Advisories · Weakness

Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-86990 CVE record

CVSS 5.1 Medium

Improper access control in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-65392 CVE record

CVSS 4.4 Medium

Missing authorization in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-113948 CVE record

CVSS 5.5 Medium

Incorrect permission assignment in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112569 CVE record

CVSS 8.2 High

Improper access control in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-86939 CVE record

CVSS 4.9 Medium

Missing authorization in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-113914 CVE record

CVSS 5.5 Medium

Missing authorization in Apple iOS and iPadOS
- Apple iOS and iPadOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112539 CVE record

CVSS 7.1 High

Incorrect permission assignment in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112647 CVE record

CVSS 5.5 Medium

Incorrect authorization in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112542 CVE record

CVSS 7.5 High

Improper access control in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112692 CVE record

CVSS 5.5 Medium

Missing authorization in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple tvOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112446 CVE record

CVSS 5.5 Medium

Missing authorization in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112447 CVE record

CVSS 5.3 Medium

Incorrect authorization in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112685 CVE record

CVSS 5.5 Medium

Missing authorization in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112559 CVE record

CVSS 5.5 Medium

Missing authorization in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112467 CVE record

CVSS 3.3 Low

Improper access control in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112624 CVE record

CVSS 5.1 Medium

Improper access control in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-65397 CVE record

CVSS 5.5 Medium

Missing authorization in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-86920 CVE record

CVSS 5.5 Medium

Missing authorization in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-65363 CVE record

CVSS 8.4 High

Improper access control in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112701 CVE record

CVSS 5.5 Medium

Missing authorization in Apple iOS and iPadOS
- Apple iOS and iPadOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112557 CVE record

CVSS 5.5 Medium

Improper access control in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112609 CVE record

CVSS 5.5 Medium

Missing authorization in Apple iOS and iPadOS
- Apple iOS and iPadOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112473 CVE record

CVSS 7.4 High

Improper access control in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-84614 CVE record

CVSS 4.6 Medium

Improper access control in Apple iOS and iPadOS
- Apple iOS and iPadOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112706 CVE record

CVSS 5.5 Medium

Missing authorization in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple tvOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112497 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Improper access control in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-84594 CVE record

CVSS 5.5 Medium

Improper access control in Apple iOS and iPadOS
- Apple iOS and iPadOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-84605 CVE record

CVSS 4.0 Medium

Incorrect authorization in Apple iOS and iPadOS
- Apple iOS and iPadOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112675 CVE record

CVSS 5.5 Medium

Missing authorization in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112618 CVE record

CVSS 5.5 Medium

Improper access control in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple visionOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112462 CVE record

CVSS 3.3 Low

Incorrect authorization in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112570 CVE record

CVSS 8.2 High

Improper access control in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-86880 CVE record

CVSS 5.5 Medium

Improper access control in Apple iOS and iPadOS
- Apple iOS and iPadOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-86984 CVE record

CVSS 5.5 Medium

Improper access control in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112567 CVE record

CVSS 7.5 High

Improper access control in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112480 CVE record

CVSS 7.5 High

Improper access control in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112455 CVE record

CVSS 5.5 Medium

Missing authorization in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112681 CVE record

CVSS 5.5 Medium

Incorrect authorization in Apple iOS and iPadOS
- Apple iOS and iPadOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112551 CVE record

CVSS 5.5 Medium

Missing authorization in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112678 CVE record

CVSS 5.5 Medium

Missing authorization in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112506 CVE record

CVSS 5.5 Medium

Missing authorization in Apple macOS
- Apple macOS
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-110720 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Consul-k8s vulnerable to a cross-namespace authorization bypass in component ACL binding rules
- HashiCorp Tooling
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-115804 CVE record

CVSS 6.4 Medium

Consul vulnerable to an authorization bypass in health check registration
- HashiCorp Consul
- HashiCorp Consul Enterprise
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-33522 CVE record

CVSS 5.3 Medium

BUG-000182936 - ArcGIS Server has a security vulnerability.
- Esri ArcGIS Server
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-105765 CVE record

CVSS 7.5 High

Consul vulnerable to an authorization bypass in the agent's service mesh leaf certificate API
- HashiCorp Consul
- HashiCorp Consul Enterprise
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-112839 CVE record

CVSS 4.3 Medium

WordPress Customer Coupons for WooCommerce plugin <= 1.3.14 - Broken Access Control vulnerability
- VillaTheme Customer Coupons for WooCommerce
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-102649 CVE record

CVSS 9.9 CriticalCritical · CVSS 9+

Burrito: Unauthenticated webhooks trigger unauthorized Terraform plans when webhookSecret is unset
- padok-team burrito
- Authentication bypass
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-116384 CVE record

CVSS 5.3 Medium

Bdtask Garage 24 Garage Management Software Backend improper authorization
- Bdtask Garage 24 Garage Management Software
- Privilege escalation
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2013-10077 CVE record

CVSS 6.9 Medium

OctoPrint API Key settings.py getSettings information disclosure
- OctoPrint
- Information disclosure
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-115598 CVE record

CVSS 5.3 Medium

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
- ThimPress LearnPress
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-115597 CVE record

CVSS 5.4 Medium

WordPress LearnPress plugin <= 4.4.11 - Broken Access Control vulnerability
- ThimPress LearnPress
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-116388 CVE record

CVSS 5.3 Medium

WordPress Amelia plugin <= 2.4.10 - Broken Access Control vulnerability
- TMS Amelia
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-93846 CVE record

CVSS 3.8 Low

Team admin can escalate a team member's permissions via the team member roles endpoint
- Mattermost
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-116368 CVE record

CVSS 6.9 Medium

DeepSeek Harness Browser Auth browser-auth.ts improper authorization
- DeepSeek Harness
- Privilege escalation
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-115748 CVE record

CVSS 8.8 High

Apache Vysper: Authorization bypass
- Apache Software Foundation Apache Vysper
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-77060 CVE record

CVSS 6.8 Medium

Incorrect Permission Assignment for Critical Resource in boneIO
- boneIO black_debian_images
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-116340 CVE record

CVSS 5.3 Medium

iFlytek astron-agent Console Knowledge-List Endpoint FileInfoV2Service.java FileInfoV2Service.listKnowledgeByPage authorization
- iFlytek astron-agent
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-93328 CVE record

CVSS 9.3 CriticalCritical · CVSS 9+

Missing Authorization in MCP Toolbox for Databases allows Arbitrary File Read and Write
- Google Cloud MCP Toolbox for Databases (googleapis/mcp-toolbox)
- Path traversal
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-93847 CVE record

CVSS 3.5 Low

Improper post type validation on scheduled post endpoints
- Mattermost
- Broken access control
Not analysed yet 26 Oct 2026
CVE-2026-116284 CVE record

CVSS 5.3 Medium

Kameleo Local API user-info information disclosure
- Kameleo
- Information disclosure
- Broken access control
Not analysed yet 26 Oct 2026