Advisories · Weakness
Broken access control.
Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 4.3 Medium
Microsoft Office SharePoint Elevation of Privilege Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Broken access control
- CVSS 6.5 Medium
Microsoft Office SharePoint Information Disclosure Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Broken access control
- CVSS 8.8 High
Microsoft Office SharePoint Elevation of Privilege Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Broken access control
- CVSS 8.8 High
Microsoft Office SharePoint Elevation of Privilege Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Broken access control
- CVSS 8.8 High
Microsoft Office SharePoint Elevation of Privilege Vulnerability
- Microsoft SharePoint Server Subscription Edition
- Broken access control
- CVSS 8.8 High
Visual Studio Code Remote Code Execution Vulnerability
- Microsoft Visual Studio Code
- Broken access control
- CVSS 7.8 High
Visual Studio Code Security Feature Bypass Vulnerability
- Microsoft Visual Studio Code
- Broken access control
- CVSS 7.0 High
Visual Studio Code Security Feature Bypass Vulnerability
- Microsoft Visual Studio Code
- Broken access control
- CVSS 8.7 High
Rapyd Admin 9.0.0 before 9.20.0 Authorization Bypass via UsersModalEditEmbed Component
- zofe rapyd-admin
- Broken access control
- CVSS 5.3 Medium
XBackBone through 3.8.2 Missing Authorization via Upload Vanity Endpoint
- sergix44 XBackBone
- Broken access control
- CVSS 5.3 Medium
QloApps through 1.7.0 Missing Hotel Access Restriction in Credit Slips
- Webkul QloApps
- Broken access control
- CVSS 5.3 Medium
QloApps through 1.7.0 Authorization Bypass via id_hotel in Room Type Creation
- Webkul QloApps
- Broken access control
- CVSS 6.3 Medium
Aureus ERP through 1.6.0 Unpublished Blog Post Disclosure via Direct URL
- Webkul Aureus ERP
- Broken access control
- CVSS 7.1 High
youlai-boot through 2.21.1 Missing Authorization in User Status Update Endpoint
- youlaitech youlai-boot
- Broken access control
- CVSS 8.7 High
youlai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege Escalation
- youlaitech youlai-boot
- Broken access control
- CVSS 5.3 Medium
ai-fusion-video through 1.2.0 Insecure Direct Object Reference in Generation Task Item Endpoints
- Stonewuu ai-fusion-video
- Broken access control
- CVSS 7.2 High
SkillHub through 0.2.22 Missing Authorization in CLI Skill Delete Endpoint
- iflytek skillhub
- Broken access control
- CVSS 6.0 Medium
Phase Console through 2.77.3 Missing Authorization via secretHistory GraphQL Query
- Phase Console
- Broken access control
- CVSS 7.1 High
ai-fusion-video through 1.2.0 Missing Authorization in Configuration Read Endpoints Exposes Stored Credentials
- Stonewuu ai-fusion-video
- Broken access control
- CVSS 7.1 High
Wukong AICRM through 20260610 Missing Authorization in System Configuration APIs Exposes Stored AI Provider Keys
- WuKongOpenSource Wukong AICRM
- Broken access control
- CVSS 8.7 High
Wukong AICRM through 20260610 Missing Authorization in User and Role Management APIs
- WuKongOpenSource Wukong AICRM
- Broken access control
- CVSS 7.2 High
Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
- CVSS 8.3 High
Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Adobe Commerce | Incorrect Authorization (CWE-863)
- Adobe Commerce
- Adobe Commerce B2B
- Broken access control
- CVSS 3.4 Low
Missing authorization in Fortinet FortiSIEM
- Fortinet FortiSIEM
- Broken access control
- CVSS 6.5 Medium
Git Sync connection configuration can be modified with read-only access
- Grafana Enterprise
- Grafana OSS
- Broken access control
- CVSS 6.3 Medium
Azure Monitor data source resource proxy allows calls to arbitrary Azure Resource Manager APIs
- Grafana Enterprise
- Grafana OSS
- Broken access control
- CWE-441
- CVSS 6.9 Medium
ThriveX-Server through 4.0 Missing Authorization via Article Retrieval Endpoints
- LiuYuYang01 ThriveX-Server
- Broken access control
- CVSS 7.1 High
fuintCatering through commit 122c9e6 IDOR via /clientApi/refund/detail
- fushengqian fuintCatering
- Broken access control
- CVSS 5.3 Medium
waynboot-mall through 2.0.0 IDOR via Mobile Cart Endpoints
- wayn111 waynboot-mall
- Broken access control
- CVSS 5.3 Medium
waynboot-mall through 2.0.0 IDOR via Mobile Address Endpoints
- wayn111 waynboot-mall
- Broken access control
- CVSS 5.3 Medium
waynboot-mall through 2.0.0 IDOR via Mobile Order Endpoints
- wayn111 waynboot-mall
- Broken access control
- CVSS 8.6 High
FastBee through 2.1.0 IDOR via DeviceController /iot/device Endpoints
- kerwincui FastBee
- Broken access control
- CVSS 7.1 High
Makunet maku-boot 4.3.0 through 5.0.0 Missing Authorization via Mail and SMS Config Endpoints
- makunet maku-boot
- Broken access control
- CVSS 5.3 Medium
PickMall lilishop through 4.4 IDOR via Goods Freight Endpoint
- PickMall lilishop
- Broken access control
- CVSS 7.1 High
PickMall lilishop through 4.4 IDOR via Goods Edit Endpoint
- PickMall lilishop
- Broken access control
- CVSS 5.3 Medium
yshopmall through 2.0.0 IDOR via After-Sales API in StoreAfterSalesController
- guchengwuyue yshopmall
- Broken access control
- CVSS 7.1 High
yshopmall through 2.0.0 IDOR via Member Address API in UserAddressController
- guchengwuyue yshopmall
- Broken access control
- CVSS 7.1 High
WorkFlow-Engine through 9.6.11 Missing Authorization via flowableui buttonOperation Endpoints
- risesoft-y9 WorkFlow-Engine
- Broken access control
- CVSS 7.1 High
SmartAdmin through 3.30.0 Missing Authorization via AdminProtectController
- 1024-lab SmartAdmin
- Broken access control
- CVSS 5.3 Medium
PublicCMS through V6.202608.a IDOR via tradeAddress/save Endpoint
- Sanluan PublicCMS
- Broken access control
- CVSS 5.3 Medium
JetLinks Community through 2.10.0 Missing Authorization via Alarm Enable/Disable Endpoints
- JetLinks Community
- Broken access control
- CVSS 7.1 High
JetLinks Community through 2.10.0 Missing Authorization via Product-Level Transparent Codec Save
- JetLinks Community
- Broken access control
- CVSS 8.6 High
MateCloud through 5.0.8 Missing Authorization via /api/v1/admin/storage API
- mateaix MateCloud
- Broken access control
- CVSS 2.3 Low
RuoYi-Cloud-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
- dromara RuoYi-Cloud-Plus
- Broken access control
- CVSS 2.3 Low
RuoYi-Vue-Plus through 6.0.0 IDOR via DELETE /auth/unlock/{socialId}
- dromara RuoYi-Vue-Plus
- Broken access control
- CVSS 6.9 Medium
B3log Symphony through 3.6.4 Missing Authorization in Admin Console Routes
- b3log Symphony
- Broken access control
- CVSS 5.3 Medium
Jorani before 1.0.4 Missing Authorization and SSRF via Contracts::import()
- Jorani
- Broken access control
- CVSS 5.3 Medium
Jorani before 1.0.4 Missing Authorization in HR Export Actions
- Jorani
- Broken access control
- CVSS 5.3 Medium
Jorani before 1.0.4 Insecure Direct Object Reference in Leave and Overtime Requests
- Jorani
- Broken access control
- CVSS 5.3 Medium
WordPress WP Event Solution plugin <= 4.1.25 - Broken Access Control vulnerability
- Arraytics WP Event Solution
- Broken access control
- CVSS 4.3 Medium
WordPress Download Monitor integration for WooCommerce plugin <= 1.0.3 - Broken Access Control vulnerability
- WP Chill Download Monitor integration for WooCommerce
- Broken access control
- CVSS 5.3 Medium
WordPress Premium Addons for Elementor plugin <= 4.11.110 - Broken Access Control vulnerability
- LeapWorx Premium Addons for Elementor
- Broken access control
- CVSS 6.5 Medium
Portal for ArcGIS has a security vulnerability
- Esri Portal for ArcGIS
- Broken access control
- CVSS 6.9 Medium
SourceCodester Simple Cafe Billing System User Management admin_class.php save_user improper authorization
- SourceCodester Simple Cafe Billing System
- Privilege escalation
- Broken access control
- CVSS 8.8 High
x86: XPTI may break on huge-memory systems
- Xen
- Broken access control
- CVSS 6.9 Medium
slackero phpwcms Extension Check cnt23.article.inc.php unrestricted upload
- slackero phpwcms
- Broken access control
- Unrestricted file upload
- CVSS 6.5 Medium
Plane: Unauthenticated Workspace Invitation Token Leakage
- plane
- Information disclosure
- Broken access control
- CVSS 4.8 Medium
HBAI-Ltd Toonflow-app exportData Endpoint information disclosure
- HBAI-Ltd Toonflow-app
- Information disclosure
- Broken access control
- CVSS 6.9 Medium
girishsaraf Online-Appointment-Booking-System submit2 changebookingstatus.php authorization
- girishsaraf Online-Appointment-Booking-System
- Broken access control