Broken access control.

Frappe HRMS before 15.61.0 Permission Bypass via Expense Claim Advances API

• frappe hrms
• Broken access control

Froxlor before 2.3.15 Authorization Bypass via Mysqls.add API

• froxlor
• Broken access control

Froxlor 2.3.0 before 2.3.15 Authorization Bypass via Certificates.update API

• froxlor
• Broken access control

AzuraCast before 0.24.0 Missing Authorization via Station Waveform Endpoints

• AzuraCast
• Broken access control

SurrealDB 3.1.0 before 3.3.0 Incorrect Authorization via Streaming Index Planner

• surrealdb
• Broken access control

SurrealDB 2.0.0 before 3.3.1 deny-funcs Capability Bypass via Method-Style Invocations

• surrealdb
• Broken access control

Parse Server before 8.6.112 and 9.0.0 before 9.10.6-alpha.4 Session Permission Bypass via upgradeToRevocableSession

• parse-community parse-server
• Broken access control

Instatic before 0.0.21 Authorization Bypass via MCP Content Read Tools

• CoreBunch Instatic
• Broken access control

Inadequate authorization vulnerability in Alosuite’s user invitation functionality

• AM System ALO Suite
• Broken access control

Direct Object Reference (IDOR) vulnerability in Alosuite

• AM System ALO Suite
• Broken access control

Missing server-side authorization in Eclipse Mnestix Browser admin server actions allows unauthenticated configuration tampering

• Eclipse Foundation Eclipse Mnestix
• Broken access control
• CWE-602

TYPO3-EXT-SA-2026-038: Broken Access Control in extension "Frontend User Registration" (sf_register)

• Broken access control

<13.2.5 || >=14.0.0, <14.0.3 · fixed in 13.2.5, 14.0.3

TYPO3-EXT-SA-2026-037: Information Disclosure in extension "Mail" (mail)

• Broken access control

<3.12.5 || >=4.0.0, <4.2.0 · fixed in 3.12.5, 4.2.0

TYPO3-EXT-SA-2026-037: Broken Access Control in extension "Mail" (mail)

• Broken access control

<3.12.5 || >=4.0.0, <4.2.0 · fixed in 3.12.5, 4.2.0

Read-Only Shared Token Allows Modification of Monitoring Alerts in AxxonNet

• AxxonSoft AxxonNet
• Broken access control

User-mode module can post forged callback requests to another module's callback queue, running its code with that module's privilege

• Eclipse Foundation Eclipse ThreadX
• Privilege escalation
• Broken access control

Privilege Escalation via Token Endpoint in WSO2 API Manager (APIM 4.x/IS as Resident Key Manager)

• WSO2 API Manager
• WSO2 API Control Plane
• Broken access control

Authentication Bypass

• Zohocorp Log360
• Zohocorp EventLog Analyzer
• Broken access control

Improper Access Control vulnerability

• Zohocorp Log360
• Zohocorp EventLog Analyzer
• Broken access control

Improper IDP Status Validation via JWT Bearer or SAML2 Bearer Grants in Multiple WSO2 Products Allows Access Token Issuance for Disabled Identity Providers

• WSO2 Universal Gateway
• WSO2 Traffic Manager
• Broken access control

weMail <= 2.1.6 - Editor+ Incorrect Authorization via User::can()

• weMail
• Broken access control

DT LMS <= 1.2 - Unauthenticated Arbitrary Course Completion Revocation

• DT LMS
• Broken access control

DT Directory Lite Addon <= 1.1 - Unauthenticated Plugin Settings Update

• DT Directory Lite Addon
• Broken access control

AZEXO Store Locator <= 1.4 - Subscriber+ Arbitrary Post Deletion via azt_delete_item

• AZEXO Store Locator
• Broken access control

AI Alt Text Generator <= 2.7.0 - Missing Authorization to Unauthenticated Arbitrary Attachment Modification via 'post_id' Parameter

• migkapa AI Alt Text Generator
• Broken access control

JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification

• jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
• Broken access control

WP Compress <= 7.22.01 - Missing Authorization to Unauthenticated Account Linking / Site Takeover via 'force_ic_connect' and 'apikey' Parameters

• aresit WP Compress – Instant Performance & Speed Optimization
• Broken access control

Temporal Server Kubernetes compute provider builds a client from caller-supplied configuration and runs a caller-chosen command on the Worker Service host

• Temporal Technologies, Inc. Temporal Server
• Command injection
• Broken access control

Missing authorization in Google Android XR

• Google Android XR
• Broken access control

EchoHS GeekezBrowser Public API status information disclosure

• EchoHS GeekezBrowser
• Information disclosure
• Broken access control

Incorrect default permissions in Dell Alienware Command Center (AWCC)

• Dell Alienware Command Center (AWCC)
• Broken access control

Missing authorization in Google Android

• Google Android
• Broken access control

Missing authorization in Google Android

• Google Android
• Broken access control

Missing authorization in Google Android

• Google Android
• Broken access control

Missing authorization in Google Android

• Google Android
• Broken access control

Missing authorization in Google Android

• Google Android
• Broken access control

Missing authorization in Google Android

• Google Android
• Broken access control

Missing authorization in Google Android

• Google Android
• Broken access control

Missing authorization in Google Android

• Google Android
• Broken access control

Improper access control in Google Android

• Google Android
• Broken access control

Improper access control in Google Android

• Google Android
• Broken access control

psqlODBC log files are created with default permissions at a predictable path and follow symbolic links

• PostgreSQL psqlODBC
• Path traversal
• Broken access control

Munshi IDOR via Purchase Inquiry Thread Endpoint

• Petpooja Munshi
• Broken access control

Munshi Missing Authorization in Company Deletion API

• Petpooja Munshi
• Broken access control

Munshi Broken Object Level Authorization via Invoice Deletion API

• Petpooja Munshi
• Broken access control

Joomla Extension - dj-extensions.com - IDOR vulnerability allowing cross-account ad access in DJ-Classifieds < 3.11.3

• dj-extensions.com DJ-Classifieds extension for Joomla
• Broken access control

DBHub: MySQL and MariaDB comment interpretation bypasses read-only SQL validation

• Broken access control
• CWE-436

<0.22.6 · fixed in 0.22.6

Krill treats a "local parent" as already-authenticated, letting a CA operator act as any child of any CA on the same server

• NLnet Labs Krill
• Broken access control

Krill users restricted to one CA can make any other CA delegate its prefixes and publish ROAs for them via bulk import

• NLnet Labs Krill
• Broken access control

User-mode module can suspend, terminate, re-prioritise and abort the waits of threads it does not own

• Eclipse Foundation Eclipse ThreadX
• Broken access control

Outline before 1.12.0 Incorrect Authorization via authorizeDocumentPublish() Detached Draft

• Outline
• Broken access control

LaraDashboard before 1.4.5 Incorrect Authorization via SettingPolicy Core Upgrades

• LaraDashboard
• Broken access control

Jpom through 2.11.12 Cross-Workspace Authorization Bypass via /node/ssh_command/batch

• dromara Jpom
• Broken access control

Jpom through 2.11.12 Cross-Workspace Authorization Bypass via Docker Controllers

• dromara Jpom
• Broken access control

LaraDashboard 1.4.0 before 1.4.9 Improper Authorization via MCP send-email Tool

• LaraDashboard
• Broken access control

DoraCMS through 3.1.0 Mass Assignment via API Key Update Endpoint

• doramart DoraCMS
• Broken access control

madong-admin-saas through 5.1.4 Incorrect Authorization via /platformapi AccessTokenMiddleware

• madong-code madong-admin-saas
• Broken access control

Camaleon CMS before 2.9.2 IDOR via Admin::CategoriesController

• owen2345 Camaleon CMS
• Broken access control

Camaleon CMS before 2.9.2 Missing Authorization via Admin::MediaController

• owen2345 Camaleon CMS
• Broken access control

MrDoc through 1.1.1 Missing Authorization via get_doctemp Template Read

• zmister2016 MrDoc
• Broken access control