Broken access control.

Missing authorization in Apple macOS and others

• Apple macOS
• Apple visionOS
• Broken access control

Letta through 0.16.8 Cross-Tenant Impersonation via user_id Header

• letta
• Broken access control

Coze Studio through 0.5.1 Cross-Space Workflow IDOR via Workflow API Handlers

• coze-dev coze-studio
• Broken access control

EvoScientist 0.1.0 before 0.2.5 Human Approval Bypass via Async Sub-Agents

• EvoScientist
• Broken access control

OpenSRE through 0.1.2026.10.19 Approval Gate Bypass via shell_run Prompt Injection

• Tracer-Cloud opensre
• Broken access control

Langflow OSS Authorization Bypass Through User-Controlled Key

• IBM Langflow OSS
• Broken access control

Incorrect permission assignment in Dell Application Store

• Dell Application Store
• Broken access control

Traefik before 2.11.46, 3.6.17, and 3.7.1 Cross-Namespace Resource Reference via Kubernetes Annotations

• traefik
• Broken access control

Craft CMS 5.0.0 before 5.11.0 GraphQL Site-Scope Bypass via Mutations

• cms
• Broken access control

Parse Server before 8.6.98 and 9.x before 9.10.3-alpha.1 Session Class-Level Permission Bypass

• parse-community parse-server
• Broken access control

Parse Server before 8.6.99 and 9.x before 9.10.3-alpha.2 Information Disclosure via User Update

• parse-community parse-server
• Broken access control

Mercury: Unauthenticated Remote Code Execution in /api/terminals - access control bypass

• Broken access control
• CWE-185

>=3.0.0, <3.2.4 · fixed in 3.2.4

agent-router: MCP session resume does not verify the embedded anti-hijacking subject; default Helm seed makes session IDs forgeable

• Hard-coded credentials
• Broken access control

>=0.4.0-rc1, <1.2.0-rc1 · fixed in 1.2.0-rc1

Mercury: Unauthenticated Remote Code Execution via /api/kernels

• Broken access control

<3.2.6 · fixed in 3.2.6

Refresh Token Misuse via Validation Flaw in Multiple WSO2 Products Enables Unauthorized Resource Consumption

• WSO2 API Manager
• WSO2 Universal Gateway
• Broken access control

FOSSBilling: Low-privileged staff can read and modify configuration of deactivated extensions

• FOSSBilling
• Broken access control

Incorrect Default Permissions in hMailServer

• Progressive Robot Ltd hMailServer
• Broken access control

Missing Authorization in hMailServer

• Progressive Robot Ltd hMailServer
• Broken access control

Missing Authorization in hMailServer

• Progressive Robot Ltd hMailServer
• Broken access control

Semaphore UI through 2.19.16 RCE via Task Environment Ansible Variable Override

• semaphoreui Semaphore UI
• Broken access control

Camunda Broken Access Control via Cockpit

• Camunda 7
• Broken access control

Camunda Missing Authorization in Task Sub-Resources

• Camunda 7
• Broken access control

Sensei LMS 4.26.4 Broken Access Control via save_new_message

• Automattic Sensei LMS
• Broken access control

Sensei LMS 4.26.4 Broken Access Control via add_new_module_term AJAX

• Automattic Sensei LMS
• Broken access control

vraj404 Criminal-Management-System home.php move_uploaded_file unrestricted upload

• vraj404 Criminal-Management-System
• Broken access control
• Unrestricted file upload

ai-genius-automations octoally index.ts information disclosure

• ai-genius-automations octoally
• Information disclosure
• Broken access control

FlyCms through commit edfdf724 Mass Assignment via /ucenter/account_update

• sunkaifei FlyCms
• Broken access control

FlyCms through commit edfdf724 Missing Authorization via Action Counter Endpoint

• sunkaifei FlyCms
• Broken access control

BoxyHQ SaaS Starter Kit through 1.6.0 Missing Authorization on Team Payment API

• BoxyHQ saas-starter-kit
• Broken access control

CheckCle through 1.6.0 Missing Authorization via Empty PocketBase API Rules

• operacle checkcle
• Broken access control

Flarum Extension Manager 2.0.0-beta.1 before 2.0.0-beta.8 Missing Authorization via Task API

• Flarum Extension Manager
• Broken access control

Krayin CRM before 2.2.7 Broken Object Level Authorization in Mail Module

• krayin laravel-crm
• Broken access control

Krayin CRM before 2.2.7 IDOR via Quote Search and Lead-Products Endpoints

• krayin laravel-crm
• Broken access control

sglang-router through 0.3.2 Authorization Bypass via Mesh HA Management Routes

• sgl-project sglang-router
• Broken access control

RisingWave before 3.1.0 Missing Authorization via posix_fs and fs Connectors

• risingwave
• Broken access control

Frappe Helpdesk before 1.26.0 Authorization Bypass via raised_by in Ticket Creation

• frappe helpdesk
• Broken access control

Frappe CRM before 1.74.0 Missing Authorization via add_note_to_call_log

• frappe crm
• Broken access control

Frappe CRM before 1.81.2 Missing Authorization on CRM Notification Records

• frappe crm
• Broken access control

satya-vinay Events-Management-System project.sql file access

• satya-vinay Events-Management-System
• Broken access control
• Information disclosure

WordPress Surfer plugin <= 1.8.0.744 - Broken Access Control vulnerability

• Surfer
• Broken access control

WordPress Event Tickets plugin <= 5.30.1 - Insecure Direct Object References (IDOR) vulnerability

• Liquid Web / StellarWP Event Tickets
• Broken access control

WordPress YITH WooCommerce Product Bundles plugin <= 2.29.0 - Broken Access Control vulnerability

• YITH WooCommerce Product Bundles
• Broken access control

WordPress FluentForm plugin <= 6.2.15 - Broken Access Control vulnerability

• WP ManageNinja LLC FluentForm
• Broken access control

WordPress LearnPress plugin <= 4.4.10 - Broken Access Control vulnerability

• ThimPress LearnPress
• Broken access control

WordPress FluentCommunity plugin <= 2.11.0 - Broken Access Control vulnerability

• WP ManageNinja LLC FluentCommunity
• Broken access control

WordPress Broadcast Live Video plugin <= 7.3.7 - Broken Access Control vulnerability

• VideoWhisper.com Broadcast Live Video
• Broken access control

Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions

• Apache Software Foundation Apache Camel
• Broken access control

Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions

• Apache Software Foundation Apache Answer
• Broken access control

Apache Answer: Improper Authorization in Question Invite User Lookup

• Apache Software Foundation Apache Answer
• Broken access control

Apache Answer: Email Code Purpose Confusion May Allow Account Takeover

• Apache Software Foundation Apache Answer
• Broken access control

Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions

• Apache Software Foundation Apache Answer
• Broken access control

MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings

• MISP
• Information disclosure
• Broken access control

MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution

• MISP
• Information disclosure
• Broken access control

Apache Kylin: missing JDBC-config authorization

• Apache Software Foundation Apache Kylin
• Broken access control

MISP Proposal ACL Bypass: Incomplete Distribution Level Check in Shadow Attribute Access Control

• MISP
• Broken access control

pg_read_binary_file_blocks 缺少初始用户权限校验，普通用户可读取 relation 文件块

• openGauss-server
• Broken access control

Dav-ee dairy-management-system AJAX Endpoint checkfarmer.json.php information disclosure

• Dav-ee dairy-management-system
• Information disclosure
• Broken access control

App Builder 3.8.4 - 5.7.0 - Unauthenticated Option Write and Redirect via includes/pure.php

• App Builder
• Broken access control

Snap Finance 1.0.8 - 3.11.0 - Unauthenticated Arbitrary Order Status Change via Multiple AJAX Actions

• Snap Finance
• Broken access control

TrueBooker Appointment Booking 1.1.9 - 1.2.9 - Unauthenticated Service and Category Creation and Modification

• TrueBooker
• Broken access control