https://control-plane.io/disclosures/Vulnerability Disclosures on ControlPlaneen-uk© 2026 ControlPlaneMon, 19 Oct 2026 00:00:00https://control-plane.io/disclosures/scottish-gov-open-data-portal/Fri, 16 Oct 2026https://control-plane.io/disclosures/scottish-gov-open-data-portal/ControlPlane’s AI security research team identified a critical vulnerability in a Scottish Government open data portal: a long-lived administrative API token had been compiled into the portal’s public JavaScript, where any visitor could read it and use it to control the service’s administrative API without signing in. Once reported, the finding was escalated to the Scottish Cyber Coordination Centre (SC3) and resolved: the system owner determined the service was no longer required and permanently decommissioned it.https://control-plane.io/disclosures/dfe-get-help-buying-for-schools/Fri, 02 Oct 2026https://control-plane.io/disclosures/dfe-get-help-buying-for-schools/ControlPlane’s AI security research team identified an access-control gap in the Department for Education’s “Get help buying for schools” service, which supports schools through public procurement and supplier frameworks. The service’s multi-step request form did not tie a request to the session that created it, and anyone who held a request’s identifier could change the request’s details (including its contact email) and submit it, without signing in to the service.https://control-plane.io/disclosures/dfe-register-of-training-providers/Fri, 09 Oct 2026https://control-plane.io/disclosures/dfe-register-of-training-providers/ControlPlane’s AI security research team identified a set of authorisation gaps in the Department for Education’s Register of Training Providers, which manages government-funded training providers and apprenticeships across England. The application used a well-regarded authorisation library, but several administrative actions didn’t invoke the authorisation check, allowing a standard, non-administrative staff account to perform actions intended for administrators only. Once reported, the Department for Education confirmed the issues and remediated them. Severity was assessed as High, CVSS 8.