Advisories · Weakness
Broken access control.
Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 7.0 High
WWBN AVideo before 29.4.0 Incorrect Authorization via confirmDeleteUser.json.php
- WWBN AVideo
- Broken access control
- CVSS 3.1 Low
Incorrect authorization in Roundcube Webmail
- Roundcube Webmail
- Broken access control
- CVSS 4.2 Medium
Advanced Search - Moderately critical - Access bypass - SA-CONTRIB-2026-118
- Drupal Advanced Search
- Broken access control
- CVSS 4.6 Medium
AI (Artificial Intelligence) - Moderately critical - Access Bypass - SA-CONTRIB-2026-120
- Drupal AI (Artificial Intelligence)
- Broken access control
- CVSS 4.6 Medium
AI translate - Moderately critical - Access Bypass - SA-CONTRIB-2026-121
- Drupal AI Translate
- Broken access control
- CVSS 5.3 Medium
Calculate Working Days - Critical - Access bypass - SA-CONTRIB-2026-122
- Drupal Calculate Working Days
- Broken access control
- CVSS 3.7 Low
Islandora - Moderately critical - Access bypass - SA-CONTRIB-2026-126
- Drupal Islandora
- Broken access control
- CVSS 6.5 Medium
Jsonapi Role Access - Critical - Access bypass - SA-CONTRIB-2026-127
- Drupal Jsonapi Role Access
- Broken access control
- CVSS 5.3 Medium
Unpublished Node Permissions - Critical - Access bypass - SA-CONTRIB-2026-132
- Drupal Unpublished Node Permissions
- Broken access control
- CVSS 5.3 Medium
Webform Submissions Delete - Moderately critical - Access bypass - SA-CONTRIB-2026-133
- Drupal Webform Submissions Delete
- Broken access control
- CVSS 6.5 Medium
SAML SSO - Service Provider - Critical - Improper access control - SA-CONTRIB-2026-141
- Drupal SAML SSO - Service Provider
- Broken access control
- CVSS 4.3 Medium
Taxonomy Term Glossary - Critical - Access bypass - SA-CONTRIB-2026-152
- Drupal Taxonomy Term Glossary
- Broken access control
- CVSS 4.3 Medium
Ultimate Table Field - Critical - Access bypass - SA-CONTRIB-2026-153
- Drupal Ultimate Table Field
- Broken access control
- CVSS 5.4 Medium
Webform - Moderately critical - Access bypass, Server-side request forgery - SA-CONTRIB-2026-164
- Drupal Webform
- Broken access control
- CVSS 3.3 Low
Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-168
- Drupal Webform
- Broken access control
- CVSS 5.3 Medium
Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-169
- Drupal Webform
- Broken access control
- CVSS 4.3 Medium
Webform - Less critical - Access bypass - SA-CONTRIB-2026-173
- Drupal Webform
- Broken access control
- CVSS 5.3 Medium
Webform - Moderately critical - Access bypass - SA-CONTRIB-2026-174
- Drupal Webform
- Broken access control
- CVSS 4.3 Medium
Commerce Decoupled Checkout - Moderately critical - Access bypass - SA-CONTRIB-2026-179
- Drupal Commerce Decoupled Checkout
- Broken access control
- CVSS 3.5 Low
Mermaid Diagram Field - Moderately critical - Access bypass - SA-CONTRIB-2026-180
- Drupal Mermaid Diagram Field
- Broken access control
- CVSS 4.3 Medium
Webform REST - Less critical - Access bypass - SA-CONTRIB-2026-186
- Drupal Webform REST
- Broken access control
- CVSS 6.5 Medium
CSS Usage Analyzer - Moderately critical - Improper access control - SA-CONTRIB-2026-189
- Drupal CSS Usage Analyzer
- Broken access control
- CVSS 6.5 Medium
Smart Content - Moderately critical - Access bypass - SA-CONTRIB-2026-190
- Drupal Smart Content
- Broken access control
- CVSS 6.8 Medium
Incorrect authorization in Roundcube Webmail
- Roundcube Webmail
- Broken access control
- CVSS 5.3 Medium
massCodeIO massCode Local HTTP Service index.ts information disclosure
- massCode
- Information disclosure
- Broken access control
- CVSS 6.8 Medium
Incorrect Authorization in GitLab
- GitLab
- Broken access control
- CVSS 4.3 Medium
Authorization Bypass Through User-Controlled Key in GitLab
- GitLab
- Broken access control
- CVSS 5.9 Medium
Incorrect Authorization in GitLab
- GitLab
- Broken access control
- CVSS 2.7 Low
Incorrect Authorization in GitLab
- GitLab
- Broken access control
- CVSS 9.8 CriticalCritical · CVSS 9+
Improper Access Control in Splunk SOAR
- Splunk SOAR
- Broken access control
- CVSS 6.5 Medium
Missing Authorization through the REST API in Splunk SOAR
- Splunk SOAR
- Broken access control
- CVSS 6.5 Medium
Improper Access Control during App Downloads in Splunk SOAR
- Splunk SOAR
- Broken access control
- CVSS 4.3 Medium
Sensitive Information Disclosure through Automation Broker Configuration in Splunk SOAR
- Splunk SOAR
- Broken access control
- CVSS 9.9 CriticalCritical · CVSS 9+
Security Hardening in Splunk Enterprise - October 2026
- Splunk Enterprise
- Broken access control
- CVSS 4.3 Medium
Missing Authorization through Sourcetype Renaming in Splunk Web for Splunk Enterprise
- Splunk Enterprise
- Broken access control
- CVSS 4.3 Medium
Improper Access Control in Field Extraction Management in Splunk Enterprise
- Splunk Enterprise
- Broken access control
- CVSS 6.5 Medium
Missing Authorization through REST API Endpoints in Splunk Secure Gateway
- Splunk Enterprise
- Splunk Secure Gateway
- Broken access control
- CVSS 8.8 High
Improper Access Control through Scheduled Search Safeguards in Splunk Enterprise
- Splunk Enterprise
- Broken access control
- CVSS 5.4 Medium
Authorization Bypass in the Data Management REST API in Splunk Enterprise
- Splunk Enterprise
- Broken access control
- CVSS 6.3 Medium
OpenClaw: Browser CDP discovery could accept blocked WebSocket URLs
- Broken access control
- Server-side request forgery (SSRF)
<2026.6.6 · fixed in 2026.6.6
GHSA-3x84-qq85-fj65 · CVE-2026-62197 - CVSS 7.0 High
Apache Traffic Server: origin_server_auth signs client-controlled AWS headers under the proxy's IAM credentials
- Apache Software Foundation Apache Traffic Server
- Broken access control
- CVSS 6.3 Medium
HarnessRouter Identity Mode app.py improper authorization
- HarnessRouter
- Privilege escalation
- Broken access control
- CVSS 6.9 Medium
SourceCodester Food Order Management System Admin Endpoint authorization
- SourceCodester Food Order Management System
- Broken access control
- CVSS 5.3 Medium
Missing kernel object permission check in devmux syscalls allows unprivileged user threads to retarget a device multiplexer
- zephyr
- Broken access control
- CVSS 7.7 High
Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 2.3 Low
Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 8.7 High
Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 5.3 Medium
Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 4.9 Medium
Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 7.2 High
Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 2.3 Low
Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 2.3 Low
Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 6.0 Medium
Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 4.3 Medium
WordPress H5P plugin <= 1.17.9 - Insecure Direct Object References (IDOR) vulnerability
- H5P
- Broken access control
- CVSS 2.3 Low
Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 4.3 Medium
WordPress eRoom plugin <= 1.7.1 - Broken Access Control vulnerability
- DigitalME eRoom
- Broken access control
- CVSS 5.3 Medium
Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands
- Apache Software Foundation Apache Pulsar
- Broken access control
- CVSS 8.6 High
Storybook: Missing origin validation in Storybook preview allows code injection from malicious websites
- Path traversal
- Code injection
>=8.0.0, <8.6.19 || >=9.0.0, <9.1.21 || >=10.0.0, <10.6.2 || >=11.0.0-alpha.0, <11.0.0-alpha.6 · fixed in 8.6.19, 9.1.21, 10.6.2, 11.0.0-alpha.6
GHSA-f2ph-cmg5-wxc8 · CVE-2026-114125 - CVSS 7.8 High
NoMachine Named Pipe Incorrect Permission Assignment Local Privilege Escalation Vulnerability
- NoMachine
- Broken access control
- CVSS 4.3 Medium
ApostropheCMS: GET /api/v1/@apostrophecms/page/:id bypasses viewRole restriction and exposes viewPermission-gated fields to lower-privileged users
- Broken access control
<4.34.0 · fixed in 4.34.0
GHSA-vh56-5m88-39rq · CVE-2026-112957