Broken access control.

Apache OFBiz: Authorization Bypass Through User-Controlled Key in OrderServices Enables Unauthorized Payment Preference Modification

• Apache Software Foundation Apache OFBiz
• Broken access control

Apache OFBiz: Authorization Bypass Through User-Controlled Key in Order Returns Enables Cross-Party OrderItem Association

• Apache Software Foundation Apache OFBiz
• Broken access control

Apache OFBiz: Missing Authorization in Financial Account Services Enables Unauthorized Balance Manipulation

• Apache Software Foundation Apache OFBiz
• Broken access control

Apache OFBiz: Direct Request in Order Manager Enables Unauthorized Tracking Number Modification

• Apache Software Foundation Apache OFBiz
• Broken access control

Apache OFBiz: Authorization Bypass Through User-Controlled Key in Shopping Lists Enables Cross-Party Shopping List Modification

• Apache Software Foundation Apache OFBiz
• Broken access control

Apache OFBiz: Authorization Bypass Through User-Controlled Key in Content Viewing Enables Unauthorized Content Disclosure

• Apache Software Foundation Apache OFBiz
• Broken access control

agentscope-ai AgentScope Bash Tool _bash.py check_permissions authorization

• AgentScope
• Broken access control

Io.quarkus/quarkus-vertx-http: quarkus-vertx-http: authorization bypass in management interface via path concatenation flaw

• Red Hat Exploit Intelligence
• Red Hat OpenShift Serverless
• Broken access control

Security For WooCommerce 1.0.10 - 1.0.16 - Unauthenticated Privilege Escalation via usfw_create_temporary_user

• Security For WooCommerce
• Broken access control

Missing authorization in Samsung Semiconductor Exynos 1580 and others

• Samsung Semiconductor Exynos 1580
• Samsung Semiconductor Exynos 2500
• Broken access control

Kyverno before 1.19.2 Cross-Namespace Resource Read via generate.clone

• kyverno
• Broken access control

Kyverno 1.17.0 before 1.19.2 Cross-Namespace Write via NamespacedMutatingPolicy mutateExisting

• kyverno
• Broken access control

Kyverno before 1.19.2 Label Spoofing via Generation Handler processRequest

• kyverno
• Broken access control

Kyverno before 1.19.2 Policy Bypass via admissionpolicygenerator PolicyException Handling

• kyverno
• Broken access control

Kyverno 1.17.0 before 1.19.2 Privilege Escalation via CleanupPolicy Context Loader

• kyverno
• Broken access control

Kyverno 1.17.0 before 1.19.2 Cross-Namespace Resource Overwrite via NamespacedMutatingPolicy

• kyverno
• Broken access control

InvoiceShelf MemberService.php create access control

• InvoiceShelf
• Privilege escalation
• Broken access control

purocean Yank Note Settings Endpoint index.ts config.getAll information disclosure

• purocean Yank Note
• Information disclosure
• Broken access control

Presenton User Configuration user-config JSON.parse cross-site request forgery

• Presenton
• Cross-site request forgery (CSRF)
• Broken access control

nliautaud pico-content-editor cross-site request forgery

• nliautaud pico-content-editor
• Cross-site request forgery (CSRF)
• Broken access control

Open edX: Support "manage_course_team" REST API omits the `require_support_permission` gate its sibling support views enforce

• openedx-platform
• Broken access control
• CWE-204

Campcodes Complete Advance Loan Management System banner.php move_uploaded_file unrestricted upload

• Campcodes Complete Advance Loan Management System
• Broken access control
• Unrestricted file upload

Pocket ID: Client credentials grant allows any OIDC client to obtain tokens for arbitrary audiences

• pocket-id
• Broken access control
• CWE-20

GLPI: Unauthorized visibility expansion of knowbase items, reminders and RSS feeds

• glpi
• Broken access control

VitaFit Cloud API Excessive Data Exposure via relation/search Endpoint

• Shenzhen Shine Industrial Co., Ltd. VitaFit
• Broken access control

GLPI: Unallowed notifications sending

• glpi
• Broken access control

NST Labs Tech Nstbrowser Local Agent API info information disclosure

• NST Labs Tech Nstbrowser
• Information disclosure
• Broken access control

VitaFit Cloud API Storage Bucket Unauthenticated Access Information Disclosure

• Shenzhen Shine Industrial Co., Ltd. VitaFit
• Broken access control

VitaFit Cloud API IDOR via profile_id Endpoints

• Shenzhen Shine Industrial Co., Ltd. VitaFit
• Broken access control

Sandboxie-Plus: Sandbox containment bypass

• Sandboxie
• Information disclosure
• Broken access control

Readest: Subscription/entitlement hijack: /api/stripe/check binds any paid Checkout Session to the caller

• readest
• Broken access control

6amTech 6valley Social Login Flow existing-account-check existingAccountCheck authorization

• 6amTech 6valley
• Broken access control

GPUStack: Missing authorization on several cluster and resource endpoints allows cross-user access and cluster takeover

• gpustack
• Broken access control

Yuxi sandbox isolation failure allows cross-tenant access and internal service compromise

• xerrors Yuxi
• Command injection
• Broken access control

Multiple vulnerabilities that affects IBM Db2 Genius Hub

• IBM Db2 Genius Hub
• Broken access control

Telepresence: Traffic Manager gRPC has no auth — any pod claims arbitrary namespace and intercepts services, receiving victim environment secrets

• telepresence
• Authentication bypass
• Broken access control

WebVirtCloud through commit bb920b0 Missing Authorization in REST API Migrate and Create Endpoints

• retspen webvirtcloud
• Broken access control

Telepresence: Tunnel endpoint accepts caller-supplied session ID with no ownership proof — active client sessions hijackable

• telepresence
• Broken access control

Nexus Repository 3 - Group Repository Member Authorization Bypass

• Sonatype Nexus Repository 3
• Broken access control

Nexus Repository 3 - Privilege Escalation via Rut Auth Capability Creation

• Sonatype Nexus Repository 3
• Broken access control

Zulip: Saving a draft DM to a user bypasses can_access_all_users_group permission

• zulip
• Broken access control

Zulip: Custom profile fields can be read by logged-out visitors in organization with web-public channels

• zulip
• Broken access control

Invoice Ninja < 5.13.28 Broken Access Control via Vendor Portal

• invoiceninja
• Broken access control

Incorrect authorization in Yealink T3XW Series Phones and others

• Yealink T3XW Series Phones
• Yealink T4X Series Phones
• Broken access control

Arc: DuckDB I/O aliases bypass database RBAC after CVE-2026-47735

• Information disclosure
• Broken access control

<0.0.0-20260610131716-5dc8f53b70a3 · fixed in 0.0.0-20260610131716-5dc8f53b70a3

@payloadcms/storage-vercel-blob has access control bypass of uploads in Vercel Storage adapter

• Broken access control

>=3.25.0, <3.90.0 || >=4.0.0-canary.0, <4.0.0-canary.34 · fixed in 3.90.0, 4.0.0-canary.34

GetPaid WordPress Plugin < 2.8.63 Authorization Bypass via maybe_use_invoice

• AyeCode Ltd Payment forms, Buy now buttons, and Invoicing System | GetPaid
• Broken access control

GetPaid WordPress Plugin < 2.8.63 Incorrect Authorization via REST API

• AyeCode Ltd Payment forms, Buy now buttons, and Invoicing System | GetPaid
• Broken access control

Cisco Identity Services Engine Authorization Bypass Vulnerability

• Cisco Identity Services Engine Software
• Cisco ISE Passive Identity Connector
• Broken access control

Warpgate: Kubernetes authorization correlation can be reused by a recreated same-name account

• warp-tech warpgate
• Broken access control

Oqtane Framework before 10.3.0 Broken Access Control via SettingController

• oqtane.framework
• Broken access control

Sender WordPress Plugin < 2.11.3 Broken Access Control via admin_post_sender_debug_download

• Sender – Newsletter, SMS and Email Marketing Automation for WooCommerce
• Broken access control

wePOS before 2.0.3 Missing Authorization via payment/process Endpoint

• wedevs wePOS – Point Of Sale (POS) for WooCommerce & Dokan
• Broken access control

CoopCycle coopcycle-web before 6.20.1 IDOR via Incident Resource and Action Endpoint

• coopcycle-web
• Broken access control

Stonewuu ai-fusion-video before 1.3.0 IDOR via Project, Asset and Script Controllers

• Stonewuu ai-fusion-video
• Broken access control

langchain4j-aideepin before 3.31.0 IDOR via GET /character/{uuid}

• moyangzhan langchain4j-aideepin
• Broken access control

loonflow before r3.2.3 IDOR via ticket_flow_history Endpoint

• blackholll loonflow
• Broken access control

CVE-2026-118516: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control

• Broken access control
• CWE-436

>=4.1.0, <4.2.0 || >=4.2.0, <4.3.0 || >=4.3.0, <4.4.0 || >=4.4.0, <5.0.0 || >=5.0.0, <5.1.0 || >=5.1.0, <5.2.0 || >=5.2.0, <5.3.0 || >=5.3.0, <5.4.0 || >=5.4.0, <5.4.56 || >=6.0.0, <6.1.0 || >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11 · fixed in 4.2.0, 4.3.0, 4.4.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.56, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.50, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.23, 8.1.0, 8.1.11

CVE-2026-118516: Host Placeholders Can Match the Start of the Path in Compiled URL Matchers, Bypassing Path-Based Access Control

• Broken access control
• CWE-436

>=4.1.0, <4.2.0 || >=4.2.0, <4.3.0 || >=4.3.0, <4.4.0 || >=4.4.0, <5.0.0 || >=5.0.0, <5.1.0 || >=5.1.0, <5.2.0 || >=5.2.0, <5.3.0 || >=5.3.0, <5.4.0 || >=5.4.0, <5.4.56 || >=6.0.0, <6.1.0 || >=6.1.0, <6.2.0 || >=6.2.0, <6.3.0 || >=6.3.0, <6.4.0 || >=6.4.0, <6.4.50 || >=7.0.0, <7.1.0 || >=7.1.0, <7.2.0 || >=7.2.0, <7.3.0 || >=7.3.0, <7.4.0 || >=7.4.0, <7.4.23 || >=8.0.0, <8.1.0 || >=8.1.0, <8.1.11 · fixed in 4.2.0, 4.3.0, 4.4.0, 5.0.0, 5.1.0, 5.2.0, 5.3.0, 5.4.0, 5.4.56, 6.1.0, 6.2.0, 6.3.0, 6.4.0, 6.4.50, 7.1.0, 7.2.0, 7.3.0, 7.4.0, 7.4.23, 8.1.0, 8.1.11

Apache ZooKeeper: SASL authorization bypass on the client port through a client-supplied authorization ID

• Apache Software Foundation Apache ZooKeeper
• Broken access control