Broken access control.

Modula Image Gallery <= 3.0.11 - Missing Authorization to Unauthenticated Sensitive Information Exposure via Exposed 'modulaSettings' REST field on the modula-gallery CPT

• wpchill Modula Image Gallery – Photo Grid & Video Gallery
• Broken access control

Bulk Page Generator <= 3.1.0 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Page Creation/Modification/Deletion via 'authorize' Parameter / Suite OAuth Flow

• niklaslindemann Bulk Page Generator – LPagery
• Broken access control

Klarna for WooCommerce <= 4.13.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order-pay' Endpoint

• klarnaplugin Klarna for WooCommerce
• Broken access control

FunnelKit <= 3.16.0.6 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'order_id' / 'order' POST Parameter

• teamfunnelkit FunnelKit – Funnel Builder Plugin for WooCommerce Checkout
• Broken access control

NotificationX <= 3.3.3 - Missing Authorization to Unauthenticated Arbitrary Content Injection via 'nx_id' Parameter on /popup-submit REST Route

• wpdevteam NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar
• Broken access control

FluentCart A New Era of eCommerce <= 1.7.0 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'order_id' and 'billing_address_id' Parameters

• wpmanageninja FluentCart A New Era of eCommerce – Faster, Lighter, and Simpler
• Broken access control

Dokan: AI Powered WooCommerce Multivendor Marketplace Solution <= 5.2.1 - Insecure Direct Object Reference to Authenticated (Custom+) Limited Account Takeover via 'password' Parameter to /wp-json/dok…

• dokaninc Dokan: AI Powered WooCommerce Multivendor Marketplace Solution – Build Your Own Amazon, eBay, Etsy
• Broken access control

Incorrect authorization in Wheels

• Wheels
• Broken access control

Missing Authorization on Secret Endpoints

• Moxa AIG-302 Series
• Broken access control

Frappe before 16.33.0 restrict_ip Allowlist Bypass via API Key, OAuth Authentication

• frappe
• Broken access control

Z.ai ZCode v3.11.2.6792 was discovered to automatically establish connections with MCP servers declared inside a repository's workspace configuration, possibly allowing attackers to execute arbitrary…

• Command injection
• Information disclosure

ELADMIN (eladmin-mp) up to 2.7 contains an improper access control vulnerability in the role management module.

• Broken access control

Missing authorization in Lenovo Baiying PC Client

• Lenovo Baiying PC Client
• Broken access control

ClassroomIO through 1.0.0 Incorrect Authorization via Lesson Update and Delete Routes

• ClassroomIO
• Broken access control

ClassroomIO through 1.0.0 IDOR via Course Submission Update, Grade and Delete Routes

• ClassroomIO
• Broken access control

cool-admin-midway through 8.0.0 Authorization Bypass via /admin/sys/user Endpoints

• cool-team-official cool-admin-midway
• Broken access control

cool-admin-midway through 8.0.0 Missing Authorization via System Role Endpoints

• cool-team-official cool-admin-midway
• Broken access control

MinDoc through 2.2-beta.2 IDOR via /api/:key/content/:id GET Branch

• MinDoc
• Broken access control

BISHENG through 3.0.0-beta4 IDOR via /api/v1/knowledge/file_bbox

• dataelement bisheng
• Broken access control

CRMEB 5.6.1 through 6.0.0 IDOR via giftDetail and receiveGift

• CRMEB
• Broken access control

SendPortal sendportal-core through 4.0.1 Cross-Workspace Tag Attachment via Subscriber Form

• mettle sendportal-core
• Broken access control

zhontai Admin.Core through 10.1.0 Authorization Bypass via User and Organization By-ID Endpoints

• zhontai Admin.Core
• Broken access control

crmeb_java through 3.1 Authorization Bypass via Front Order Express and Refund Endpoints

• crmeb_java
• Broken access control

Peppermint through 0.5.5 Missing Authorization via Time-Tracking and Attachment Upload Endpoints

• peppermint
• Broken access control

ThinkCMF through 8.0.1 Incorrect Authorization in Admin REST API

• ThinkCMF
• Broken access control

metasfresh through 5.175 Authorization Bypass via /rest/api/board REST API

• metasfresh
• Broken access control

Papermark through 0.22.0 Missing Authorization in Data Room Viewer Group API

• Papermark
• Broken access control

Craftplan through 0.7.5 Missing Authorization via CRM Customer JSON:API and GraphQL

• puemos Craftplan
• Broken access control

Likeshop through 3.5.1 IDOR via AfterSale API Refund Endpoints

• likeshop
• Broken access control

ZenTao PMS through 22.6 Authorization Bypass via action::editComment

• easysoft zentaopms
• Broken access control

Trudesk through 1.2.11 Authorization Bypass via GET /api/v1/messages/conversation/:id

• polonel trudesk
• Broken access control

APITable through 1.14.0-beta Authorization Bypass via GET /node/{nodeId}/description

• apitable
• Broken access control

pig through 4.1.1 Missing Authorization via GET /admin/user/details/{id}

• pig
• Broken access control

OxiCloud 0.9.1 through 0.9.3 Incorrect Authorization via Share Ring Cookie

• AtalayaLabs OxiCloud
• Broken access control

Dokploy through 0.30.8 Cross-Organization Authorization Bypass via port tRPC Router

• Dokploy
• Broken access control

rustdesk-api through 2.7 Authorization Bypass via POST /api/sysinfo

• lejianwen rustdesk-api
• Broken access control

NivoCart through 2.5.1 Guest Order Invoice Disclosure via account/order/download

• nivocart
• Broken access control

Apache Airflow Keycloak provider: Keycloak multi-team provisioning grants every team role global audit-log read

• Apache Software Foundation Apache Airflow Keycloak provider
• Broken access control

EnergizeLab Eilik User-ID Mass Assignment Account Takeover

• EnergizeLab NestJS auth service
• Broken access control

EnergizeLab Station Middleware Admin APIs Missing Role Checks

• EnergizeLab station-middleware
• Broken access control

Pipecat: Public exposure of Pipecat’s development runner can allow unauthenticated bot session creation

• Denial of service
• Broken access control

>=0.0.98, <1.6.0 · fixed in 1.6.0

JupyterLab: Command link trust prompt in JupyterLab can trust a document other than the one clicked

• Race condition
• Broken access control

>=4.5.7, <4.5.11 || >=4.6.0, <4.6.4 · fixed in 4.5.11, 4.6.4

SFTPGo source-side file-pattern filter bypass during copy operations

• Broken access control

>=2.5.0, <2.7.6 · fixed in 2.7.6

Backstage: Improper access control in backend action invocation

• Broken access control

<0.17.8 · fixed in 0.17.8

Argo CD: AppProject destination-namespace and resource restrictions bypassed by PreDelete/PostDelete resource hooks

• Broken access control

>=2.10.0, <=2.14.21 · no fixed version yet

Dgraph: Zero Unauthenticated HTTP Admin removeNode Denial of Service

• Authentication bypass
• Broken access control

<25.4.0 · fixed in 25.4.0

mise permits untrusted local configuration to override default shell arguments

• Command injection
• Broken access control

<2026.7.14 · fixed in 2026.7.14

Leantime: Any Authenticated User Can Self-Escalate to Admin via Unauthorized JSON-RPC Methods

• Privilege escalation
• Broken access control

<3.10.0 · fixed in 3.10.0

Nginx UI OTP secure-session step-up is missing on sensitive mutation routes

• Broken access control

<1.9.10-0.20260703131214-23d1934099b0 · fixed in 1.9.10-0.20260703131214-23d1934099b0

Nginx UI: Account Takeover via Missing `RequireSecureSession` on User Management Endpoint

• Broken access control

<1.9.10-0.20260703131214-23d1934099b0 · fixed in 1.9.10-0.20260703131214-23d1934099b0

temporal-proxy payload decryption is not bound to the request namespace

• Temporal Technologies, Inc. temporal-proxy
• Broken access control

Idira Secrets Manager (Self-Hosted): Improper Authorization in REST API

• Palo Alto Networks Idira Secrets Manager (Self-Hosted)
• Broken access control

La Suite Docs through 6.0.1 Authorization Bypass via Comment Thread Creation

• suitenumerique docs
• Broken access control

OpenNMS REST authorization bypass via non-canonical HTTP method

• The OpenNMS Group Meridian
• The OpenNMS Group Horizon
• Broken access control
• CWE-204

WordPress PlanetStudio Payment Gateway plugin <= 1.3.3 - Broken Access Control vulnerability

• Planet studio PlanetStudio Payment Gateway
• Broken access control

WordPress Login with phone number plugin <= 1.8.77 - Broken Access Control vulnerability

• Hamid Alinia Login with phone number
• Broken access control

WordPress Knowledge Base plugin <= 3.2.0 - Broken Access Control vulnerability

• WebberZone Knowledge Base
• Broken access control

WordPress Flexible Quantity – Measurement Price Calculator for WooCommerce plugin <= 2.3.23 - Broken Access Control vulnerability

• WP Desk Flexible Quantity – Measurement Price Calculator for WooCommerce
• Broken access control

WordPress Sunshine Photo Cart plugin <= 3.7.4 - Broken Access Control vulnerability

• WP Sunshine Sunshine Photo Cart
• Broken access control

WordPress Ajax Search Lite plugin <= 4.14.5 - Broken Access Control vulnerability

• WPdreams Ajax Search Lite
• Broken access control