Advisories · Weakness
Broken access control.
Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 9.8 CriticalCritical · CVSS 9+
CVE-2026-118131
- GnuPG
- Broken access control
- CWE-379
- CVSS 6.5 Medium
CVE-2026-16491 CVE Record
- Grafana Enterprise
- Grafana OSS
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Adobe Campaign Classic (ACC) | Incorrect Authorization (CWE-863)
- Adobe Campaign Classic
- Broken access control
- CVSS 6.9 Medium
oretnom23 php-travel-agency-system employee_insert.php unrestricted upload
- oretnom23 php-travel-agency-system
- Broken access control
- Unrestricted file upload
- CVSS 8.3 High
Incorrect authorization in Veeam Backup for Microsoft 365
- Veeam Backup for Microsoft 365
- Broken access control
- CVSS 4.3 Medium
Improper access control in Nextcloud Server
- Nextcloud Server
- Broken access control
- CVSS 4.3 Medium
Improper access control in Nextcloud Files Confidential
- Nextcloud Files Confidential
- Broken access control
- CVSS 3.5 Low
Improper access control in Nextcloud Richdocuments
- Nextcloud Richdocuments
- Broken access control
- CVSS 3.5 Low
Improper access control in Nextcloud Collectives
- Nextcloud Collectives
- Broken access control
- CVSS 4.6 Medium
Improper access control in Nextcloud Tables
- Nextcloud Tables
- Broken access control
- CVSS 8.7 High
Fireware OS Missing Authentication in FireCluster Sync Allows Privilege Escalation
- WatchGuard Fireware OS
- Command injection
- Authentication bypass
- CVSS 7.2 High
Fireware OS Missing Command Validation allows Authenticated Arbitrary File Modification as Root
- WatchGuard Fireware OS
- Path traversal
- Broken access control
- CVSS 9.2 CriticalCritical · CVSS 9+
Fireware OS Missing Authentication in FireCluster Sync Daemon Allows Remote Root Action Injection
- WatchGuard Fireware OS
- Command injection
- Authentication bypass
- CVSS 4.6 Medium
Authlib: OpenID implicit grant checks raw scope instead of allowed scope before issuing ID tokens
- Broken access control
<1.9.0 · fixed in 1.9.0
GHSA-q686-2qmg-hqc7 · CVE-2026-114619 - CVSS 6.4 Medium
PhpSpreadsheet: SSRF whitelist bypass via unre-validated HTTP redirect in Drawing::setPath external image loading
- Broken access control
- Server-side request forgery (SSRF)
<1.30.7 || >=2.0.0, <2.1.19 || >=2.2.0, <2.4.8 || >=3.3.0, <3.10.8 || >=4.0.0, <5.10.0 · fixed in 1.30.7, 2.1.19, 2.4.8, 3.10.8, 5.10.0
GHSA-2phh-27fw-q4gc · CVE-2026-108360 - CVSS 4.0, no score published
Strands Agents: Default FileSessionManager storage is world-readable on shared systems
- Broken access control
<1.48.0 · fixed in 1.48.0
GHSA-763v-5pjm-fx36 - CVSS 7.5 High
3Dviewer-Nextcloud: Share password not enforced when streaming 3D models from a public link share
- maz1987in 3Dviewer-Nextcloud
- Authentication bypass
- Broken access control
- CVSS 7.8 High
Local Privilege Escalation via DLL Sideloading in TeamViewer Patch Management for Windows
- TeamViewer Full Client
- TeamViewer Host
- Broken access control
- CVSS 7.8 High
Local privilege escalation via improper IPC access control in TeamViewer Remote Management Monitoring
- TeamViewer Full Client
- TeamViewer Host
- Broken access control
- CVSS 7.1 High
Ghost: Authorization Bypass in Comment Like Feature
- Broken access control
- Other injection
>=5.9.0, <6.44.1 · fixed in 6.44.1
GHSA-qrh6-cwg3-343x · CVE-2026-103288 - CVSS 6.9 Medium
SiYuan: MCP file tool's blocklist is incomplete relative to the HTTP file API it claims to align with, exposing publish-mode passwords and other sensitive workspace files
- Broken access control
<0.0.0-20260808051406-3542530c505f · fixed in 0.0.0-20260808051406-3542530c505f
GHSA-c8r8-95hg-mp34 · CVE-2026-60083 - CVSS 8.8 High
Privilege escalation in the DOM: UI Events & Focus Handling component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
- CVSS 8.1 High
Site isolation issue in the DOM: Service Workers component
- Mozilla Firefox
- Mozilla Thunderbird
- Broken access control
- CVSS 8.1 High
Ajenti has potential Remote Code Execution
- Broken access control
<2.2.13 · fixed in 2.2.13
GHSA-vcw3-r3fx-j444 · CVE-2026-27975 - CVSS 4.3 Medium
IDOR in Netiket Information Technologies' EdoWEB
- Netiket Information Technologies EdoWEB
- Broken access control
- CVSS 5.3 Medium
MrDoc through 1.1.1 Broken Access Control via manage_doc_share
- zmister2016 MrDoc
- Broken access control
- CVSS 6.9 Medium
rssant 1.9.0 through 1.9.1 Information Disclosure via publish.story_get Endpoint
- anyant rssant
- Broken access control
- CVSS 4.8 Medium
Advanced Custom Fields: Extended <= 0.9.2.6 - Missing Authorization to Unauthenticated Arbitrary Attachment Deletion via Email Action Dynamic File Field
- hwk-fr Advanced Custom Fields: Extended
- Broken access control
- CVSS 6.5 Medium
Improper access control in Dell PowerProtect Data Domain
- Dell PowerProtect Data Domain
- Broken access control
- CVSS 7.1 High
REDAXO before 5.21.4 Broken Access Control in Slice Operations
- redaxo core
- Broken access control
- CVSS 7.1 High
REDAXO before 5.21.4 Missing Authorization in Media Pool Bulk Move
- redaxo core
- Broken access control
- CVSS 7.1 High
REDAXO before 5.21.4 Missing Authorization in Version and History Previews
- redaxo core
- Broken access control
- CVSS 7.7 High
REDAXO before 5.21.5 Privilege Escalation via Backup Export of Authentication Tables
- redaxo core
- Broken access control
- CVSS 6.1 Medium
REDAXO core before 5.21.5 Missing Authorization in rex_api_package API
- redaxo core
- Broken access control
- CVSS 6.9 Medium
Semantic MediaWiki 7.3.0 before 7.3.1 Missing Authorization via smwtask Update Task
- SemanticMediaWiki
- Broken access control
- CVSS 7.1 High
Semantic MediaWiki 2.5.0 before 7.3.1 Missing Authorization via Is edit protected
- SemanticMediaWiki
- Broken access control
- CVSS 6.9 Medium
Semantic MediaWiki 7.3.0 Missing Authorization via smwtask API run-joblist and update
- SemanticMediaWiki
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Joomla Extension - balbooa.com - Missing Authorization Check on Editor Controller Task in Gridbox < 2.20.4.2
- balbooa.com Gridbox extension for Joomla
- Broken access control
- CVSS 8.3 High
Missing Authorization in Compute Engine allows Cross-Project Disk Exfiltration
- Google Cloud Compute Engine
- Broken access control
- CVSS 4.3 Medium
URL prefix handling permits API key read-scope bypass in Psono Server
- esaqa GmbH Psono
- Broken access control
- CVSS 5.4 Medium
File-transfer type confusion permits unauthorized repository writes in Psono Server
- esaqa GmbH Psono
- Broken access control
- CVSS 6.9 Medium
code-projects Simple Content Management System Admin welcome.php authorization
- code-projects Simple Content Management System
- Broken access control
- CVSS 5.1 Medium
SourceCodester Online Food Ordering System add_food.php unrestricted upload
- SourceCodester Online Food Ordering System
- Broken access control
- Unrestricted file upload
- CVSS 6.9 Medium
OpenPanel before 3.0.0 Missing Authorization via reference.getChartReferences
- openpanel
- Broken access control
- CVSS 6.9 Medium
OpenPanel before 3.0.0 Missing Authorization in event.bots tRPC Procedure
- openpanel
- Broken access control
- CVSS 5.9 Medium
StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
- Kubernetes
- Broken access control
- CVSS 6.9 Medium
QloApps 1.6.0 through 1.7.0 Unauthorized Hotel Review Submission via qlohotelreview
- qloapps
- Broken access control
- CVSS 6.9 Medium
QloApps through 1.7.0 Guest Order Disclosure via id_cart in Order Confirmation
- qloapps
- Broken access control
- CVSS 6.9 Medium
TOTOLINK A950RG global.so getLanguageCfg information disclosure
- TOTOLINK A950RG
- Information disclosure
- Broken access control
- CVSS 5.5 Medium
Missing authorization in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
- CVSS 5.5 Medium
Missing authorization in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
- CVSS 7.5 High
Improper access control in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
- CVSS 5.5 Medium
Missing authorization in Apple macOS
- Apple macOS
- Broken access control
- CVSS 5.5 Medium
Missing authorization in Apple iOS and iPadOS
- Apple iOS and iPadOS
- Broken access control
- CVSS 5.5 Medium
Missing authorization in Apple macOS
- Apple macOS
- Broken access control
- CVSS 7.8 High
Missing authorization in Apple macOS
- Apple macOS
- Broken access control
- CVSS 7.5 High
Missing authorization in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
- CVSS 3.3 Low
Incorrect authorization in Apple iOS and iPadOS and others
- Apple iOS and iPadOS
- Apple macOS
- Broken access control
- CVSS 7.1 High
Incorrect permission assignment in Apple macOS
- Apple macOS
- Broken access control
- CVSS 5.5 Medium
Improper access control in Apple macOS
- Apple macOS
- Broken access control