Broken access control.

OpenCSG CSGHub through v2.6.0-ce Unauthenticated Private Repository File Read via Resolve Route

• OpenCSG CSGHub
• Broken access control

Chatify before 1.6.4 Pusher Authorization Bypass via /chat/auth Endpoint

• munafio Chatify
• Broken access control

Product Gallery Slider for WooCommerce 2.3.23 before 2.3.26 Missing Authorization via Codestar AJAX

• Codeixer Product Gallery Slider & Additional Variation Images for WooCommerce
• Broken access control

Apache Syncope: Delegated administration boundaries can be bypassed for Realm update

• Apache Software Foundation Apache Syncope
• Broken access control

Warracker before 1.0.4 Missing Authorization via Paperless-ngx Document Linking

• sassanix Warracker
• Broken access control

Local Privilege Escalation via Polkit Misconfiguration in TÜBİTAK BİLGEM's eta-register

• TÜBİTAK BİLGEM Software Technologies Research Institute eta-register
• Broken access control

Incorrect permission assignment in Dell OpenManage Enterprise

• Dell OpenManage Enterprise
• Broken access control

Incorrect permission assignment in Dell OpenManage Enterprise

• Dell OpenManage Enterprise
• Broken access control

Broken Access Control via System REST APIs in Multiple WSO2 Products Allows Unauthorized Administrative Actions

• WSO2 API Manager
• WSO2 Identity Server as Key Manager
• Broken access control

Incorrect permission assignment in MediaTek, Inc. MediaTek chipset

• MediaTek, Inc. MediaTek chipset
• Broken access control

samanhappy MCPHub passthroughHeaders.ts information disclosure

• samanhappy MCPHub
• Information disclosure
• Broken access control

Sanluan PublicCMS publiccms-trade TradeRefundService.java TradeRefundService.updateAmound authorization

• Sanluan PublicCMS
• Broken access control

Apache Wicket: The configured authorization strategy is not applied to an IResource embedded in a component

• Apache Software Foundation Apache Wicket
• Broken access control

Apache Wicket: A listener is invoked on a page instance the request itself created and never configured

• Apache Software Foundation Apache Wicket
• Broken access control

Apache Wicket: WebSocketBehavior delivers client messages to a component the client may not invoke

• Apache Software Foundation Apache Wicket
• Broken access control

Apache Wicket: A disabled or invisible form submitting component is still invoked on a plain form submission

• Apache Software Foundation Apache Wicket
• Broken access control

Apache Wicket: The configured authorization strategy is not applied to a shared WebSocketResource

• Apache Software Foundation Apache Wicket
• Broken access control

ag-ui-protocol ag-ui HttpAgent http.ts information disclosure

• ag-ui
• Information disclosure
• Broken access control

Oray Pugongying X5 Pro API Authorization run_async_task improper authorization

• Oray Pugongying X5 Pro
• Privilege escalation
• Broken access control

Gitea user and organization feed token scope bypass

• Gitea
• Broken access control

Gitea private pull request disclosure on project boards

• Gitea
• Broken access control

Gitea public-only token bypass on bulk organization repository deletion

• Gitea
• Broken access control

Gitea OAuth2 userinfo private group disclosure to public-only tokens

• Gitea
• Information disclosure
• Broken access control

Gitea public-only package token access to private OCI blobs

• Gitea
• Broken access control

Gitea private issue disclosure through issue dependency timeline events

• Gitea
• Information disclosure
• Broken access control

Gitea admin API public-only token scope bypass

• Gitea
• Broken access control
• CWE-1259

Gitea archived repository release, milestone and label modification

• Gitea
• Broken access control

Gitea public-only token bypass through Actions runner registration

• Gitea
• Broken access control

Gitea Actions task token private repository enumeration

• Gitea
• Information disclosure
• Broken access control

Gitea OAuth2 account auto-linking takeover through the sign-up form

• Gitea
• Authentication bypass
• Broken access control

Gitea Actions fork workflow trust through pull request review commit

• Gitea
• Broken access control

Media Library Assistant < 3.44 - Subscriber+ Missing Authorization via mla-fill-compat-fields

• Media Library Assistant
• Broken access control

Kali Forms < 2.4.30 - Subscriber+ Email Sending and Sender Spoofing

• Kali Forms — Contact Form & Drag-and-Drop Builder
• Broken access control

Presenton Desktop Authentication Middleware app_data information disclosure

• Presenton
• Information disclosure
• Broken access control

Nexterm through 1.2.2-BETA Missing Authorization in Server Session Lifecycle Routes

• gnmyt Nexterm
• Broken access control

LearnHouse before 1.1.1 Missing Authorization via Assignment Submissions API

• learnhouse
• Broken access control

epiphany: clipboard/website-data permission prompt incorrectly grants camera and microphone access

• GNOME Epiphany
• Broken access control

Redux Framework <= 4.5.15 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Disclosure via /wp-admin/profile.php inline redux_<opt_name> JavaScript

• davidanderson Redux Framework
• Broken access control

Perfect Images <= 7.2.0 - Missing Authorization to Authenticated (Author+) Image Replacement

• tigroumeow Perfect Images: Regenerate Thumbnails, Image Sizes, WebP & AVIF
• Broken access control

WP Data Access <= 5.5.88 - Missing Authorization to Unauthenticated Sensitive Information Exposure via 'rel_tab' Parameter

• peterschulznl WP Data Access – App Builder for Tables, Forms, Dashboards, Charts & Maps
• Broken access control

Product Filter for WooCommerce by WBW <= 3.4.6 - Missing Authorization to Unauthenticated Information Disclosure via filterSettings[default_query] Parameter

• woobewoo Product Filter for WooCommerce by WBW
• Broken access control

Hustle <= 7.8.14.3 - Missing Authorization to Authenticated (Custom+) ESP Credential Overwrite and Irreversible OAuth Token Deletion via 'hustle_provider_migrate_hubspot' (and sibling migrate_*) AJAX…

• wpmudev Hustle – Email Marketing, Lead Generation, Optins, Popups
• Broken access control

WP Booking System <= 2.1.0.5 - Missing Authorization to Unauthenticated Arbitrary Calendar Note Deletion via wpbs_calendar_remove_note AJAX Action

• murgroland WP Booking System – Booking Calendar
• Broken access control

Popup Builder <= 4.4.5 - Missing Authorization to Unauthenticated Arbitrary Popup Post Trashing via 'post_type' and 'sg_popup_preview_id' Parameters

• popupbuilder Popup Builder – Create highly converting, mobile friendly marketing popups.
• Broken access control

PAYable IPG < 1.3.1 - Unauthenticated Order Payment Forgery via Unsigned Callback

• Payable Payment Gateway for WooCommerce
• Broken access control

Mapster WP Maps < 2.0.6 - Unauthenticated Arbitrary Post Modification via save-mapmaker REST Route

• Mapster WP Maps
• Broken access control

Premium Packages < 7.2.2 - Unauthenticated Order Total Manipulation

• Premium Packages
• Broken access control

Spectra Gutenberg Blocks <= 2.20.4 - Missing Authorization to Unauthenticated Limited Theme File Deletion and Modification via 'page', 'path', and 'settings' GET Parameters

• brainstormforce Spectra Legacy – Gutenberg Blocks
• Broken access control

File Force Download for Drupal 7 Access Bypass via Unconditional Download Headers

• Drupal File Force Download
• Broken access control

Field Collection for Drupal 7 access bypass via missing parent entity access check

• Field Collection for Drupal 7
• Broken access control

Kubeflow Pipelines: Run-log endpoint permits unauthorized access to pod logs

• Information disclosure
• Broken access control

<0.0.0-20260904182349-be4723e33727 · fixed in 0.0.0-20260904182349-be4723e33727

Authlib RFC 7592 examples omit registration-access-token client binding

• Broken access control
• CWE-1188

>=0.15, <1.9.1 · fixed in 1.9.1

Nuxt: Dot segments in the request path bypass `server/middleware` path checks and server route rules on page routes

• Broken access control
• CWE-41

>=4.6.0, <4.6.3 · fixed in 4.6.3

russh: Agent server never calls `Agent::confirm`, so keys added with the confirm constraint (`ssh-add -c`) sign without confirmation

• Broken access control

<0.65 · fixed in 0.65

OAuthLib: Token grants can use attacker-supplied client_id for authorization after authenticating a different client

• Broken access control

<4.0.0 · fixed in 4.0.0

OpenWISP Controller CA CRL REST API does not scope requests to managed organizations

• Broken access control

>=1.0.0, <1.3.2 · fixed in 1.3.2

Coop has cross-org IDOR in addAccessibleQueuesForUser / removeAccessibleQueuesForUser

• roostorg coop
• Broken access control

IXP Manager has Broken Object-Level Authorization

• inex IXP-Manager
• Broken access control

LubeLogger: IDOR in PrintRecordStickers Allows Unauthenticated Cross-User Vehicle Record Exfiltration

• hargata lubelog
• Broken access control

ActivityPub Undo handler can unfollow or remove reposts on behalf of other accounts

• TryGhost ActivityPub
• Authentication bypass
• Broken access control