Advisories · Weakness

Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-109661 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.116.0 Missing Authorization Exposes Financial Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109660 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.112.0 Missing Authorization in Production Record Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109659 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.113.0 Missing Authorization Exposes Financial Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109658 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.115.0 Missing Authorization on Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109656 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.118.2 Unauthorized Item Master Data Access
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109655 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.115.0 Missing Authorization in Inventory Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109654 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.119.0 Missing Authorization in Transactional Email Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109650 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.112.0 Missing Authorization Exposes Personal Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109645 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.119.0 Unauthorized Record Creation via Missing Authorization
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109644 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.119.0 Unauthorized Access to Valuation Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109643 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.111.0 Missing Authorization Exposes Project Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109642 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.110.0 Missing Authorization in Certain Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109641 CVE record

CVSS 6.9 Medium

Frappe ERPNext before 15.110.0 Missing Authorization in Record Creation Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109640 CVE record

CVSS 7.2 High

Frappe ERPNext before 16.22.0 Missing Authorization Allows Unauthorized Record Modification
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109637 CVE record

CVSS 7.1 High

Frappe ERPNext before 16.14.0 Missing Authorization Allows Master Data Modification
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109636 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.115.0 Missing Authorization Exposes Financial Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109635 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.105.0 Missing Authorization in Document Creation Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109632 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.121.0 Missing Authorization on Certain Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109630 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.121.0 Missing Authorization in Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109629 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.121.3 Missing Authorization in Transactional Email Endpoint
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109628 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.121.0 Unauthorized Status Modification via Missing Authorization
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109627 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.120.0 Missing Authorization Exposes Financial Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109625 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.121.3 Missing Authorization Exposes Financial Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109624 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.120.0 Missing Authorization Exposes Personal Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109623 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.121.1 Unauthorized Document Modification via Missing Authorization
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109622 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.121.0 Unauthorized Document Modification via Missing Authorization
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109621 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.120.0 Unauthorized Party Record Access via Permission Bypass
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109617 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.121.0 Missing Authorization in Record Creation Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109616 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.121.3 Missing Authorization Allows Unauthorized Data Modification
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109615 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.121.0 Missing Authorization in Document Creation Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109614 CVE record

CVSS 7.1 High

Frappe ERPNext before 16.34.0 Missing Authorization Exposes Financial Data
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109613 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.121.0 Missing Authorization Allows Unauthorized Status Modification
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109611 CVE record

CVSS 5.3 Medium

Frappe ERPNext before 15.121.0 Missing Authorization in Certain Endpoints
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109610 CVE record

CVSS 7.1 High

Frappe ERPNext before 15.119.1 Missing Authorization Allows Unauthorized Document Modification
- frappe erpnext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109600 CVE record

CVSS 6.9 Medium

Frappe before 16.31.0 Improper Access Control in Document Follow Notifications
- frappe
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109599 CVE record

CVSS 5.3 Medium

Frappe before 15.113.3 Missing Authorization Allows Unauthorized Record Modification
- frappe
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109598 CVE record

CVSS 5.3 Medium

Frappe before 16.33.0 Broken Authorization via send_sms Endpoint
- frappe
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109572 CVE record

CVSS 7.2 High

Open WebUI 0.8.6 before 0.11.4 Privilege Escalation via Terminal Proxy
- open-webui
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2023-54412 CVE record

CVSS 7.1 High

Frappe before 13.46.3 Improper Access Control for Email Templates
- frappe
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2023-54410 CVE record

CVSS 5.3 Medium

Frappe before 13.22.0 Improper Authorization via Document Rename
- frappe
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-102596 CVE record

CVSS 4.3 Medium

Nango: Production flow RBAC bypass on private flow-read routes
- nango
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-49483 CVE record

CVSS 8.9 High

Code for IBMi: Uses IBM i components with blind check allowing arbitrary code execution
- codefori vscode-ibmi
- Broken access control
- CWE-345
Not analysed yet 12 Oct 2026
CVE-2026-18517 CVE record

CVSS 7.7 High

IBM Maximo Application Suite - Location Service for Esri Component Improper Access Control
- IBM Maximo Application Suite - Location Service for Esri Component
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109568 CVE record

CVSS 7.1 High

Shaark 1.2.13 through 1.2.44 Missing Authorization via API Update and Delete Routes
- MarceauKa Shaark
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109564 CVE record

CVSS 2.3 Low

LearnHouse before 1.4.0 Missing Authorization via Playground Duplicate Endpoint
- LearnHouse
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109562 CVE record

CVSS 5.3 Medium

SnapOtter 1.15.10 through 2.2.0 Missing Authorization via Upload and Preview API
- SnapOtter
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109561 CVE record

CVSS 2.3 Low

goose from 1.28.0 before 1.44.0 Manual Approval Bypass via Read-Only Tool Annotations
- goose
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109560 CVE record

CVSS 7.7 High

Continue CLI through 1.5.47 Bash Permission Rule Bypass via Command Chaining
- continue
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109559 CVE record

CVSS 8.4 High

EdgeEver Desktop 1.6.26 through 1.112.0 Navigation Allowlist Bypass via will-navigate
- tianma-if EdgeEver
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109377 CVE record

CVSS 5.3 Medium

ERPNext 9.0.0 through 16.50.0 Missing Authorization in Batch Lookup Methods
- Frappe ERPNext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109376 CVE record

CVSS 5.3 Medium

ERPNext 15.55.0 through 16.50.0 Incorrect Authorization via get_timesheet_html
- Frappe ERPNext
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-108930 CVE record

CVSS 5.1 Medium

Netcore NR268 DDNS ddns_wan_list_show.cgi ddns_wan_list_show information disclosure
- Netcore NR268
- Information disclosure
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-109427 CVE record

CVSS 7.1 High

Telegram-Stremio 5.1.0 Broken Object Authorization via Stream IDs
- weebzone Telegram-Stremio
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-97691 CVE record

CVSS 4.3 Medium

Convex: Unauthorized data access
- get-convex convex-backend
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-92119 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Apache Allura: REST API Mass Assignment
- Apache Software Foundation Apache Allura
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-108924 CVE record

CVSS 5.3 Medium

getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization
- Kirby
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-108923 CVE record

CVSS 5.3 Medium

1024-lab smart-admin Support Config Query queryByKey access control
- 1024-lab smart-admin
- Privilege escalation
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-108922 CVE record

CVSS 5.3 Medium

KusalkaSilva Learning-Management-System upload_save.php getimagesize unrestricted upload
- KusalkaSilva Learning-Management-System
- Broken access control
- Unrestricted file upload
Not analysed yet 12 Oct 2026
CVE-2026-18166 CVE record

CVSS 7.7 High

IBM® Db2® is vulnerable to arbitrary library loading via the CREATE WRAPPER command, allowing a privileged database user to read sensitive files from the host filesystem
- IBM Db2
- Broken access control
Not analysed yet 12 Oct 2026
CVE-2026-89140 CVE record

CVSS 6.0 Medium

Temporal Server internal completion callbacks are not bound to their namespace, allowing cross-namespace changes to Scheduler V2 schedule state
- Temporal Technologies, Inc. Temporal Server
- Broken access control
Not analysed yet 12 Oct 2026