Advisories · Weakness
Broken access control.
Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Booking Creation with Arbitrary Price via Multiple AJAX Actions
- TrueBooker
- Broken access control
- CVSS 5.3 Medium
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Customer PII Disclosure via IDOR in 'refappbkd' Parameter
- TrueBooker
- Broken access control
- CVSS 5.3 Medium
TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Plugin Settings Overwrite via admin_setting_setup_data
- TrueBooker
- Broken access control
- CVSS 5.3 Medium
BDM Digital Payment Gateway 1.2.7 - 1.3.12 - Unauthenticated Payment Confirmation Forgery
- BDM Digital Payment Gateway
- Broken access control
- CVSS 5.3 Medium
Snap Finance <= 3.11.0 - Unauthenticated Payment Confirmation Forgery via snap_finance_complete_payment
- Snap Finance
- Broken access control
- CVSS 5.3 Medium
Gateway for Vantiv on WC <= 1.0.1 - Unauthenticated Order Payment Completion via Payment Callback Forgery
- Gateway for Vantiv on WC
- Broken access control
- CVSS 5.3 Medium
ElementsReady Addons for Elementor <= 6.7.2 - Unauthenticated Paid Download Access Bypass via 'downloadtype' Parameter
- ElementsReady Addons for Elementor
- Broken access control
- CVSS 4.3 Medium
ElementsReady Addons for Elementor <= 6.7.2 - Subscriber+ Plugin Settings Overwrite via Missing Authorization
- ElementsReady Addons for Elementor
- Broken access control
- CVSS 5.3 Medium
ActiveTrail for WooCommerce <= 1.2.6 - Unauthenticated Arbitrary Coupon Creation
- ActiveTrail for WooCommerce
- Broken access control
- CVSS 5.3 Medium
donetick History Deletion model.go CanDeleteHistory improper authorization
- donetick
- Privilege escalation
- Broken access control
- CVSS 5.3 Medium
calcom cal.com/cal.diy Webhook util.ts createWebhookProcedure authorization
- calcom cal.com
- calcom cal.diy
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Insecure Default Policy and Unrestricted OIDC Enrollment in Google OSS Agent Mesh (SAM)
- Google SAM
- Information disclosure
- Authentication bypass
- CVSS 9.3 CriticalCritical · CVSS 9+
Missing Authentication on /libp2p-http Ingress in Google OSS Agent Mesh (SAM)
- Google SAM
- Authentication bypass
- Broken access control
- CVSS 5.3 Medium
aircheng-org iWebShop-5 Password Change system.php admin_repwd_act cross-site request forgery
- aircheng-org iWebShop-5
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 6.9 Medium
light0011 cms Captcha Validation UserController.class.php access control
- light0011 cms
- Privilege escalation
- Broken access control
- CVSS 6.5 Medium
Gitea API disclosure of private user social graph, keys and stars
- Gitea
- Broken access control
- CVSS 3.1 Low
Gitea label deletion across repository and organization IDs
- Gitea
- Broken access control
- CVSS 6.3 Medium
Gitea release attachment re-linking of issue attachments
- Gitea
- Broken access control
- CVSS 4.3 Medium
Gitea watched repositories API disclosure after access revocation
- Gitea
- Broken access control
- CVSS 4.3 Medium
Gitea reactions accepted on locked issues and comments
- Gitea
- Broken access control
- CVSS 5.3 Medium
dyad-sh dyad OAuth Callback cross-site request forgery
- dyad
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 5.3 Medium
OneUptime 14.0.2 before 14.0.69 Incorrect Authorization in Kubernetes AI Actions
- oneuptime
- Broken access control
- CVSS 2.3 Low
Teable before 2026-10-12T12-45-53Z.3331 Authorization Bypass via Folder Rename Endpoint
- teable
- Broken access control
- CVSS 8.6 High
ProjectSend 2.0.0 before 2.7.0 Incorrect Authorization via Users API Token Abilities
- ProjectSend
- Broken access control
- CVSS 7.2 High
Vanus 0.8.0 through 0.9.0 Missing Authorization in Gateway Streaming RPCs
- vanus
- Broken access control
- CVSS 6.5 Medium
WordPress Kit (formerly ConvertKit) plugin <= 3.4.6 - Broken Access Control vulnerability
- Kit (formerly ConvertKit)
- Broken access control
- CVSS 7.5 High
WordPress Electronic Signature Add-on for Fluent Forms plugin <= 2.0.5 - Insecure Direct Object References (IDOR) vulnerability
- WP E-Signature Electronic Signature Add-on for Fluent Forms
- Broken access control
- CVSS 6.5 Medium
WordPress Advanced File Manager plugin <= 5.4.14 - Broken Access Control vulnerability
- WPExperts Advanced File Manager
- Broken access control
- CVSS 4.9 Medium
AI Engine < 3.7.9 - Editor+ Arbitrary Post Modification via update_media_metadata and approve_media
- AI Engine
- Broken access control
- CVSS 4.9 Medium
AI Engine < 3.7.9 - Editor+ Arbitrary Post Deletion via reject_media
- AI Engine
- Broken access control
- CVSS 6.5 Medium
Modern Events Calendar Lite < 7.36.4 - Subscriber+ Arbitrary Post Modification via IDOR
- Modern Events Calendar Lite
- Broken access control
- CVSS 4.3 Medium
Salon Booking System < 10.31.11 - Subscriber+ Coupon Code Disclosure via Discounts REST Route
- Salon Booking System
- Broken access control
- CVSS 5.5 Medium
Salon Booking System < 10.31.11 - Salon Staff+ Administrator Role Demotion via Customer Editor
- Salon Booking System
- Broken access control
- CVSS 4.9 Medium
Tasty Recipes Lite 1.2 - 1.2.10 - Contributor+ Taxonomy Term Creation, Renaming and Deletion
- Tasty Recipes Lite
- Broken access control
- CVSS 5.3 Medium
Product Designer <= 1.0.40 - Unauthenticated Design Template Data Injection
- PickPlugins Product Designer for WooCommerce
- Broken access control
- CVSS 5.1 Medium
David-Crty Databasement Scheduled Restore SaveScheduledRestoreRequest.php authorization
- David-Crty Databasement
- Broken access control
- CVSS 4.3 Medium
WordPress SMS Alert Order Notifications plugin <= 4.0.1 - Broken Access Control vulnerability
- Cozy Vision Technologies Pvt. Ltd. SMS Alert Order Notifications
- Broken access control
- CVSS 6.0 Medium
Coder 2.30.0 before 2.34.8 Cross-Organization File Disclosure via DownloadFile RPC
- coder
- Broken access control
- CVSS 5.3 Medium
Coder 2.0.0 before 2.34.8 Authorization Bypass via User-Level ACL in RBAC Policy
- coder
- Broken access control
- CVSS 6.9 Medium
Admidio before 5.0.16 Information Disclosure via rss/links.php Weblinks Feed
- admidio
- Broken access control
- CVSS 7.1 High
Admidio 5.0.11 before 5.0.16 Broken Access Control via inventory_data.php
- admidio
- Broken access control
- CVSS 5.3 Medium
Admidio 5.0.0 before 5.0.16 Authorization Bypass via pdfl Mode in lists_show.php
- admidio
- Broken access control
- CVSS 7.1 High
Admidio 5.0.0 before 5.0.16 IDOR via Forum Topic Update
- admidio
- Broken access control
- CVSS 7.1 High
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Authorization Bypass via attachment.php Downloads
- thorsten phpMyFAQ
- Broken access control
- CVSS 8.7 High
phpMyFAQ 4.0.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta BOLA in FAQ Update via REST API
- thorsten phpMyFAQ
- Broken access control
- CVSS 7.0 High
phpMyFAQ 3.2.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta IDOR Leaks TOTP Secret via /admin/api/user/data
- thorsten phpMyFAQ
- Broken access control
- CVSS 6.9 Medium
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass via Comments and Attachments API
- thorsten phpMyFAQ
- Broken access control
- CVSS 5.3 Medium
phpMyFAQ before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Draft FAQ Attachment Disclosure via attachment.php
- thorsten phpMyFAQ
- Broken access control
- CVSS 7.1 High
phpMyFAQ 4.2.0-alpha before 4.2.0-beta Authorization Bypass in Attachment Administration Endpoints
- thorsten phpMyFAQ
- Broken access control
- CVSS 5.3 Medium
phpMyFAQ 4.1.0 before 4.1.9 and 4.2.0-alpha before 4.2.0-beta Missing Authorization via Admin Dashboard
- thorsten phpMyFAQ
- Broken access control
- CVSS 5.1 Medium
phpMyFAQ 4.0.0 before 4.1.9 Incorrect Authorization via news update API
- thorsten phpMyFAQ
- Broken access control
- CVSS 5.3 Medium
Frontend Admin by DynamiApps <= 3.29.13 - Unauthenticated ACF Options Page Field Update via Form Submission
- ACF Frontend Admin by DynamiApps
- Broken access control
- CVSS 5.3 Medium
WP User Manager 2.9 - 2.9.19 - Unauthenticated Account Creation via Stripe Registration Payment Bypass
- WP User Manager
- Broken access control
- CVSS 3.7 Low
Patreon WordPress < 1.10.0 - Unauthenticated Taxonomy and Term Enumeration
- Patreon WordPress
- Broken access control
- CVSS 6.5 Medium
LearnPress <= 4.4.10 - Missing Authorization to Authenticated (Subscriber+) Email Address Enumeration via 'search-authors' AJAX Action
- thimpress LearnPress – WordPress LMS Plugin for Create and Sell Online Courses
- Broken access control
- CVSS 7.5 High
WP Booking System <= 2.1.0.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'wpbs_action=email_logs' Action
- murgroland WP Booking System – Booking Calendar
- Broken access control
- CVSS 6.8 Medium
WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Privilege Escalation via 'user_permission' Parameter via Cross-Form Nonce Reuse
- murgroland WP Booking System – Booking Calendar
- Broken access control
- CVSS 6.5 Medium
WP Booking System <= 2.1.0.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure via wpbs_refresh_calendar_editor AJAX action
- murgroland WP Booking System – Booking Calendar
- Broken access control
- CVSS 4.3 Medium
Tutor LMS <= 4.1.0 - Insecure Direct Object Reference to Authenticated (Author+) Arbitrary Course Modification and Ownership Takeover via 'ID' Parameter
- themeum Tutor LMS – eLearning and online course solution
- Broken access control
- CVSS 7.5 High
Kirki <= 6.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Exposure via Context Smuggling via 'context' Parameter
- themeum Kirki – Freeform Page Builder, Website Builder & Customizer
- Broken access control