Thousands of Grok-built apps were public without sign-in
Claroc found 35,578 of 37,571 active grok.me apps open to anyone, and about one in 10 held sensitive data.
Stories per day · 30 days
12 RSS
Relatedai-agents4authorization4oss-security3apache-airflow2apache-answer2cedar2data-exposure2denial-of-service2fedramp2gcc2government-cloud2ics2microsoft2openstack2prompt-injection2splunk2ubuntu2abac1
129 stories, newest first · one card per story
Stories tagged #access-control
Xen publishes XSA-530 on multiple XAPI RBAC issues
Version 2 makes five CVE-tracked XAPI role issues public; versions and fixes are not stated.
Geometric RAG access control isolates policies but not embeddings
A curious user can recover original embeddings from a few hundred pairs and forge policy-compatible queries.
RISC-V MCU design bounds runtime protection-policy delegation
A CVA6-based World Checker adds 7.1% LUT and 1.2% FF for eight rules, with no access-latency or frequency loss.
Text2NGAC extracts all four NGAC relationship types from policy text
Exact-tuple match was 97.3–99.6% on 714 sentences, and one graph loaded unmodified into NIST's implementation.
Airflow async connection test can overwrite later connections
A create-only user can replace a connection created by someone else when commit_on_success runs after the test.
Airflow queued-event delete ignores per-Dag edit checks
Edit rights on one Dag let a user delete queued asset events for every Dag they can read.
Cloudflare Launches Personal Agents Visibility
New analytics and policies give site owners control over personal AI agent access.
Callix Detects Access Control Flaws in Android Firmware
Callix found 819 vulnerable paths in 1,750 pre-installed Android apps.
Apache Pinot before 1.6.0 can read unauthorized tables (CVE-2026-73322)
With broker access control on, lookup() can name a dimension table that the FROM-clause check never authorizes.
Reparo: LLM-aided pipeline for access control policy synthesis and validation
Reparo synthesizes and repairs policies from repository evidence for Cedar, OpenFGA, and Rego, achieving 99.0-100% valid policies.
Drupal Commerce access bypass exploited in the wild (CVE-2026-118539)
Unauthenticated attackers can reach protected routes and fields; sites should update and audit orders.
1
OpenStack keystonemiddleware access_rules bypass via X-Service-Token
OSSA-2026-050 names CVE-2026-115642 and lists several Keystonemiddleware releases, but the posted description is cut off.
n8n before 2.44.1 and 2.43.5 can expose other projects' data tables
Canada's Cyber Centre says a crafted workflow ID can reach data tables in other n8n projects and urges updates.
2009 HP report says ACL checks fail for multi-principal access
HP Labs argued missing cross-message state lets clickjacking and CSRF bypass ACL decisions on many web applications.
WordPress 7.1.4 fixes 22 security flaws, including unauthenticated RCE
Exploitation needs a seconds-long update window and public access to wp-content/upgrade/; older branches are patched back to 4.7.39.
1
Unverified claim: India-based engineer approved for US cloud logs
Screenshots allegedly show escort approval for GCC Moderate logs; citizenship, session use, and content exposure are unconfirmed.
1
Unverified claim: Microsoft cleared India-based engineer for US cloud logs
Screenshots of a resolved GCC-Moderate escort ticket do not show log contents, a named customer, or a completed transfer.
Johnson Controls Kantech Entrapass before 9.20 has two flaws
Canada's Cyber Centre says Johnson Controls confirmed two vulnerabilities and urges administrators to apply updates when available.
Lobster_pro privilege escalation via request replaying
Improper permission checks let attackers call admin-only endpoints; 4.12.12-LTS and builds before 25.1.3 are cited.
LLM agent security depends more on data access than model guardrails
Concentric AI’s chief scientist says access limits, identities, and approval gates bound what agents can leak or do.
Splunk patches 24 flaws, four critical, in Enterprise and SOAR
October 21 fixes cover CVSS 9.9 bugs; Secure Gateway also needs updates for two CVEs.
1
Paper finds learned access-control deny sets often unsound
Unchecked hard-deny clauses would block 16-78% of grants; certified sets withhold nothing, and hybrid ranking is one-class in all 24 cells.
Tornado flaws may cause denial of service or expose data
USN-8952-1 lists six CVEs that could also let an attacker bypass access controls.