Broken access control.

abp-next-admin 10.2.0 through 10.6.0 IDOR in AIManagement Chat Conversations

• colinin abp-next-admin
• Broken access control

IoTSharp through 3.6.1 Cross-Tenant Data Exposure via Customers and Devices APIs

• IoTSharp
• Broken access control

HestiaCP before 1.10.5 Protected Admin Bypass via Cron Job Creation

• hestiacp
• Broken access control

10up Distributor before 2.3.2 Missing Authorization via dt_push AJAX Action

• 10up Distributor
• Broken access control

TDuck Survey Form through 5.3 Missing Authorization via /user/form/setting/{key}

• TDuckCloud tduck-survey-form
• Broken access control

O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint

• O2OA
• Broken access control

Oqtane Framework through 10.2.6 Cross-Site Settings Disclosure via Setting API

• Oqtane Framework
• Broken access control

Mall4cloud through 4.0 IDOR Exposing Buyer Addresses via order_addr Endpoint

• gz-yami mall4cloud
• Broken access control

DataCap through 2025.1.1 IDOR via BaseController.getInfoForPath Exposes Credentials

• devlive-community DataCap
• Broken access control

roncoo-education through 25.0.0-RELEASE IDOR via Order Pay Cancel and Continue Endpoints

• roncoo-education
• Broken access control

B3log Solo through 4.4.0 Missing Authorization in ArticleConsole

• b3log Solo
• Broken access control

PKP Open Journal Systems through 3.5.0-5 Cross-Journal Subscription IDOR via updateSubscription

• PKP Open Journal Systems
• Broken access control

Jeepay through 3.2.9 IDOR via DELETE /api/divisionReceivers/{recordId}

• jeequan jeepay
• Broken access control

Jeepay through 3.2.9 IDOR via POST /api/mch/payConfigs

• jeequan jeepay
• Broken access control

Huly Platform through 0.7.432 Account Takeover via mergeSpecifiedPersons RPC

• hcengineering Huly Platform
• Broken access control

Jpom through 2.11.12 Cross-Workspace Authorization Bypass via SshFileController

• dromara Jpom
• Broken access control

eladmin through 2.7 Broken Access Control via /api/users Update and Delete

• elunez eladmin
• Broken access control

PlayEdu through 2.3 Missing Authorization via Student CourseController Endpoints

• PlayEdu
• Broken access control

Incorrect authorization in the Arm Cortex-R82 MPU port in FreeRTOS-Kernel

• FreeRTOS-Kernel
• Broken access control

Tandoor Recipes: Cross-user IDOR in /api/recipe-from-source/ bookmarklet import — read and destroy another space member's pending BookmarkletImport

• recipes
• Broken access control

MariaDB: GRANT PROXY with empty password incorrectly checks grantor's privileges

• MariaDB server
• Broken access control
• CWE-620

MariaDB: Unauthorized file access via CONNECT engine UDFs

• MariaDB server
• Broken access control

Mailu: Domain managers can allow themselves to spoof on other hosted domains they should not control

• Mailu
• Broken access control

Mailu domain managers can take over higher-privileged accounts

• Mailu
• Privilege escalation
• Broken access control

Dockhand: Unauthenticated container exec via WebSocket upgrade

• Finsys dockhand
• Authentication bypass
• Broken access control

Incorrect Permission Assignment for Critical Resource in lomiri-download-manager

• UBports lomiri-download-manager
• Broken access control

Incorrect Permission Assignment for Critical Resource in lomiri-download-manager

• UBports lomiri-download-manager
• Broken access control

Open Zaak: /zaken/_zoek and /enkelvoudiginformatieobjecten/_zoek endpoints do not filter result lists based on authorizations linked to token

• open-zaak
• Broken access control

J4Care dcm4che Missing Authorization

• J4Care dcm4chee-arc-light
• Broken access control

Guangzhou Juan IoT Technology EseeCloud Improperly Controlled Modification of Dynamically-Determined Object Attributes

• Guangzhou Juan IoT Technology Co., Ltd. EseeCloud App
• Guangzhou Juan IoT Technology Co., Ltd. EseeCloud Firmware
• Broken access control

Mass assignment in Devolutions Server

• Devolutions Server
• Broken access control

Incorrect authorization in Devolutions Server

• Devolutions Server
• Broken access control

Incorrect authorization in Devolutions Server

• Devolutions Server
• Broken access control

WordPress Passster plugin <= 4.3.18 - Broken Access Control vulnerability

• WP Chill Passster
• Broken access control

WordPress Advanced Post Manager plugin <= 4.5.6 - Broken Access Control vulnerability

• Liquid Web / StellarWP Advanced Post Manager
• Broken access control

WordPress YITH PayPal Express Checkout for WooCommerce plugin <= 1.61.0 - Broken Access Control vulnerability

• YITH PayPal Express Checkout for WooCommerce
• Broken access control

WordPress BookIt plugin <= 2.6.0.5 - Broken Access Control vulnerability

• Liquid Web / StellarWP BookIt
• Broken access control

WordPress SmartCrawl plugin <= 3.16.4 - Insecure Direct Object References (IDOR) vulnerability

• WPMU DEV SmartCrawl
• Broken access control

WordPress WP Event Solution plugin <= 4.1.26 - Broken Access Control vulnerability

• Arraytics WP Event Solution
• Broken access control

WordPress MapSVG plugin <= 8.16.1 - Sensitive Data Exposure vulnerability

• PT Norther Lights Production MapSVG
• Broken access control

Apache Kylin: Missing authorization and path-confinement on system meta dump

• Apache Software Foundation Apache Kylin
• Broken access control

Squeeze < 1.8.1 - Subscriber+ Missing Authorization via squeeze_restore_attachment

• Squeeze
• Broken access control

Missing Authorization in rdiffweb

• ikus-soft rdiffweb
• Broken access control

Missing Authorization in NordVPN for Windows

• Nord Security NordVPN
• Broken access control

IDOR in SFM Software's Costifier

• SFM Software Technologies Inc. Costifier
• Broken access control

Kubernetes Ingress NGINX provider: a TLS-option cache hit skips the cross-namespace authorization check, letting an Ingress use another namespace's CA secret

• Broken access control

Published by the maintainers · not yet reviewed by GitHub

>=v3.7.11, <=v3.7.14 · fixed in v3.7.15

Mattermost Server fails to restrict Slack import account binding, allowing team admins to forge posts as existing users

• Mattermost
• Broken access control

Private team metadata disclosure via the team search API

• Mattermost
• Broken access control

Mattermost invitation tokens not bound to invited email address allowing unauthorized team and private channel access

• Mattermost
• Broken access control

Mattermost fails to reject OAuth application sessions in account type switch, allowing account takeover via bearer token

• Mattermost
• Broken access control

Missing server side validation allowed user to quarantine a DM and GM post

• Mattermost
• Broken access control

Mattermost guest account privilege escalation via member roles API

• Mattermost
• Broken access control

WordPress Site Reviews plugin <= 8.3.4 - Broken Access Control vulnerability

• Gemini Labs Site Reviews
• Broken access control

WP Map Block <= 3.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Map Publish/Unpublish/Delete via set_status() and bulk() REST Endpoints

• tusharimran WP Map Block – Google Maps, OpenStreetMap, Mapbox, Store & Shop Locator, Directory, Listings & Filters
• Broken access control

WSP MCP <= 2.9.5 - Authenticated (Subscriber+) Sensitive Information Disclosure via Broken Access Control to 'wsp_get_posts' MCP Tool

• bilalnaseer WSP MCP – Free MCP Plugin for WordPress: Connect Claude, ChatGPT & AI Agents
• Broken access control

Photo Engine (Media Organizer & Lightroom) <= 6.5.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion and Upload via /?wplr-sync-api 'delete' / 'sync' action

• tigroumeow Photo Engine (Media Organizer & Lightroom)
• Broken access control

Smush < 4.3.4 - Admin+ Network-Wide Plugin Settings Update on Multisite

• Smush
• Broken access control

Salon Booking System < 10.31.9 - Unauthenticated Booking Creation with Arbitrary Customer ID and Status

• Salon Booking System
• Broken access control

MB Custom Post Types & Custom Taxonomies < 2.12.2 - Subscriber+ Missing Authorization via CPT UI Migration

• MB Custom Post Types & Custom Taxonomies
• Broken access control

Visual Form Builder <= 3.1 - Subscriber+ Arbitrary Form Field Reordering via Missing Authorization

• Visual Form Builder
• Broken access control