Organizations Exposed via Attribute Search and Paginated View

• MISP
• Broken access control

Incorrect authorization in Google Chrome

• Google Chrome
• Broken access control

MISP Correlation Authorization Bypass Exposes Restricted Event and Attribute Data

• MISP
• Broken access control

Missing Authorization in Meari IoT Cloud Platform OpenAPI Service

• Meari IoT Cloud Platform OpenAPI Service
• Broken access control

MISP Information Disclosure via Related Events Listing Bypassing Per-Event Authorization

• MISP
• Broken access control

Missing Authorization in Meari IoT Cloud Platform OpenAPI Service

• Meari IoT Cloud Platform OpenAPI Service
• Broken access control

MISP Decaying Model Import Mass Assignment Allows Cross-Organization Model Overwrite and Default Flagging

• MISP
• Broken access control

WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

• ThimPress LearnPress
• Broken access control

WordPress PublishPress Series plugin <= 3.1.3 - Insecure Direct Object References (IDOR) vulnerability

• PublishPress Series
• Broken access control

onetwothreeneth HospitalManagementSystem controller.php edit_patient unrestricted upload

• onetwothreeneth HospitalManagementSystem
• Broken access control
• Unrestricted file upload

WordPress WebSamurai plugin <= 1.0.7 - Broken Access Control vulnerability

• Kiera Howe WebSamurai
• Broken access control

WordPress Airano MCP Bridge plugin <= 2.11.0 - Broken Access Control vulnerability

• Airano MCP Bridge
• Broken access control

IDOR in AVEZ Electronics's LMS

• AVEZ Electronics Communication Training and Consultancy Trade Inc. Learning Management System (LMS)
• Broken access control

YesWiki before 4.6.7 Missing Authorization via Attachment Download Handler

• yeswiki
• Broken access control

YesWiki before 4.6.7 Authorization Bypass via Public API Mode

• yeswiki
• Broken access control

YesWiki before 4.6.7 Unauthenticated Page Overwrite via Bazar id_fiche

• yeswiki
• Broken access control

YesWiki before 4.6.7 Authorization Bypass via Comments API editComment

• yeswiki
• Broken access control

YesWiki before 4.6.7 Scope Bypass via Triples Delete API

• yeswiki
• Broken access control

YesWiki before 4.6.7 Information Disclosure via listpagestag and includepages Actions

• yeswiki
• Broken access control

SiYuan before 3.8.5 Information Disclosure via /api/export/preview

• siyuan
• Broken access control

SiYuan before v3.8.5 Missing Authorization in Save-Path Resolver Endpoints

• siyuan
• Broken access control

WordPress LearnPress plugin <= 4.4.9 - Insecure Direct Object References (IDOR) vulnerability

• ThimPress LearnPress
• Broken access control

WordPress Advanced Ads plugin <= 2.0.26 - Sensitive Data Exposure vulnerability

• Monetizemore Advanced Ads
• Broken access control

WordPress Download Manager plugin <= 3.3.71 - Sensitive Data Exposure vulnerability

• Shahjada Download Manager
• Broken access control

WPMobile.App <= 11.82 - Unauthenticated Admin Account Takeover via 'wpapp_category[]' Parameter

• amauric WPMobile.App – Android and iOS App Builder
• Broken access control

Unauthorized Cross-Chatbot Tool Invocation in HAVELSAN's Sef - AI Chatbot Platform

• HAVELSAN Inc. Sef - AI Chatbot Platform
• Broken access control

Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter

• Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress
• Broken access control

MStore API 4.21.1 - 4.22.0 - Subscriber+ Payment Bypass via 'status' Parameter

• MStore API
• Broken access control

WP Edit Password Protected 2.0.0 - 2.0.6 - Unauthenticated Site-Wide Access Mode Bypass via REST API

• WP Edit Password Protected
• Broken access control

Popup Maker WP 1.2.2.1 - 1.4.5 - Subscriber+ Zero-Argument PHP Callable Invocation via Missing Authorization

• Popup Maker WP
• Broken access control

WP User Frontend < 4.3.12 - Subscriber+ Post Creation via Subscription-Gated Form

• WP User Frontend
• Broken access control

CMP - Coming Soon & Maintenance < 4.1.20 - Unauthenticated Maintenance Mode Bypass via Login URL Match

• CMP – Coming Soon & Maintenance
• Broken access control

Motors – Car Dealership & Classified Listings < 1.4.124 - Subscriber+ Cross-User Post Meta Modification via stm_make_featured

• Motors
• Broken access control

Popup Maker WP <= 1.4.5 - Subscriber+ Missing Authorization via sgpm_connect

• Popup Maker
• Broken access control

calcom cal.diy PBAC Permission BookingAccessService.ts doesUserIdHaveAccessToBooking authorization

• calcom cal.diy
• Broken access control

Improper MLS Welcome roster validation in Discord libdave allows unauthorized group membership

• Discord libdave
• Broken access control
• CWE-390

TransformerOptimus SuperAGI v0.0.14 contains an incorrect access control vulnerability in delete_user_knowledge in superagi/controllers/knowledges.py.

• Broken access control

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the tool controller.

• Broken access control

TransformerOptimus SuperAGI v0.0.14 is vulnerable to Incorrect Access Control in the agent template controller.

• Broken access control

SuperAGI up to v0.0.14 contains an improper access control vulnerability in the agent execution controller.

• Broken access control

SuperAGI up to 0.0.14 is vulnerable to Incorrect Access Control.

• Broken access control

In SuperAGI v0.0.14 and prior, controller endpoints (/api/agents/create, /api/agents/schedule, /api/agents/delete, /api/agents/edit_schedule, /api/agents/stop_schedule) allow authenticated users from…

• Broken access control

Cilium: Namespaced HTTPRoutes can redirect traffic to other namespaces in github.com/cilium/cilium

• Broken access control

<1.17.17 || >=1.18.0, <1.18.11 || >=1.19.0, <1.19.5 · fixed in 1.17.17, 1.18.11, 1.19.5

Missing authorization in Motorola Setup App

• Motorola Setup App
• Broken access control

RT-Labs AB C-Open CANopen SDO Server Write Protection Bypass

• RT-Labs AB C-Open
• Broken access control

SiYuan: The reference filter for getRefIDs checks visibility but not the password tier, disclosing that password-protected documents reference a given block

• Broken access control

<0.0.0-20260812083335-251596fc0de2 · fixed in 0.0.0-20260812083335-251596fc0de2

SiYuan: getAttributeViewSearchTarget returns database row content to anonymous readers with no publish-access check, reopening the class closed one day earlier at the adjacent route

• Broken access control

>=0.0.0-20260726161145-9b8e8956f997, <0.0.0-20260812083335-251596fc0de2 · fixed in 0.0.0-20260812083335-251596fc0de2

SiYuan: getBookmarkLabels returns every bookmark label in the workspace to anonymous readers, with no publish-access filtering

• Broken access control

<0.0.0-20260812083335-251596fc0de2 · fixed in 0.0.0-20260812083335-251596fc0de2

Apache HTTP Server: mod_proxy_ftp PASV address handling

• Apache Software Foundation Apache HTTP Server
• Broken access control

SiYuan: getUniqueFilename passes an unvalidated client-supplied path to the filesystem, giving anonymous readers an existence oracle over the entire host filesystem

• Broken access control

<0.0.0-20260812083335-251596fc0de2 · fixed in 0.0.0-20260812083335-251596fc0de2

SiYuan: Outline state for any document, including documents forbidden to readers, is returned by /api/storage/getOutlineStorage with no access check

• Broken access control

<0.0.0-20260812083335-251596fc0de2 · fixed in 0.0.0-20260812083335-251596fc0de2

vm2 Custom Module Resolver Can Bypass the External Package Allowlist by Loading a Colliding Host Package

• Broken access control
• CWE-706

<3.11.7 · fixed in 3.11.7

vm2: NodeVM builtin denylist bypass via fs/promises despite -fs, allowing host filesystem writes

• Privilege escalation
• Broken access control

<3.11.7 · fixed in 3.11.7

vm2: NodeVM node:-prefixed negative builtin deny bypass exposes child_process

• Privilege escalation
• Broken access control

<3.11.7 · fixed in 3.11.7

vm2 NodeVM can replace the host process TLS trust store

• Broken access control

>=3.11.3, <3.11.7 · fixed in 3.11.7

vm2: External module allowlist uses a raw prefix test, so a prefix-sharing sibling package is treated as allowlisted

• Path traversal
• Broken access control

<3.11.7 · fixed in 3.11.7

SMBus callback-removal syscalls accept an unvalidated user pointer, letting user threads manipulate kernel callback state

• zephyr
• Broken access control