Advisories · Weakness

Broken access control.

Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.

CVE-2026-112999 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113327 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113207 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113146 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113289 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113183 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113290 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113155 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113051 CVE record

CVSS 6.5 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113209 CVE record

CVSS 6.5 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113005 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113219 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113319 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113343 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113014 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113275 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113220 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113105 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113264 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113129 CVE record

CVSS 6.5 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113131 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113302 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113198 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113011 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113211 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113035 CVE record

CVSS 6.5 Medium

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113281 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113142 CVE record

CVSS 6.5 Medium

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113240 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113018 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113263 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113006 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113069 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113113 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113109 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113022 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113174 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113231 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-112993 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113179 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113222 CVE record

CVSS 9.6 CriticalCritical · CVSS 9+

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113253 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113092 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113058 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113097 CVE record

CVSS 8.8 High

Missing authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113101 CVE record

CVSS 8.8 High

Incorrect authorization in Google Chrome
- Google Chrome
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-112380 CVE record

CVSS 9.0 CriticalCritical · CVSS 9+

Missing authorization in the WhatsApp channel in Kiro Crew
- Amazon Kiro Crew
- Broken access control
Not analysed yet 20 Oct 2026
@modelcontextprotocol/express +3 npm

CVSS 6.8 Medium

MCP TypeScript SDK: Server bearer authentication accepted tokens issued for another service
- Broken access control
>=2.0.0, <2.0.2 · fixed in 2.0.2

GHSA-rvq5-wwqv-78pq · CVE-2026-111771 Not analysed yet 20 Oct 2026
@modelcontextprotocol/sdk npm

CVSS 8.6 High

MCP TypeScript SDK: Experimental tasks were not tied to the session that created them
- Broken access control
>=1.24.0, <1.32.0 · fixed in 1.32.0

GHSA-22jm-h49p-29qw · CVE-2026-111767 Not analysed yet 20 Oct 2026
apostrophe npm

CVSS 6.9 Medium

ApostropheCMS: The general public can access @apostrophecms/user objects via a relationship (viewRole is not applied to the general public)
- Broken access control
<4.33.0 · fixed in 4.33.0

GHSA-xf6w-q65w-4f2w · CVE-2026-113653 Not analysed yet 20 Oct 2026
apostrophe npm

CVSS 3.7 Low

ApostropheCMS: Missing Authorization on Notification PATCH/DELETE Endpoints
- Broken access control
<4.33.0 · fixed in 4.33.0

GHSA-vwwx-px9w-crrc · CVE-2026-113665 Not analysed yet 20 Oct 2026
apostrophe npm

CVSS 4.3 Medium

ApostropheCMS: Authenticated Object-Level Authorization Bypass in exist-in-locale Reveals Restricted Localized Draft Identifiers
- Broken access control
<4.33.0 · fixed in 4.33.0

GHSA-vmxh-77cw-65j7 · CVE-2026-113660 Not analysed yet 20 Oct 2026
@apostrophecms/import-export npm

CVSS 5.4 Medium

ApostropheCMS import-export: NoSQL injection via update-key value lets a crafted import match and overwrite an unidentified document
- Broken access control
- Other injection
<3.7.0 · fixed in 3.7.0

GHSA-jqw5-w6h3-44g6 · CVE-2026-113662 Not analysed yet 20 Oct 2026
CVE-2026-113643 CVE record

CVSS 5.3 Medium

EspoCRM PDF Rendering Pipeline ImageSourceProvider.php get authorization
- EspoCRM
- Broken access control
Not analysed yet 20 Oct 2026
apostrophe npm

CVSS 5.3 Medium

ApostropheCMS: :_id/locales REST route omits the public-API authorization gate its sibling read routes enforce (unauthenticated doc-existence + locale metadata disclosure)
- Information disclosure
- Broken access control
<4.33.0 · fixed in 4.33.0

GHSA-gqh3-7856-rjjg · CVE-2026-113668 Not analysed yet 20 Oct 2026
apostrophe npm

CVSS 5.3 Medium

ApostropheCMS: Page REST API authorization bypass
- Broken access control
<4.33.0 · fixed in 4.33.0

GHSA-2j32-q6rx-h844 · CVE-2026-110904 Not analysed yet 20 Oct 2026
CVE-2026-97406 CVE record

CVSS 9.1 CriticalCritical · CVSS 9+

Authentication Bypass via Bearer Tokens to Unauthorized Credential Minting
- Xerj Console API
- Authentication bypass
- Broken access control
Not analysed yet 20 Oct 2026
apostrophe npm

CVSS 4.3 Medium

ApostropheCMS: Same-parent page reorder in @apostrophecms/page move() re-ranks a restricted parent's children without create authorization
- Broken access control
<4.33.0 · fixed in 4.33.0

GHSA-2jrp-qc93-h2j8 · CVE-2026-113655 Not analysed yet 20 Oct 2026
CVE-2026-112861 CVE record

CVSS 6.3 Medium

WordPress Participants Database plugin <= 2.7.8.5 - Insecure Direct Object References (IDOR) vulnerability
- xnau webdesign Participants Database
- Broken access control
Not analysed yet 20 Oct 2026
CVE-2026-113507 CVE record

CVSS 6.9 Medium

aaPanel common.py GetClientIp access control
- aaPanel
- Privilege escalation
- Broken access control
Not analysed yet 20 Oct 2026