Broken access control.

Plane: Any project member can modify (deactivate) other members' records

• plane
• Broken access control

Plane: Any Authenticated User Can Upload and Delete Assets in Any Published Project via /api/public/assets/v2/anchor/{anchor}/

• plane
• Broken access control

InvoiceShelf: Cross-company read/modify/delete of notes via missing company scope in NotePolicy (BOLA/IDOR)

• InvoiceShelf
• Broken access control

InvoiceShelf: IDOR in InvoiceShelf estimate-to-invoice conversion allows any company user to read and tamper with other companies' estimates

• InvoiceShelf
• Broken access control

InvoiceShelf: Public EmailLog token type confusion allows cross-company invoice disclosure

• InvoiceShelf
• Broken access control

InvoiceShelf bulk deletion lacks company scoping

• InvoiceShelf
• Broken access control

InvoiceShelf trusts client-supplied document totals

• InvoiceShelf
• Broken access control
• CWE-472

Nexent through 2.7.0 Cross-Tenant Knowledge-Base File Read via check_file_access

• ModelEngine-Group nexent
• Broken access control

Blinko through 1.8.8 Private Attachment Read via /api/file Route

• blinko
• Broken access control

GrowChief through 0.3.0 Missing Authorization via /users/all-users Endpoint

• growchief
• Broken access control

Sure 0.7.0 through 0.7.6-alpha.6 Missing Authorization via Transaction Bulk Update

• we-promise sure
• Broken access control

Shopizer through 3.2.5 Authorization Bypass via Product Review customerId

• Shopizer
• Broken access control

AstronRPA through 1.1.6 Cross-Tenant File Disclosure via /file/download

• iflytek astron-rpa
• Broken access control

lamp-boot 4.16.0-java17 through 4.21.2-java17 IDOR via /anyone/findDeptByCompany

• zuihou lamp-boot
• Broken access control

bbPress before 2.6.19 Information Disclosure via BuddyPress Activity Stream

• bbPress
• Broken access control

Incorrect authorization in Eclipse Foundation Eclipse Vert.x

• Eclipse Foundation Eclipse Vert.x
• Broken access control

WordPress Skydropx plugin <= 2.1.4 - Broken Access Control vulnerability

• Skydropx
• Broken access control

Redash: DuckDB query runner allows arbitrary file read/write via unrestricted external access

• redash
• Broken access control

ServiceNext Insecure Direct Object Reference via GetUsarios

• ServiceNext SerTec
• Broken access control

Microsoft Office SharePoint Elevation of Privilege Vulnerability

• Microsoft SharePoint Server Subscription Edition
• Broken access control

Zulip: Guests can read new messages in non-subscribed public channels

• zulip
• Broken access control

Discourse: Media uploads remain publicly accessible after category permissions are restricted

• discourse
• Information disclosure
• Broken access control

Discourse: Chat MessageBus delivers read-restricted messages to unauthorized users

• discourse
• Broken access control

MOVEit Transfer Authorization Flaw in Certificate Management

• Progress MOVEit Transfer
• Broken access control

MOVEit Transfer Service Directory Writable by Local Users Enables Local Privilege Escalation

• Progress MOVEit Transfer
• Broken access control

Gitea private attachment disclosure through repository mismatch

• Gitea
• Broken access control
• CWE-1220

Gitea API token scope escalation through HTTP signatures

• Gitea
• Privilege escalation
• Broken access control

Gitea private workflow badge token scope bypass

• Gitea
• Broken access control

Gitea private pull request title disclosure through markup

• Gitea
• Broken access control

Gitea fork workflow approval bypass through review events

• Gitea
• Broken access control

Gitea organization listing token scope bypass

• Gitea
• Broken access control

Gitea private comparison disclosure with public-only tokens

• Gitea
• Broken access control

Gitea local code execution through writable Git hooks

• Gitea
• Broken access control

Gitea private migration creation with public-only tokens

• Gitea
• Broken access control

Gitea organization repository creation token scope bypass

• Gitea
• Broken access control

Gitea restricted-user SSH and GPG key metadata disclosure

• Gitea
• Broken access control

Gitea restricted-user issue search disclosure

• Gitea
• Broken access control

Gitea restricted-user activity and heatmap disclosure

• Gitea
• Broken access control

Gitea fork workflow approval bypass through concurrency cancellation

• Gitea
• Broken access control

Gitea required Actions check bypass through skipped workflows

• Gitea
• Broken access control
• CWE-345

Gitea restricted-user organization metadata disclosure

• Gitea
• Information disclosure
• Broken access control

Gitea restricted-user package visibility bypass

• Gitea
• Broken access control

Gitea organization team policy bypass through repository API

• Gitea
• Privilege escalation
• Broken access control

VentureDrake Laravel CRM before 2.4.0 Privilege Escalation via Unscoped Role Assignment

• venturedrake laravel-crm
• Broken access control

VentureDrake Laravel CRM before 2.4.0 Missing Authorization via Livewire Actions

• venturedrake laravel-crm
• Broken access control

Papermerge Core through 3.5.3 Missing Authorization via /tags/all and /document-types/all

• papermerge-core
• Broken access control

Papermerge Core through 3.5.3 Missing Authorization in Shared Nodes API

• papermerge-core
• Broken access control

Papermerge Core through 3.5.3 Missing Authorization in Page Management and OCR Endpoints

• papermerge-core
• Broken access control

Swetrix Cloud before 5.1.0 Missing Authorization via POST /project/organisation/:orgId

• swetrix
• Broken access control

Formbricks before 4.9.0 Cross-Organization IDOR in Server Actions via organizationId

• formbricks
• Broken access control

we-mp-rss through 1.5.3 Missing Authorization via Export File Download Endpoint

• rachelos we-mp-rss
• Broken access control

jshERP through 3.6 Missing Authorization via /user/batchSetStatus

• jishenghua jshERP
• Broken access control

youlai-mall through commit 9f62de8 Order Information Disclosure via App Order List

• youlaitech youlai-mall
• Broken access control

REBUILD through 4.5.0 Authorization Bypass via aibot2 Chat Endpoints chatid

• rebuild
• Broken access control

BizSpring Shop through commit cf22d39daaf1 IDOR via /member/order Cancel and Receive

• BizSpring Shop
• BizSpring Java Mall
• Broken access control

Kaneo before 2.1.6 Missing Authorization Allows Cross-Workspace Data Access

• kaneo
• Broken access control

WordPress Push Notification for Post and BuddyPress plugin <= 3.23 - Broken Access Control vulnerability

• Muralidharan Ramasamy Push Notification for Post and BuddyPress
• Broken access control

WordPress Paid Videochat Turnkey Site plugin <= 7.5.12 - Broken Access Control vulnerability

• VideoWhisper.com Paid Videochat Turnkey Site
• Broken access control

Radar < 1.12.2 Missing Authorization via /api/local-terminal

• skyhook-io radar
• Broken access control

WordPress Bus Ticket Booking with Seat Reservation plugin <= 5.9.7 - Broken Access Control vulnerability

• Magepeople inc. Bus Ticket Booking with Seat Reservation
• Broken access control