Broken access control.

charmbracelet/soft-serve HTTP responses disclose the existence and names of private repositories

• Information disclosure
• Broken access control

>=0.5.0, <0.12.3 · fixed in 0.12.3

WordPress Timetics plugin <= 1.0.65 - Broken Access Control vulnerability

• Arraytics Timetics
• Broken access control

Improper Access Control in Multi-Factor Authentication (MFA) Functionality in ManageEngine SharePoint Manager Plus

• ManageEngine SharePoint Manager Plus
• Broken access control

SOCFortress CoPilot: Cross-Tenant Arbitrary Object-Store Write via the Data-Store Upload Endpoint (customer_user)

• socfortress CoPilot
• Broken access control

Vvveb: Authenticated IDOR on admin/auth-token Allows Admin Privilege Escalation via API Token Theft

• givanz Vvveb
• Broken access control

WHartTest 2.2.0 through 2.8.1 Missing Authorization via task_center Scheduled-Task APIs

• MGdaasLab WHartTest
• Broken access control

Tamery (Conar) 0.26.1 before 0.99.0 Authorization Bypass via chatsMessages.update

• wannabespace tamery
• Broken access control

Tamery (Conar) 0.32.0 before 0.99.0 Broken Authorization via connectionsResources.create

• wannabespace tamery
• Broken access control

ShowDoc through 3.9.5 Authorization Bypass via paramDescLib deleteEntries

• star7th ShowDoc
• Broken access control

Blossom through 1.17.1 Authorization Bypass via Folder Endpoints

• Blossom
• Broken access control

PowerDNS-Admin through 2026.08.1 Authorization Bypass via /domain/<domain_name>/update

• PowerDNS-Admin
• Broken access control

FilePress through 3.0.1 Missing Authorization in PicHome Library Folder Operations

• zyx0814 FilePress
• Broken access control

DataCap through 2025.1.1 Privilege Escalation via allocationRole Missing Authorization

• devlive-community DataCap
• Broken access control

Nging through 5.3.5 Directory Listing Disclosure via /user/autocomplete_path

• admpub nging
• Broken access control

HuLa-Server through 3.0.7 IDOR via /user/friend/page Friend List Disclosure

• HuLaSpark HuLa-Server
• Broken access control

HuLa-Server through 3.0.7 IDOR via /feed/del Moment Deletion

• HuLaSpark HuLa-Server
• Broken access control

HuLa-Server through 3.0.7 IDOR via /privacy Endpoint in PrivacyController

• HuLaSpark HuLa-Server
• Broken access control

Orchard CMS 1.10.3 through 1.11 Improper Authorization via Media Library Folder Permission Check

• Orchard
• Broken access control

BlueKing CMDB through 3.14.6 Missing Authorization via /api/v3/hosts/search/asstdetail

• TencentBlueKing bk-cmdb
• Broken access control

RuoYi-Vue-Plus through 6.0.0 Data-Scope Bypass via /system/user/list/dept/{deptId}

• dromara RuoYi-Vue-Plus
• Broken access control

Open Web Analytics before 1.14.1 Cross-Site Data Disclosure via REST Report API

• Open Web Analytics
• Broken access control

ZenTao PMS through 22.6 Missing Authorization via doc.ajaxGetDoc

• easysoft zentaopms
• Broken access control

Blossom through 1.17.1 Authorization Bypass via Picture Delete and Star Endpoints

• Blossom
• Broken access control

Kirki WordPress Plugin < 6.4.1 Broken Object-Level Access Control via Page API

• Themeum Kirki
• Broken access control

Incorrect permission assignment in Dell OpenManage Enterprise

• Dell OpenManage Enterprise
• Broken access control

Miaomiaowu before 0.9.3 Cross-User Proxy Provider Config Disclosure via external_subscription_id

• iluobei miaomiaowu
• Broken access control

UNIT3D through 9.2.0 Private Playlist Disclosure via Playlist Zip Download

• HDInnovations UNIT3D
• Broken access control

ArcadeDB from 21.12.1 before 26.10.2 GraphQL Schema Replacement via Read-Only Query Endpoint

• ArcadeData arcadedb
• Broken access control

Traefik 3.7.11 before 3.7.15 Cross-Namespace Authorization Bypass via auth-tls-secret

• traefik
• Broken access control

Parse Server 9.7.0 before 9.10.5-alpha.10 Installation Update Misdirection via Installation ID

• parse-community parse-server
• Broken access control

Business::GoCardless versions before 1.01 for Perl complete redirect flows without checking the session token, letting a leaked redirect flow ID create payments against another customer's mandate

• Broken access control

Improper access control vulnerability in ESET Encryption products for Windows

• ESET spol. s.r.o. ESET Endpoint Encryption
• ESET spol. s.r.o. ESET Full Disk Encryption
• Broken access control

Incorrect authorization in Protectel

• ARKETEAM PROTECTELMAJ
• ARKETEAM BDF
• Broken access control

Plausible Analytics through 3.2.1 Mass Assignment via Traffic Change Notification Update

• Plausible Analytics
• Broken access control

Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Missing Authorization via core_grades_get_gradeitems

• moodle
• Broken access control

Moodle through 5.3.0, 5.2.4, 5.1.8, 5.0.11 and 4.5.15 Information Disclosure via core_grades_get_feedback

• moodle
• Broken access control

Jellyfin through 12.4 Authorization Bypass via GET /Items/Suggestions

• jellyfin
• Broken access control

Jellyfin through 12.4 Information Disclosure via GET /Playlists/{playlistId}

• jellyfin
• Broken access control

Lago through 1.55.0 Cross-Organization Invoice Payment Manipulation via Stripe Webhook

• lago
• Broken access control

Forgejo through 15.0.11, 16.0.7, and 17.0.1 Information Disclosure via /api/v1/user/keys/{id}

• forgejo
• Broken access control

Hyperswitch through 1.128.0 Missing Authorization in Payout Confirmation

• juspay hyperswitch
• Broken access control

Bitwarden Server before 2026.10.1 Authorization Bypass via POST /api/ciphers/create

• bitwarden server
• Broken access control

SQLite before 3.54.0 Authorizer Bypass via RIGHT or FULL JOIN USING

• SQLite
• Broken access control

ProFTPD before 1.3.9e and 1.3.10rc5 mod_sftp Copy-File Authorization Bypass

• ProFTPD
• Broken access control

Broken access control restriction in Cloud Controller API

• Cloud Foundry CAPI (Cloud Controller API)
• Cloud Foundry cf-deployment
• Broken access control

Space Developer can extract space-scoped broker credentials

• CAPI (Cloud Foundry Controller)
• Cloud Foundry CF Deployment
• Broken access control

AI Engine – The Chatbot, AI Framework & MCP for WordPress <= 3.8.6 - Missing Authorization to Administrator Account Takeover via Unauthenticated MCP OAuth Client Registration

• tigroumeow AI Engine – MCP Server & AI Chatbot for WordPress, with Claude, ChatGPT & Gemini
• Broken access control

Kroxylicious-authorizer-acl: kroxylicious: acl prefix matching can bypass authorization rules

• Red Hat streams for Apache Kafka 2
• Red Hat streams for Apache Kafka 3
• Broken access control

BuddyForms < 2.10.1 - Subscriber+ Arbitrary Post Modification

• BuddyForms
• Broken access control

Fraud Prevention For WooCommerce and EDD < 2.3.6 - Subscriber+ Arbitrary Customer Blacklisting

• Fraud Prevention For WooCommerce and EDD
• Broken access control

Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Author+) Administrator-Authored Post Creation via 'preset_id' Parameter

• keywordrush Content Egg – Affiliate Product Importer & Price Comparison
• Broken access control

Content Egg <= 12.0.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Post Meta Modification via 'post_id' Parameter via cegg_update_products AJAX Action

• keywordrush Content Egg – Affiliate Product Importer & Price Comparison
• Broken access control

Block AJAX - Highly critical - PHP object injection - SA-CONTRIB-2026-192

• Drupal Block AJAX
• Broken access control

Entity Reference Manager (Merge entities) - Critical - Access bypass - SA-CONTRIB-2026-194

• Drupal Entity Reference Manager (Merge entities)
• Broken access control

Actstream - Critical - Access bypass - SA-CONTRIB-2026-198

• Drupal Actstream
• Broken access control

Inline Entity Form Dialog - Moderately critical - Access bypass - SA-CONTRIB-2026-199

• Drupal Inline Entity Form Dialog
• Broken access control

Gutenberg - Moderately critical - Access bypass - SA-CONTRIB-2026-202

• Drupal Gutenberg
• Broken access control

Views Share - Moderately critical - Access bypass - SA-CONTRIB-2026-205

• Drupal Views Share
• Broken access control

Xray Audit - Moderately critical - Access bypass - SA-CONTRIB-2026-206

• Drupal Xray Audit
• Broken access control

DKAN - Moderately critical - Access bypass - SA-CONTRIB-2026-208

• Drupal DKAN
• Broken access control