Advisories · Weakness
Broken access control.
Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 5.3 Medium
Xiaozhi-esp32-server before 0.9.8 IDOR via device address-book endpoint
- xinnan-tech xiaozhi-esp32-server
- Broken access control
- CVSS 5.3 Medium
yudao-cloud through 2026.09 IDOR via after-sale-log list endpoint
- YunaiV yudao-cloud
- Broken access control
- CVSS 5.3 Medium
RosarioSIS before 12.9.1 Missing Authorization in Teacher Save Handlers
- francoisjacquet RosarioSIS
- Broken access control
- CVSS 5.3 Medium
DaybydayCRM through 2.2.1 Missing Authorization via ProjectsController updateAssign
- Bottelet DaybydayCRM
- Broken access control
- CVSS 6.5 Medium
WordPress WP Social Feed Gallery plugin <= 5.0.13 - Broken Access Control vulnerability
- quadlayers WP Social Feed Gallery
- Broken access control
- CVSS 4.3 Medium
IDOR: User reads and modifies findings from other people's projects
- cervantes
- Broken access control
- CVSS 5.4 Medium
BOLA Allows Cross-Project Target Tampering
- cervantes
- Broken access control
- CVSS 6.5 Medium
WordPress SureDash plugin <= 1.12.2 - Broken Access Control vulnerability
- Brainstorm Force SureDash
- Broken access control
- CVSS 7.1 High
Broken access control in JiraController
- cervantes
- Broken access control
- CVSS 5.3 Medium
Scada-LTS AmCharts Data API AmChartValuesAPI.java HttpServletRequest.getParameter authorization
- Scada-LTS
- Broken access control
- CVSS 3.7 Low
GeoDirectory < 2.8.194 - Unauthenticated Guest-Submitted Listing Modification
- GeoDirectory
- Broken access control
- CVSS 4.3 Medium
GeoDirectory < 2.8.194 - Subscriber+ Arbitrary Listing Image Modification via IDOR
- GeoDirectory
- Broken access control
- CVSS 5.4 Medium
News Kit Addons For Elementor <= 1.4.7 - Subscriber+ Arbitrary Post Meta Update via nekit_update_mega_menu_form
- News Kit Addons For Elementor
- Broken access control
- CVSS 4.3 Medium
News Kit Addons For Elementor < 1.4.9 - Subscriber+ Plugin Installation and Activation via nekit_install_importer
- News Kit Addons For Elementor
- Broken access control
- CVSS 6.5 Medium
MAS Videos <= 1.3.4 - Subscriber+ Arbitrary Post Deletion via delete_video/delete_playlist
- MAS Videos
- Broken access control
- CVSS 6.5 Medium
Front End Users <= 3.2.35 - Unauthenticated Membership Level and Account Status Self-Assignment
- Front End Users
- Broken access control
- CVSS 5.4 Medium
Advanced Twenty Seventeen <= 1.3.1 - Subscriber+ Site Theme Switch via ats_create_child_theme
- Advanced Twenty Seventeen
- Broken access control
- CVSS 4.4 Medium
virtualenv: Seeded files retain permissions from an older cache
- Broken access control
<21.14.9 · fixed in 21.14.9
GHSA-fc2g-4w5p-6whm · CVE-2026-113720 - CVSS 6.0 Medium
LangGraph: Namespace labels containing `.` reach other namespaces in Postgres and SQLite stores
- Broken access control
- CWE-20
<3.1.3 · fixed in 3.1.3
GHSA-6hmw-9432-67qq · CVE-2026-115883 - CVSS 6.8 Medium
FastMCP: Post-transform component authorization is skipped on direct calls
- Broken access control
>=3.0.0, <3.4.10 || >=4.0.0, <4.1.2 · fixed in 3.4.10, 4.1.2
GHSA-7xgj-8392-5q4r - CVSS 7.8 High
Incorrect default permissions in Apple Container
- Apple Container
- Broken access control
- CVSS 6.5 Medium
Livewire: Authorization bypass in #[Authorize] via reordered parameter keys and #[Json] execution order
- Broken access control
>=4.3.0, <4.4.8 · fixed in 4.4.8
GHSA-mhf7-xp6r-6qrc - CVSS 9.1 CriticalCritical · CVSS 9+
Echo: Rejected WebSocket upgrades can bypass Echo route-level access controls
- HTTP request smuggling
- Broken access control
>=4.0.0, <4.16.1 · fixed in 4.16.1
GHSA-cxf3-9h37-7rr8 · CVE-2026-118264 - CVSS 5.3 Medium
OpenReception: unauthenticated ML-KEM key injection into the staff-crypto recipient directory in any tenant
- open-reception appointment-booking-software
- Broken access control
- CVSS 5.3 Medium
Tenda F6 Web Management cross-site request forgery
- Tenda F6
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 7.1 High
obsidian-tc: Memory-lifecycle tools overwrite unowned notes or partially commit lifecycle changes
- Broken access control
- CWE-459
>=1.0.1, <1.31.4 · fixed in 1.31.4
GHSA-r3g7-r4hr-m258 · CVE-2026-115478 - CVSS 6.9 Medium
SiYuan: The publish filter for database backlinks consults the forbidden list instead of the visibility list, disclosing hidden-tier documents to anonymous readers
- Broken access control
<0.0.0-20260730150429-5b42614311b0 · fixed in 0.0.0-20260730150429-5b42614311b0
GHSA-p4qw-vx5p-g984 · CVE-2026-73049 - CVSS 5.8 Medium
SiYuan: The publish filter for local storage returns the administrator's entire storage map with only three keys sanitized
- Broken access control
<0.0.0-20260729005258-4daee87d4152 · fixed in 0.0.0-20260729005258-4daee87d4152
GHSA-xp3q-r38w-vgqm - CVSS 4.3 Medium
obsidian-tc Bridge tools leak denied-note data via unfiltered sibling fields
- Information disclosure
- Broken access control
<1.3.1 · fixed in 1.3.1
GHSA-43r2-c7g8-prc8 · CVE-2026-77362 - CVSS 7.1 High
Tandoor Recipes < 2.7.0 Cross-Space Permission Cache Poisoning
- Tandoor Recipes
- Broken access control
- CVSS 7.1 High
obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
- Broken access control
>=1.13.0, <1.31.4 · fixed in 1.31.4
GHSA-737x-cwfr-5vvc · CVE-2026-115477 - CVSS 9.9 CriticalCritical · CVSS 9+
obsidian-tc tokens can access arbitrary configured vaults
- Broken access control
<1.3.1 · fixed in 1.3.1
GHSA-84c9-qqpq-2pq5 · CVE-2026-77366 - CVSS 6.5 Medium
obsidian-tc: Default folder ACL is fail-open; .obsidian plugin secrets are readable by default
- Information disclosure
- Broken access control
<1.3.1 · fixed in 1.3.1
GHSA-cvp8-vvgf-69q4 · CVE-2026-77364 - CVSS 4.7 Medium
obsidian-tc : Symlink read-ACL scope bypass via lexical path checks
- Path traversal
- Broken access control
<1.3.1 · fixed in 1.3.1
GHSA-c5xx-h28h-f682 · CVE-2026-77361 - CVSS 7.4 High
Improper access control in node
- node
- Broken access control
- CVSS 3.6 Low
Improper access control in node
- node
- Broken access control
- CVSS 3.3 Low
Improper access control in node
- node
- Broken access control
- CVSS 6.5 Medium
Goobi viewer: WebSocket endpoints lack server-side authentication and origin validation
- intranda goobi-viewer-core
- Authentication bypass
- Broken access control
- CVSS 6.5 Medium
baserCMS: Path traversal in the BcThemeFile admin screen allows file disclosure
- baserproject basercms
- Path traversal
- Information disclosure
- CVSS 7.0 High
DJI CrystalSky ZS600C DJIUpdateService binder exposes privileged operations without authorization
- DJI CrystalSky ZS600C
- Broken access control
- CVSS 7.8 High
Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted zmunbound Sudo Configuration
- Zimbra Collaboration Suite
- Broken access control
- CVSS 8.6 High
DJI CrystalSky ZS600C android.dji.server binder transaction 1018 command injection as root
- DJI CrystalSky ZS600C
- Command injection
- Broken access control
- CVSS 7.8 High
Zimbra Collaboration Suite Local Privilege Escalation via Unrestricted Postfix Sudo Permissions
- Zimbra Collaboration Suite
- Broken access control
- CVSS 8.7 High
Zimbra Collaboration Suite Missing Authorization in ConfigureZimlet Enables Delegated Administrator Privilege Escalation
- Zimbra Collaboration Suite
- Broken access control
- CVSS 4.3 Medium
Zimbra Collaboration Suite Cross-Account Authorization Bypass via Forged Shared-File Records
- Zimbra Collaboration Suite
- Broken access control
- CVSS 2.3 Low
Chatwoot before 4.17.0 Cross-Account Authorization Bypass via source_id
- chatwoot
- Broken access control
-
Unauthorized volume access through asset replacement
- Broken access control
Published by the maintainers · not yet reviewed by GitHub
>=5.10.0, <5.11.2 · fixed in 5.11.2
GHSA-hvp5-pwxx-2752 -
Unauthenticated GraphQL cross-site disclosure via "localized" field bypasses schema Sites scope
- Broken access control
Published by the maintainers · not yet reviewed by GitHub
>=5.0.0, <5.11.2 · fixed in 5.11.2
GHSA-mp59-9rf5-93wr -
Anonymous GraphQL clients can read out-of-scope section content
- Broken access control
Published by the maintainers · not yet reviewed by GitHub
>=5.0.0, <5.11.2 · fixed in 5.11.2
GHSA-xpg7-m6gm-4xfh - CVSS 7.1 High
BlueSpiceUserManager: Missing authorization in REST endpoints for blocking and unblocking users
- Hallo Welt! GmbH BlueSpice
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Local Privilege Escalation in CGM CLININET
- CGM CLININET
- Broken access control
- CVSS 6.8 Medium
Insecure File Permissions in CGM CLININET
- CGM CLININET
- Broken access control
- CVSS 7.5 High
WordPress WPMobile.App plugin <= 11.86 - Broken Access Control vulnerability
- Amauri.IO WPMobile.App
- Broken access control
- CVSS 6.5 Medium
WordPress Knit Pay plugin <= 9.6.3.0 - Broken Access Control vulnerability
- Knit Pay
- Broken access control
- CVSS 6.5 Medium
WordPress Car Rental Manager plugin <= 1.5.3 - Broken Access Control vulnerability
- Magepeople inc. Car Rental Manager
- Broken access control
- CVSS 8.1 High
Advanced Custom Fields: Extended 0.9.2.7 - Unauthenticated Non-Administrator Account Takeover via Front-End User Update Action
- Advanced Custom Fields: Extended
- Advanced Custom Fields: Extended PRO
- Broken access control
- CVSS 3.1 Low
LiteSpeed Cache < 7.9.2 - Subscriber+ Pinned Administrative Notice Dismissal
- LiteSpeed Cache
- Broken access control
- CVSS 3.7 Low
Popup Builder < 4.4.6 - Unauthenticated Popup Trashing via post_type Parameter
- Popup Builder
- Broken access control
- CVSS 4.9 Medium
Download Monitor < 5.3.5 - Multisite Subsite Admin+ Incorrect Authorization via Approved Download Paths REST Route
- Download Monitor
- Broken access control
- CVSS 5.5 Medium
Speed Optimizer < 7.8.5 - Admin+ Network Option Update via enable-option/disable-option
- Speed Optimizer
- Broken access control