Advisories · Weakness
Broken access control.
Missing or wrong authorization checks, IDOR, loose permissions. Every Advisory and CVE whose weakness (CWE) is one of these, newest first.
- CVSS 4.3 Medium
LORIS has incorrect access checks in issue_tracker
- aces Loris
- Broken access control
- CVSS 6.3 Medium
LORIS has incorrect access checks in API for Imaging Browser
- aces Loris
- Broken access control
- CVSS 6.5 Medium
Shopper: customer detail IDOR exposes administrator and staff records
- shopper
- Broken access control
- CVSS 8.1 High
Shopper: missing variant-delete authorization permits destructive single and bulk actions
- shopper
- Broken access control
- CVSS 8.1 High
ZTNET privilege bypass: any user can deactivate arbitrary accounts via /api/auth/user/invalidateUser
- sinamics ztnet
- Broken access control
- CVSS 8.2 High
Filecoin Pin: Fork bypass in the privileged GitHub Actions workflow
- filecoin-project filecoin-pin
- Broken access control
- CVSS 7.1 High
RAGFlow: OpenAI-compatible agent completion bypasses private canvas authorization
- infiniflow ragflow
- Broken access control
- CVSS 6.0 Medium
pgAdmin 4: Non-administrators can share a server with every user
- pgadmin.org pgAdmin 4
- Broken access control
- CVSS 7.1 High
pgAdmin 4: Connection services are not restricted in server mode
- pgadmin.org pgAdmin 4
- Hard-coded credentials
- Broken access control
- CVSS 8.9 High
pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username
- pgadmin.org pgAdmin 4
- Authentication bypass
- Broken access control
- CVSS 9.2 CriticalCritical · CVSS 9+
pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks
- pgadmin.org pgAdmin 4
- Authentication bypass
- Broken access control
- CVSS 3.5 Low
Immich: A regular user can create SharedLink for album/asset belonging to another user through CreateSharedLink API
- immich
- Broken access control
- CVSS 4.3 Medium
Immich: Partner "view-only" sharing leaks GPS coordinates of the sharer's archived assets via GET /api/map/markers
- immich
- Broken access control
- CVSS 8.7 High
Secret Server JWT issuance error
- Delinea Secret Server (On-Prem)
- Broken access control
- CVSS 9.4 CriticalCritical · CVSS 9+
Secret Server device validation error
- Delinea Secret Server (On-Prem)
- Broken access control
- CVSS 7.1 High
MyTube: Visitor Can Access Hidden Video Metadata and Content
- franklioxygen MyTube
- Broken access control
- CVSS 6.5 Medium
HotCRP: comment-author search exposes anonymous commenter identities
- kohler hotcrp
- Broken access control
- CVSS 9.3 CriticalCritical · CVSS 9+
Unauthenticated Stack Buffer Overflow in Sentinel Keys Server
- Thalesgroup Sentinel Keys Server
- Memory corruption
- Broken access control
- CVSS 6.9 Medium
NodeBB 1.18.0 through 4.16.5 Authorization Bypass via /register/complete uid
- NodeBB
- Broken access control
- CVSS 7.5 High
WordPress WP REST Cache plugin <= 2026.3.1 - Broken Access Control vulnerability
- Acato WP REST Cache
- Broken access control
- CVSS 6.5 Medium
WordPress GiveWP plugin <= 4.19.0.1 - Broken Access Control vulnerability
- Nexcess GiveWP
- Broken access control
- CVSS 6.5 Medium
WordPress Masteriyo - LMS plugin <= 3.4.3 - Arbitrary Content Deletion vulnerability
- Masteriyo - LMS
- Broken access control
- CVSS 7.5 High
WordPress HUSKY plugin <= 1.4.6 - Broken Access Control vulnerability
- RealMag777 HUSKY
- Broken access control
- CVSS 5.3 Medium
WordPress YITH WooCommerce Product Add-Ons plugin <= 4.34.0 - Bypass Vulnerability vulnerability
- YITHEMES YITH WooCommerce Product Add-Ons
- Broken access control
- CVSS 6.5 Medium
WordPress Booking and Rental Manager plugin <= 2.8.2 - Broken Access Control vulnerability
- magepeopleteam Booking and Rental Manager
- Broken access control
- CVSS 8.2 High
Hydra: Deposit Claim omits Head state-token spending requirement
- cardano-scaling hydra
- Broken access control
- CVSS 5.3 Medium
WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability
- WP ManageNinja LLC Fluent CRM
- Broken access control
- CVSS 4.3 Medium
WordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.26 - Broken Access Control vulnerability
- Unlimited Elements For Elementor (Free Widgets, Addons, Templates)
- Broken access control
- CVSS 4.3 Medium
WordPress BookIt plugin <= 2.6.0.6 - Broken Access Control vulnerability
- Liquid Web / StellarWP BookIt
- Broken access control
- CVSS 4.3 Medium
WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability
- Arraytics Booktics
- Broken access control
- CVSS 4.3 Medium
WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability
- Liquid Web / StellarWP Event Tickets
- Broken access control
-
Apache Pinot: Incorrect authorization in the single-stage query engine allows reading unauthorized dimension tables via lookup()
- Apache Software Foundation Apache Pinot
- Broken access control
- CVSS 5.3 Medium
WordPress Booktics plugin <= 1.0.31 - Broken Access Control vulnerability
- Arraytics Booktics
- Broken access control
- CVSS 6.9 Medium
37954679 cak-filemanagement-system add_logs.php move_uploaded_file unrestricted upload
- 37954679 cak-filemanagement-system
- Broken access control
- Unrestricted file upload
- CVSS 4.4 Medium
Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
- Microsoft Edge (Chromium-based)
- Broken access control
- CVSS 6.9 Medium
changelog.com before commit 7b35e829 Missing Authorization via Preview Routes
- thechangelog changelog.com
- Broken access control
- CVSS 4.3 Medium
OpenStation: Desktop Windows, Dock & Virtual Desktops for WP Admin <= 1.1.16 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Placement Modification and Entity Metadata Disclosure via…
- wordpressdotorg OpenStation – Admin Dashboard Notes, Custom Dashboard, AI Assistant & PWA
- Broken access control
- CVSS 7.5 High
Forminator Forms <= 1.57.3.1 - Insecure Direct Object Reference to Unauthenticated Arbitrary Draft Deletion and Takeover via 'previous_draft_id' Parameter
- wpmudev Forminator Forms – Contact Form, Payment Form & Custom Form Builder
- Broken access control
- CVSS 7.5 High
Email Templates Customizer and Designer for WordPress and WooCommerce <= 1.5.14 - Missing Authorization to Unauthenticated Order PII Disclosure via 'preview_order' Parameter
- saadiqbal Email Templates Customizer and Designer for WordPress and WooCommerce
- Broken access control
- CVSS 8.7 High
Database Cleaner <= 1.4.7 - Authenticated (Administrator+) Arbitrary Table Deletion
- tigroumeow Database Cleaner: Cleanup, Optimization & Repair
- Broken access control
- CVSS 6.5 Medium
Meow Gallery <= 5.5.4 - Missing Authorization to Authenticated (Author+) Information Disclosure via fetch_posts REST Endpoint
- tigroumeow Meow Gallery
- Broken access control
- CVSS 10.0 CriticalCritical · CVSS 9+
Bazarr: Plex OAuth API namespace is entirely unauthenticated, allowing config tampering, integration takeover and server-side request forgery
- morpheus65535 bazarr
- Cross-site request forgery (CSRF)
- Broken access control
- CVSS 5.0 Medium
SecureDrop: API session token reuse against the Journalist Interface web UI
- freedomofpress securedrop
- Broken access control
- CVSS 5.3 Medium
Frappe LMS allows unpublished certificate access
- frappe lms
- Broken access control
- CVSS 5.3 Medium
Frappe LMS: Quiz result manipulation and cross-user submission forgery
- frappe lms
- Broken access control
- CVSS 6.5 Medium
ZAC: Missing per-zaaktype authorization on by-ID decision and process reads
- infonl dimpact-zaakafhandelcomponent
- Broken access control
- CVSS 8.3 High
Incorrect authorization in OpenStack keystonemiddleware
- OpenStack keystonemiddleware
- Broken access control
- CVSS 4.3 Medium
WordPress Event Tickets plugin <= 5.30.2 - Broken Access Control vulnerability
- Liquid Web / StellarWP Event Tickets
- Broken access control
- CVSS 5.4 Medium
WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability
- Liquid Web / StellarWP The Events Calendar
- Broken access control
- CVSS 8.0 High
Zuke: Command-form registry descriptors bypass the MCP launch policy
- zuke
- Broken access control
- CVSS 5.4 Medium
WordPress Fluent CRM plugin <= 3.2.6 - Broken Access Control vulnerability
- WP ManageNinja LLC Fluent CRM
- Broken access control
- CVSS 7.1 High
PipesHub 0.3.0 before 0.10.0 Connector Deletion via Crawling-Manager Schedule Route
- pipeshub-ai
- Broken access control
- CVSS 7.1 High
abp-next-admin 10.4.0 through 10.7.0 Cross-Tenant File Disclosure via Blob Download-By-Name
- colinin abp-next-admin
- Broken access control
- CVSS 7.1 High
SonicJS through 3.0.0 Missing Authorization in Content Write API
- sonicjs
- Broken access control
- CVSS 6.9 Medium
WPGraphQL before 2.24.1 Missing Authorization via createComment Mutation
- WPGraphQL
- Broken access control
- CVSS 5.4 Medium
WordPress Webba Booking plugin <= 6.5.4 - Broken Access Control vulnerability
- Webba Plugins Webba Booking
- Broken access control
- CVSS 5.3 Medium
WordPress The Events Calendar plugin <= 6.18.2 - Broken Access Control vulnerability
- Liquid Web / StellarWP The Events Calendar
- Broken access control
- CVSS 5.3 Medium
WordPress JetFormBuilder plugin <= 3.6.7.1 - Broken Access Control vulnerability
- Crocoblock JetFormBuilder
- Broken access control
- CVSS 4.3 Medium
Collabora Online: Read-only session authorization bypass permits live document edits
- online
- Broken access control
- CVSS 7.5 High
SOCFortress CoPilot: Authentication Bypass and Missing Authorization on Velociraptor Sigma Exclusion Rules (Detection Suppression)
- socfortress CoPilot
- Authentication bypass
- Broken access control