Common Weakness Enumeration

CWE-863

Allowed-with-Review

Incorrect Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

5678 vulnerabilities reference this CWE, most recent first.

GHSA-5JHR-VV8X-5WG9

Vulnerability from github – Published: 2022-02-15 00:02 – Updated: 2022-07-13 00:01
VLAI
Details

Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction. Users information such as first name, last name, acount id, server uuid, email address, profile image, number, timestamps, etc can be extracted by sending an unauthenticated HTTP GET request to the https://Switchvox-IP/main?cmd=invalid_browser.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-45310"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-02-14T21:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Sangoma Technologies Corporation Switchvox Version 102409 is affected by an information disclosure vulnerability due to an improper access restriction. Users information such as first name, last name, acount id, server uuid, email address, profile image, number, timestamps, etc can be extracted by sending an unauthenticated HTTP GET request to the https://Switchvox-IP/main?cmd=invalid_browser.",
  "id": "GHSA-5jhr-vv8x-5wg9",
  "modified": "2022-07-13T00:01:50Z",
  "published": "2022-02-15T00:02:45Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-45310"
    },
    {
      "type": "WEB",
      "url": "https://github.com/IthacaLabs/Sangoma/tree/main/Switchvox_Version%20102409"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5JM7-G527-M694

Vulnerability from github – Published: 2022-05-17 00:01 – Updated: 2023-08-25 21:56
VLAI
Summary
Publify exposes article metadata
Details

Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, compromising confidentiality and integrity of users.

Severity
4.9 (Medium)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "publify_core"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "9.2.8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-1553"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-06-01T21:44:51Z",
    "nvd_published_at": "2022-05-16T15:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Leaking password protected articles content due to improper access control in GitHub repository publify/publify prior to 9.2.8. Attackers can leverage this vulnerability to view the contents of any password-protected article present on the publify website, compromising confidentiality and integrity of users.",
  "id": "GHSA-5jm7-g527-m694",
  "modified": "2023-08-25T21:56:45Z",
  "published": "2022-05-17T00:01:41Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-1553"
    },
    {
      "type": "WEB",
      "url": "https://github.com/publify/publify/commit/1a78f16f460847274265a12a9555b3524892d7db"
    },
    {
      "type": "WEB",
      "url": "https://github.com/publify/publify"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/publify_core/CVE-2022-1553.yml"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/b398e4c9-6cdf-4973-ad86-da796cde221f"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Publify exposes article metadata"
}

GHSA-5JMJ-H3C5-682W

Vulnerability from github – Published: 2025-03-20 12:32 – Updated: 2025-03-20 12:32
VLAI
Details

A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint "/api/system/custom-models". This access enables them to modify the model's API key and base path, leading to potential API key leakage and denial of service on chats.

Severity
8.3 (High)
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-10109"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-20T10:15:14Z",
    "severity": "HIGH"
  },
  "details": "A vulnerability in the mintplex-labs/anything-llm repository, as of commit 5c40419, allows low privilege users to access the sensitive API endpoint \"/api/system/custom-models\". This access enables them to modify the model\u0027s API key and base path, leading to potential API key leakage and denial of service on chats.",
  "id": "GHSA-5jmj-h3c5-682w",
  "modified": "2025-03-20T12:32:38Z",
  "published": "2025-03-20T12:32:38Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-10109"
    },
    {
      "type": "WEB",
      "url": "https://github.com/mintplex-labs/anything-llm/commit/8d302c3f670c582b09d47e96132c248101447a11"
    },
    {
      "type": "WEB",
      "url": "https://huntr.com/bounties/ad3c9e76-679d-4775-b203-96947ff73551"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-5JP2-VWRJ-99RF

Vulnerability from github – Published: 2022-10-19 20:26 – Updated: 2025-04-16 16:08
VLAI
Summary
Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution
Details

Impact

For some Post/Put Concourse endpoint containing :team_name in the URL, a Concourse user can send a request with body including :team_name=team2 to bypass team scope check to gain access to certain resources belong to any other team. The user only needs a valid user session and belongs to team2.

Exploitable endpoints:

{Path: "/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/builds/:build_name", Method: "POST", Name: RerunJobBuild},
{Path: "/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/pause", Method: "PUT", Name: PauseJob},
{Path: "/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/unpause", Method: "PUT", Name: UnpauseJob},
{Path: "/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/schedule", Method: "PUT", Name: ScheduleJob},

{Path: "/api/v1/teams/:team_name/pipelines/:pipeline_name/pause", Method: "PUT", Name: PausePipeline},
{Path: "/api/v1/teams/:team_name/pipelines/:pipeline_name/unpause", Method: "PUT", Name: UnpausePipeline},
{Path: "/api/v1/teams/:team_name/pipelines/:pipeline_name/expose", Method: "PUT", Name: ExposePipeline},
{Path: "/api/v1/teams/:team_name/pipelines/:pipeline_name/hide", Method: "PUT", Name: HidePipeline},
{Path: "/api/v1/teams/:team_name/pipelines/:pipeline_name/rename", Method: "PUT", Name: RenamePipeline},
{Path: "/api/v1/teams/:team_name/pipelines/:pipeline_name/archive", Method: "PUT", Name: ArchivePipeline},

{Path: "/api/v1/teams/:team_name/pipelines/:pipeline_name/resources/:resource_name/versions/:resource_config_version_id/enable", Method: "PUT", Name: EnableResourceVersion},
{Path: "/api/v1/teams/:team_name/pipelines/:pipeline_name/resources/:resource_name/versions/:resource_config_version_id/disable", Method: "PUT", Name: DisableResourceVersion},
{Path: "/api/v1/teams/:team_name/pipelines/:pipeline_name/resources/:resource_name/versions/:resource_config_version_id/pin", Method: "PUT", Name: PinResourceVersion},
{Path: "/api/v1/teams/:team_name/pipelines/:pipeline_name/resources/:resource_name/unpin", Method: "PUT", Name: UnpinResource},

{Path: "/api/v1/teams/:team_name/artifacts", Method: "POST", Name: CreateArtifact},

Steps to reproduce

  1. Set up a Concourse deployment with team 1 (with pipeline 1) and team 2. User is in team 2 but not team 1.
  2. Login as user to team 2.
fly -t ci login -n team2 -u user -p password
  1. Try pausing pipeline 1 in team 1 using fly. Verify the command output is pipeline 'pipeline1' not found.
fly -t ci pause-pipeline -p pipeline1
  1. Send a customized request through fly curl command intend to pause pipeline 1 again. 
fly -t ci curl /api/v1/teams/team1/pipelines/pipeline1/pause -- -X PUT -d ":team_name=team2" -H "Content-type: application/x-www-form-urlencoded"
  1. pipeline 1 in team 1 will be paused.

In step 4, the parameter pollution would allow an user from any team to pause a pipeline that belongs to other team.

Patches

Concourse v6.7.9 and v7.8.3 were both released with a fix on October 12, 2022.

Instead of using FormValue to parse team_name in the request, where allows body parameters to take precedence over URL query string values, both patch versions are now using URL.Query().Get() over multiple scope handlers to prevent the parameter pollution.

Workarounds

No known workarounds for existing versions.

References

  • https://github.com/concourse/concourse/pull/8566: PR with the fix

For more information

If you have any questions or comments about this advisory, you may reach us privately at security@concourse-ci.org.

Severity
5.4 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/concourse/concourse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.7.9"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/concourse/concourse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "7.0.0"
            },
            {
              "fixed": "7.8.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-31683"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-10-19T20:26:05Z",
    "nvd_published_at": "2022-12-19T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\nFor some Post/Put Concourse endpoint containing `:team_name` in the URL, a Concourse user can send a request with body including `:team_name=team2` to bypass team scope check to gain access to certain resources belong to any other team. The user only needs a valid user session and belongs to team2.\n\nExploitable endpoints:\n```\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/builds/:build_name\", Method: \"POST\", Name: RerunJobBuild},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/pause\", Method: \"PUT\", Name: PauseJob},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/unpause\", Method: \"PUT\", Name: UnpauseJob},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/jobs/:job_name/schedule\", Method: \"PUT\", Name: ScheduleJob},\n\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/pause\", Method: \"PUT\", Name: PausePipeline},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/unpause\", Method: \"PUT\", Name: UnpausePipeline},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/expose\", Method: \"PUT\", Name: ExposePipeline},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/hide\", Method: \"PUT\", Name: HidePipeline},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/rename\", Method: \"PUT\", Name: RenamePipeline},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/archive\", Method: \"PUT\", Name: ArchivePipeline},\n\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/resources/:resource_name/versions/:resource_config_version_id/enable\", Method: \"PUT\", Name: EnableResourceVersion},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/resources/:resource_name/versions/:resource_config_version_id/disable\", Method: \"PUT\", Name: DisableResourceVersion},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/resources/:resource_name/versions/:resource_config_version_id/pin\", Method: \"PUT\", Name: PinResourceVersion},\n{Path: \"/api/v1/teams/:team_name/pipelines/:pipeline_name/resources/:resource_name/unpin\", Method: \"PUT\", Name: UnpinResource},\n\t\n{Path: \"/api/v1/teams/:team_name/artifacts\", Method: \"POST\", Name: CreateArtifact},\n```\n\n### Steps to reproduce\n\n1. Set up a Concourse deployment with team 1 (with pipeline 1) and team 2. User is in team 2 but not team 1.\n2. Login as user to team 2.\n```\nfly -t ci login -n team2 -u user -p password\n```\n3. Try pausing pipeline 1 in team 1 using fly. Verify the command output is `pipeline \u0027pipeline1\u0027 not found`.\n```\nfly -t ci pause-pipeline -p pipeline1\n```\n\n\n4. Send a customized request through `fly curl` command intend to pause pipeline 1 again. \n```\nfly -t ci curl /api/v1/teams/team1/pipelines/pipeline1/pause -- -X PUT -d \":team_name=team2\" -H \"Content-type: application/x-www-form-urlencoded\"\n```\n5. pipeline 1 in team 1 will be paused.\n\nIn step 4, the parameter pollution would allow an user from any team to pause a pipeline that belongs to other team.\n\n### Patches\nConcourse [v6.7.9](https://github.com/concourse/concourse/releases/tag/v6.7.9) and [v7.8.3](https://github.com/concourse/concourse/releases/tag/v7.8.3) were both released with a fix on October 12, 2022.\n\nInstead of using [`FormValue`](https://pkg.go.dev/net/http#Request.FormValue) to parse team_name in the request, where allows body parameters to take precedence over URL query string values, both patch versions are now using `URL.Query().Get()` over multiple scope handlers to prevent the parameter pollution.\n\n### Workarounds\nNo known workarounds for existing versions.\n\n### References\n * https://github.com/concourse/concourse/pull/8566: PR with the fix\n\n### For more information\nIf you have any questions or comments about this advisory, you may reach us privately at [security@concourse-ci.org](mailto:security@concourse-ci.org).",
  "id": "GHSA-5jp2-vwrj-99rf",
  "modified": "2025-04-16T16:08:47Z",
  "published": "2022-10-19T20:26:05Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/concourse/concourse/security/advisories/GHSA-5jp2-vwrj-99rf"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31683"
    },
    {
      "type": "WEB",
      "url": "https://github.com/concourse/concourse/pull/8566"
    },
    {
      "type": "WEB",
      "url": "https://github.com/concourse/concourse/pull/8580"
    },
    {
      "type": "WEB",
      "url": "https://github.com/concourse/concourse/commit/57e06711b0d861775a5a6bd078a34abeb0e2638e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/concourse/concourse/commit/ba885834d9bcbb9d1ccb9964faa7af0e78a72205"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/concourse/concourse"
    },
    {
      "type": "WEB",
      "url": "https://github.com/concourse/concourse/releases/tag/v6.7.9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/concourse/concourse/releases/tag/v7.8.3"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Team scope authorization bypass when Post/Put request with :team_name in body, allows HTTP parameter pollution "
}

GHSA-5JQ8-Q6RJ-9GQ4

Vulnerability from github – Published: 2024-07-11 17:32 – Updated: 2024-07-11 18:33
VLAI
Summary
Red-DiscordBot vulnerable to Incorrect Authorization in commands API
Details

Impact

Due to a bug in Red's Core API, 3rd-party cogs using the @commands.can_manage_channel() command permission check without additional permission controls may authorize a user to run a command even when that user doesn't have permissions to manage a channel. None of the core commands or core cogs are affected. The maintainers of the project are not aware of any public 3rd-party cog utilizing this API at the time of writing this advisory.

The @commands.mod_or_can_manage_channel(), @commands.admin_or_can_manage_channel(), and @commands.guildowner_or_can_manage_channel() command permission checks are unaffected.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/AU:Y/R:U/RE:L

Patches

The problem was patched in PR #6398 and later released in version 3.5.10.

Workarounds

Any cog using the @commands.can_manage_channel() command permission check should be unloaded until an upgrade to a patched version can be performed.

References

https://github.com/Cog-Creators/Red-DiscordBot/pull/6398 https://github.com/Cog-Creators/Red-DiscordBot/releases/tag/3.5.10 https://pypi.org/project/Red-DiscordBot/3.5.10/

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
6.9 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "Red-DiscordBot"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "3.5.0"
            },
            {
              "fixed": "3.5.10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-39905"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-11T17:32:42Z",
    "nvd_published_at": "2024-07-11T16:15:05Z",
    "severity": "MODERATE"
  },
  "details": "### Impact\n\nDue to a bug in Red\u0027s Core API, 3rd-party cogs using the [`@commands.can_manage_channel()`](https://docs.discord.red/en/stable/framework_checks.html#redbot.core.commands.can_manage_channel) command permission check without additional permission controls may authorize a user to run a command even when that user doesn\u0027t have permissions to manage a channel.\nNone of the core commands or core cogs are affected. The maintainers of the project are not aware of any _public_ 3rd-party cog utilizing this API at the time of writing this advisory.\n\nThe [`@commands.mod_or_can_manage_channel()`](https://docs.discord.red/en/stable/framework_checks.html#redbot.core.commands.mod_or_can_manage_channel), [`@commands.admin_or_can_manage_channel()`](https://docs.discord.red/en/stable/framework_checks.html#redbot.core.commands.admin_or_can_manage_channel), and [`@commands.guildowner_or_can_manage_channel()`](https://docs.discord.red/en/stable/framework_checks.html#redbot.core.commands.guildowner_or_can_manage_channel) command permission checks are unaffected.\n\nCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N\nCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N/AU:Y/R:U/RE:L\n\n### Patches\n\nThe problem was patched in PR #6398 and later released in version [3.5.10](https://pypi.org/project/Red-DiscordBot/3.5.10/).\n\n### Workarounds\n\nAny cog using the [`@commands.can_manage_channel()`](https://docs.discord.red/en/stable/framework_checks.html#redbot.core.commands.can_manage_channel) command permission check should be unloaded until an upgrade to a patched version can be performed.\n\n### References\n\nhttps://github.com/Cog-Creators/Red-DiscordBot/pull/6398\nhttps://github.com/Cog-Creators/Red-DiscordBot/releases/tag/3.5.10\nhttps://pypi.org/project/Red-DiscordBot/3.5.10/\n\n",
  "id": "GHSA-5jq8-q6rj-9gq4",
  "modified": "2024-07-11T18:33:32Z",
  "published": "2024-07-11T17:32:42Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Cog-Creators/Red-DiscordBot/security/advisories/GHSA-5jq8-q6rj-9gq4"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-39905"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Cog-Creators/Red-DiscordBot/pull/6398"
    },
    {
      "type": "WEB",
      "url": "https://github.com/Cog-Creators/Red-DiscordBot/commit/0b0b23b9717b40ed4f8715720b199417c8e89750"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Cog-Creators/Red-DiscordBot"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Red-DiscordBot vulnerable to Incorrect Authorization in commands API"
}

GHSA-5JV7-2MJM-H6QJ

Vulnerability from github – Published: 2026-06-18 14:26 – Updated: 2026-07-20 21:28
VLAI
Summary
npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining
Details

Summary

The published npm package praisonai ships dist/tools/utility-tools.js, which exports a shell(command) helper described in source as:

Execute shell command (safe version - read-only commands)

The helper attempts to enforce a safe read-only command allowlist by checking only the first whitespace-delimited token:

const safeCommands = ['ls', 'cat', 'head', 'tail', 'wc', 'grep', 'find', 'echo', 'date', 'pwd', 'which'];
const firstWord = command.split(/\s+/)[0];

if (!safeCommands.includes(firstWord)) {
    return { success: false, error: `Command not allowed: ${firstWord}` };
}

It then passes the entire original string to Node child_process.exec():

const { stdout, stderr } = await execAsync(command, { timeout: 5000 });

Because exec() runs the command through a shell, a command string that starts with an allowed command can append a second non-allowlisted command with shell metacharacters. For example, direct printf <marker> is rejected, but echo ok; printf <marker> is accepted and executes printf.

This bypasses the helper's safe-command policy and allows arbitrary shell commands to run with the PraisonAI process privileges when an application, agent, or integration exposes this helper to lower-trust users, prompts, model output, or plugin/tool input.

The PoV is deterministic and local-only. It installs only the npm package, runs harmless marker commands, and does not contact any live service after installation.

Technical Details

utility-tools.shell() authorizes one token but executes the full shell string.

Source-head implementation:

export async function shell(command: string): Promise<ToolResult<string>> {
    // Only allow safe read-only commands
    const safeCommands = ['ls', 'cat', 'head', 'tail', 'wc', 'grep', 'find', 'echo', 'date', 'pwd', 'which'];
    const firstWord = command.split(/\s+/)[0];

    if (!safeCommands.includes(firstWord)) {
        return { success: false, error: `Command not allowed: ${firstWord}` };
    }

    try {
        const { exec } = await import('child_process');
        const { promisify } = await import('util');
        const execAsync = promisify(exec);

        const { stdout, stderr } = await execAsync(command, { timeout: 5000 });
        return { success: true, data: stdout || stderr };
    } catch (error: any) {
        return { success: false, error: error.message ?? String(error) };
    }
}

The published npm:praisonai@1.7.1 dist file preserves the same behavior:

  • exports.shell = shell
  • const firstWord = command.split(/\s+/)[0]
  • if (!safeCommands.includes(firstWord)) ...
  • const { stdout, stderr } = await execAsync(command, { timeout: 5000 })

This creates a policy/parser differential: PraisonAI checks only the first token, while the shell parses the full string as a script.

Why This Is Not Intended Behavior

The helper is explicitly documented in code as a "safe version" for read-only commands and contains an allowlist of specific safe commands. The control test proves that non-allowlisted commands are intended to be blocked: direct printf <marker> returns Command not allowed: printf.

The same helper accepting echo ok; printf <marker> is therefore a bypass of the intended safe-command boundary, not merely a permissive command runner.

This is also consistent with Node's own guidance for shell execution: child_process.exec() runs through a shell, and shell metacharacters can change which commands execute. The fix should make PraisonAI's authorization boundary match what is actually executed.

PoV

Run from a local reproduction checkout:

node poc/pov_poc.js 1.7.1

Observed output summary from evidence/pov-npm-1.7.1.json:

{
  "package": "npm:praisonai",
  "version": "1.7.1",
  "installedPackageVersion": "1.7.1",
  "commands": {
    "directDisallowedCommand": "printf poc.7.1",
    "benignAllowedCommand": "echo poc",
    "chainedBypassCommand": "echo poc; printf poc.7.1"
  },
  "controls": {
    "directDisallowedRejected": true,
    "benignAllowedAccepted": true,
    "patchedControlRejectsChainedShell": true
  },
  "observed": {
    "directDisallowed": {
      "success": false,
      "error": "Command not allowed: printf"
    },
    "chainedBypass": {
      "success": true,
      "data": "poc\npoc.7.1"
    }
  },
  "vulnerable": true
}

Interpretation:

  • Direct printf <marker> is rejected because printf is not in safeCommands.
  • Benign echo ... is accepted.
  • echo ...; printf <marker> is accepted because the first token is echo.
  • The shell then executes the non-allowlisted printf command.
  • A patched-control validator that rejects shell metacharacters before execution blocks the chained command while still allowing benign echo.

The PoV uses only harmless marker output. It does not read system files, leak environment variables, call external services, or run destructive commands.

PoC

The PoV section above contains the local reproduction command, input, and decisive output.

Impact

If lower-trust users, prompts, model output, plugins, or tool input can influence a command string passed to utility-tools.shell(), the safe-command allowlist does not restrict execution to the intended read-only commands. An attacker can append arbitrary shell commands after an allowed first token and run them with the PraisonAI process privileges.

Concrete consequences depend on the embedding application and process privileges, but can include:

  • reading files and secrets available to the process;
  • modifying files or project state;
  • invoking local tools and package managers;
  • network exfiltration if the host permits egress; and
  • denial of service by running expensive commands.

This report does not claim that npm PraisonAI exposes this helper as a default unauthenticated network service. It is a library-level safe-command wrapper bypass in a shipped npm subpath.

Severity

Suggested severity: High.

Rationale:

  • AV: common PraisonAI use is a network-facing application, agent API, or tool integration that accepts user or prompt-controlled tasks.
  • AC: a single command string beginning with an allowed command is sufficient.
  • PR: conservative scoring assumes the attacker can submit prompts or work items to the application using this helper.
  • UI: no further operator interaction is required once the command reaches the helper.
  • S: impact is within the PraisonAI-hosting process and its host context.
  • C/I/A: arbitrary shell commands can affect confidentiality, integrity, and availability depending on process privileges.

If maintainers score only direct local library use, AV:L may be reasonable. If a deployment exposes this helper through unauthenticated agent/tool endpoints, PR:N may be reasonable.

Suggested Fix

Avoid passing policy-checked strings to a shell.

Recommended:

  1. Replace exec(command) with execFile() or spawn(command, args, { shell: false }).
  2. Require callers to pass { command, args } instead of a shell string, or parse the shell string into argv with a shell-aware parser before policy checks.
  3. Apply the allowlist to the exact executable that will be invoked.
  4. Reject shell metacharacters (;, &&, ||, |, backticks, $(), redirects, newlines) if a string API must remain available.
  5. Add regression tests proving that echo ok is allowed while printf marker, echo ok; printf marker, echo ok && printf marker, and echo ok | printf marker are rejected.

If this helper is not intended to be public, also consider adding a package exports map that exposes only supported public API paths.

Affected Package/Versions

  • Repository: MervinPraison/PraisonAI
  • Ecosystem: npm
  • Package: praisonai
  • Component: TypeScript utility tools helper src/praisonai-ts/src/tools/utility-tools.ts
  • Published dist path: node_modules/praisonai/dist/tools/utility-tools.js
  • Latest npm package validated: 1.7.1
  • Current origin/main validated: 1ad58ca02975ff1398efeda694ea2ab78f20cf3e
  • src/praisonai-ts/package.json at origin/main: praisonai 1.7.1

Suggested affected range:

npm:praisonai >= 1.5.1, <= 1.7.1

All published npm 1.x versions were swept locally:

  • 1.0.0 through 1.5.0: dist/tools/utility-tools.js was not present in the tested package.
  • 1.5.1, 1.5.2, 1.5.3, 1.5.4, 1.6.0, 1.7.0, and 1.7.1: vulnerable.

The npm package has no exports map and ships dist in its files list, so the affected helper is importable as a package subpath:

const { shell } = require("praisonai/dist/tools/utility-tools.js");

The root package entry point does not appear to re-export this helper directly. This report is scoped to the shipped npm subpath and the TypeScript source that generates it.

Advisory History

Visible PraisonAI advisories and prior submissions were checked. The closest known issues are adjacent but distinct:

  • GHSA-vjv9-7m7j-h833 covers npm TypeScript SandboxExecutor.allowedCommands in src/cli/features/sandbox-executor.ts, where a caller-supplied allowlist is checked before spawn("sh", ["-c", command]).
  • This report covers npm TypeScript utility-tools.shell() in src/tools/utility-tools.ts, where a built-in "safe read-only commands" allowlist is checked before child_process.exec(command).
  • Fixing only SandboxExecutor leaves this helper unchanged.
  • The public Python/PyPI command-injection advisories cover different packages, files, and execution paths, such as Python execute_command, run_python(), memory hooks, and subprocess sandbox code.

This is a sibling-callsite variant of the same mature allowlist/shell-parser class, but it is not the same function, policy surface, affected version range, or shipped import path as the prior npm SandboxExecutor advisory.

Severity
8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 1.7.1"
      },
      "package": {
        "ecosystem": "npm",
        "name": "praisonai"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.5.1"
            },
            {
              "fixed": "1.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-57133"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-693",
      "CWE-78",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-06-18T14:26:54Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "## Summary\n\nThe published npm package `praisonai` ships `dist/tools/utility-tools.js`, which exports a `shell(command)` helper described in source as:\n\n```text\nExecute shell command (safe version - read-only commands)\n```\n\nThe helper attempts to enforce a safe read-only command allowlist by checking only the first whitespace-delimited token:\n\n```ts\nconst safeCommands = [\u0027ls\u0027, \u0027cat\u0027, \u0027head\u0027, \u0027tail\u0027, \u0027wc\u0027, \u0027grep\u0027, \u0027find\u0027, \u0027echo\u0027, \u0027date\u0027, \u0027pwd\u0027, \u0027which\u0027];\nconst firstWord = command.split(/\\s+/)[0];\n\nif (!safeCommands.includes(firstWord)) {\n    return { success: false, error: `Command not allowed: ${firstWord}` };\n}\n```\n\nIt then passes the entire original string to Node `child_process.exec()`:\n\n```ts\nconst { stdout, stderr } = await execAsync(command, { timeout: 5000 });\n```\n\nBecause `exec()` runs the command through a shell, a command string that starts with an allowed command can append a second non-allowlisted command with shell metacharacters. For example, direct `printf \u003cmarker\u003e` is rejected, but `echo ok; printf \u003cmarker\u003e` is accepted and executes `printf`.\n\nThis bypasses the helper\u0027s safe-command policy and allows arbitrary shell commands to run with the PraisonAI process privileges when an application, agent, or integration exposes this helper to lower-trust users, prompts, model output, or plugin/tool input.\n\nThe PoV is deterministic and local-only. It installs only the npm package, runs harmless marker commands, and does not contact any live service after installation.\n\n## Technical Details\n\n`utility-tools.shell()` authorizes one token but executes the full shell string.\n\nSource-head implementation:\n\n```ts\nexport async function shell(command: string): Promise\u003cToolResult\u003cstring\u003e\u003e {\n    // Only allow safe read-only commands\n    const safeCommands = [\u0027ls\u0027, \u0027cat\u0027, \u0027head\u0027, \u0027tail\u0027, \u0027wc\u0027, \u0027grep\u0027, \u0027find\u0027, \u0027echo\u0027, \u0027date\u0027, \u0027pwd\u0027, \u0027which\u0027];\n    const firstWord = command.split(/\\s+/)[0];\n\n    if (!safeCommands.includes(firstWord)) {\n        return { success: false, error: `Command not allowed: ${firstWord}` };\n    }\n\n    try {\n        const { exec } = await import(\u0027child_process\u0027);\n        const { promisify } = await import(\u0027util\u0027);\n        const execAsync = promisify(exec);\n\n        const { stdout, stderr } = await execAsync(command, { timeout: 5000 });\n        return { success: true, data: stdout || stderr };\n    } catch (error: any) {\n        return { success: false, error: error.message ?? String(error) };\n    }\n}\n```\n\nThe published `npm:praisonai@1.7.1` dist file preserves the same behavior:\n\n- `exports.shell = shell`\n- `const firstWord = command.split(/\\s+/)[0]`\n- `if (!safeCommands.includes(firstWord)) ...`\n- `const { stdout, stderr } = await execAsync(command, { timeout: 5000 })`\n\nThis creates a policy/parser differential: PraisonAI checks only the first token, while the shell parses the full string as a script.\n\n### Why This Is Not Intended Behavior\n\nThe helper is explicitly documented in code as a \"safe version\" for read-only commands and contains an allowlist of specific safe commands. The control test proves that non-allowlisted commands are intended to be blocked: direct `printf \u003cmarker\u003e` returns `Command not allowed: printf`.\n\nThe same helper accepting `echo ok; printf \u003cmarker\u003e` is therefore a bypass of the intended safe-command boundary, not merely a permissive command runner.\n\nThis is also consistent with Node\u0027s own guidance for shell execution: `child_process.exec()` runs through a shell, and shell metacharacters can change which commands execute. The fix should make PraisonAI\u0027s authorization boundary match what is actually executed.\n\n## PoV\n\nRun from a local reproduction checkout:\n\n```bash\nnode poc/pov_poc.js 1.7.1\n```\n\nObserved output summary from `evidence/pov-npm-1.7.1.json`:\n\n```json\n{\n  \"package\": \"npm:praisonai\",\n  \"version\": \"1.7.1\",\n  \"installedPackageVersion\": \"1.7.1\",\n  \"commands\": {\n    \"directDisallowedCommand\": \"printf poc.7.1\",\n    \"benignAllowedCommand\": \"echo poc\",\n    \"chainedBypassCommand\": \"echo poc; printf poc.7.1\"\n  },\n  \"controls\": {\n    \"directDisallowedRejected\": true,\n    \"benignAllowedAccepted\": true,\n    \"patchedControlRejectsChainedShell\": true\n  },\n  \"observed\": {\n    \"directDisallowed\": {\n      \"success\": false,\n      \"error\": \"Command not allowed: printf\"\n    },\n    \"chainedBypass\": {\n      \"success\": true,\n      \"data\": \"poc\\npoc.7.1\"\n    }\n  },\n  \"vulnerable\": true\n}\n```\n\nInterpretation:\n\n- Direct `printf \u003cmarker\u003e` is rejected because `printf` is not in `safeCommands`.\n- Benign `echo ...` is accepted.\n- `echo ...; printf \u003cmarker\u003e` is accepted because the first token is `echo`.\n- The shell then executes the non-allowlisted `printf` command.\n- A patched-control validator that rejects shell metacharacters before execution blocks the chained command while still allowing benign `echo`.\n\nThe PoV uses only harmless marker output. It does not read system files, leak environment variables, call external services, or run destructive commands.\n\n## PoC\n\nThe PoV section above contains the local reproduction command, input, and decisive output.\n\n## Impact\n\nIf lower-trust users, prompts, model output, plugins, or tool input can influence a command string passed to `utility-tools.shell()`, the safe-command allowlist does not restrict execution to the intended read-only commands. An attacker can append arbitrary shell commands after an allowed first token and run them with the PraisonAI process privileges.\n\nConcrete consequences depend on the embedding application and process privileges, but can include:\n\n- reading files and secrets available to the process;\n- modifying files or project state;\n- invoking local tools and package managers;\n- network exfiltration if the host permits egress; and\n- denial of service by running expensive commands.\n\nThis report does not claim that npm PraisonAI exposes this helper as a default unauthenticated network service. It is a library-level safe-command wrapper bypass in a shipped npm subpath.\n\n### Severity\n\nSuggested severity: High.\n\nRationale:\n\n- `AV`: common PraisonAI use is a network-facing application, agent API, or tool integration that accepts user or prompt-controlled tasks.\n- `AC`: a single command string beginning with an allowed command is sufficient.\n- `PR`: conservative scoring assumes the attacker can submit prompts or work items to the application using this helper.\n- `UI`: no further operator interaction is required once the command reaches the helper.\n- `S`: impact is within the PraisonAI-hosting process and its host context.\n- `C/I/A`: arbitrary shell commands can affect confidentiality, integrity, and availability depending on process privileges.\n\nIf maintainers score only direct local library use, `AV:L` may be reasonable. If a deployment exposes this helper through unauthenticated agent/tool endpoints, `PR:N` may be reasonable.\n\n## Suggested Fix\n\nAvoid passing policy-checked strings to a shell.\n\nRecommended:\n\n1. Replace `exec(command)` with `execFile()` or `spawn(command, args, { shell: false })`.\n2. Require callers to pass `{ command, args }` instead of a shell string, or parse the shell string into argv with a shell-aware parser before policy checks.\n3. Apply the allowlist to the exact executable that will be invoked.\n4. Reject shell metacharacters (`;`, `\u0026\u0026`, `||`, `|`, backticks, `$()`, redirects, newlines) if a string API must remain available.\n5. Add regression tests proving that `echo ok` is allowed while `printf marker`, `echo ok; printf marker`, `echo ok \u0026\u0026 printf marker`, and `echo ok | printf marker` are rejected.\n\nIf this helper is not intended to be public, also consider adding a package `exports` map that exposes only supported public API paths.\n\n## Affected Package/Versions\n\n- Repository: `MervinPraison/PraisonAI`\n- Ecosystem: `npm`\n- Package: `praisonai`\n- Component: TypeScript utility tools helper `src/praisonai-ts/src/tools/utility-tools.ts`\n- Published dist path: `node_modules/praisonai/dist/tools/utility-tools.js`\n- Latest npm package validated: `1.7.1`\n- Current `origin/main` validated: `1ad58ca02975ff1398efeda694ea2ab78f20cf3e`\n- `src/praisonai-ts/package.json` at `origin/main`: `praisonai` `1.7.1`\n\nSuggested affected range:\n\n```text\nnpm:praisonai \u003e= 1.5.1, \u003c= 1.7.1\n```\n\nAll published npm `1.x` versions were swept locally:\n\n- `1.0.0` through `1.5.0`: `dist/tools/utility-tools.js` was not present in the tested package.\n- `1.5.1`, `1.5.2`, `1.5.3`, `1.5.4`, `1.6.0`, `1.7.0`, and `1.7.1`: vulnerable.\n\nThe npm package has no `exports` map and ships `dist` in its `files` list, so the affected helper is importable as a package subpath:\n\n```js\nconst { shell } = require(\"praisonai/dist/tools/utility-tools.js\");\n```\n\nThe root package entry point does not appear to re-export this helper directly. This report is scoped to the shipped npm subpath and the TypeScript source that generates it.\n\n## Advisory History\n\nVisible PraisonAI advisories and prior submissions were checked. The closest known issues are adjacent but distinct:\n\n- `GHSA-vjv9-7m7j-h833` covers npm TypeScript `SandboxExecutor.allowedCommands` in `src/cli/features/sandbox-executor.ts`, where a caller-supplied allowlist is checked before `spawn(\"sh\", [\"-c\", command])`.\n- This report covers npm TypeScript `utility-tools.shell()` in `src/tools/utility-tools.ts`, where a built-in \"safe read-only commands\" allowlist is checked before `child_process.exec(command)`.\n- Fixing only `SandboxExecutor` leaves this helper unchanged.\n- The public Python/PyPI command-injection advisories cover different packages, files, and execution paths, such as Python `execute_command`, `run_python()`, memory hooks, and subprocess sandbox code.\n\nThis is a sibling-callsite variant of the same mature allowlist/shell-parser class, but it is not the same function, policy surface, affected version range, or shipped import path as the prior npm `SandboxExecutor` advisory.",
  "id": "GHSA-5jv7-2mjm-h6qj",
  "modified": "2026-07-20T21:28:11Z",
  "published": "2026-06-18T14:26:54Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-5jv7-2mjm-h6qj"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/MervinPraison/PraisonAI"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "npm PraisonAI utility shell safe-command wrapper allowlist bypass via shell chaining"
}

GHSA-5JVJ-HXMH-6H6J

Vulnerability from github – Published: 2026-03-29 15:46 – Updated: 2026-04-10 17:26
VLAI
Summary
OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope
Details

Summary

Gateway HTTP Session History Route Bypasses Operator Read Scope

Affected Packages / Versions

  • Package: openclaw
  • Affected versions: <= 2026.3.24
  • First patched version: 2026.3.25
  • Latest published npm version at verification time: 2026.3.24

Details

The HTTP /sessions/:sessionKey/history route previously authenticated bearer tokens but skipped the same operator.read check used by chat.history over WebSocket. Commit 1c45123231516fa50f8cf8522ba5ff2fb2ca7aea makes HTTP callers declare operator scopes and rejects history reads that do not include operator.read.

Verified vulnerable on tag v2026.3.24 and fixed on main by commit 1c45123231516fa50f8cf8522ba5ff2fb2ca7aea.

Fix Commit(s)

  • 1c45123231516fa50f8cf8522ba5ff2fb2ca7aea
Severity
5.3 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2026.3.24"
      },
      "package": {
        "ecosystem": "npm",
        "name": "openclaw"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2026.3.25"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-35657"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-29T15:46:40Z",
    "nvd_published_at": null,
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nGateway HTTP Session History Route Bypasses Operator Read Scope\n\n## Affected Packages / Versions\n\n- Package: `openclaw`\n- Affected versions: `\u003c= 2026.3.24`\n- First patched version: `2026.3.25`\n- Latest published npm version at verification time: `2026.3.24`\n\n## Details\n\nThe HTTP `/sessions/:sessionKey/history` route previously authenticated bearer tokens but skipped the same `operator.read` check used by `chat.history` over WebSocket. Commit `1c45123231516fa50f8cf8522ba5ff2fb2ca7aea` makes HTTP callers declare operator scopes and rejects history reads that do not include `operator.read`.\n\nVerified vulnerable on tag `v2026.3.24` and fixed on `main` by commit `1c45123231516fa50f8cf8522ba5ff2fb2ca7aea`.\n\n## Fix Commit(s)\n\n- `1c45123231516fa50f8cf8522ba5ff2fb2ca7aea`",
  "id": "GHSA-5jvj-hxmh-6h6j",
  "modified": "2026-04-10T17:26:09Z",
  "published": "2026-03-29T15:46:40Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-5jvj-hxmh-6h6j"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openclaw/openclaw/commit/1c45123231516fa50f8cf8522ba5ff2fb2ca7aea"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openclaw/openclaw"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "OpenClaw: Gateway HTTP Session History Route Bypasses Operator Read Scope"
}

GHSA-5JVP-M9H4-253H

Vulnerability from github – Published: 2026-02-26 19:40 – Updated: 2026-02-26 19:40
VLAI
Summary
Fleet: Authorization Bypass in certificate template batch deletion for team administrators
Details

Summary

A broken authorization check in Fleet’s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance.

Impact

Fleet supports certificate templates that are scoped to individual teams. In affected versions, the batch deletion endpoint validated authorization using a user-supplied team identifier but did not verify that the certificate template IDs being deleted actually belonged to that team.

As a result, a team administrator could delete certificate templates associated with other teams, potentially disrupting certificate-based workflows such as device enrollment, Wi-Fi authentication, VPN access, or other certificate-dependent configurations for the affected teams.

This issue does not allow privilege escalation, access to sensitive data, or compromise of Fleet’s control plane. Impact is limited to integrity and availability of certificate templates across teams.

Patches

  • v4.80.1

Workarounds

If an immediate upgrade is not possible, administrators should restrict access to certificate template management to trusted users and avoid delegating team administrator permissions where not strictly required.

For more information

If there are any questions or comments about this advisory:

Email Fleet at security@fleetdm.com
Join #fleet in osquery Slack

Credits

Fleet thanks @secfox-ai for responsibly reporting this issue.

Severity
5.0 (Medium)
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/fleetdm/fleet/v4"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.80.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-25963"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-02-26T19:40:10Z",
    "nvd_published_at": "2026-02-26T03:16:04Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\n\nA broken authorization check in Fleet\u2019s certificate template deletion API could allow a team administrator to delete certificate templates belonging to other teams within the same Fleet instance.\n\n### Impact\n\nFleet supports certificate templates that are scoped to individual teams. In affected versions, the batch deletion endpoint validated authorization using a user-supplied team identifier but did not verify that the certificate template IDs being deleted actually belonged to that team.\n\nAs a result, a team administrator could delete certificate templates associated with other teams, potentially disrupting certificate-based workflows such as device enrollment, Wi-Fi authentication, VPN access, or other certificate-dependent configurations for the affected teams.\n\nThis issue does not allow privilege escalation, access to sensitive data, or compromise of Fleet\u2019s control plane. Impact is limited to integrity and availability of certificate templates across teams.\n\n### Patches\n\n- v4.80.1\n\n### Workarounds\n\nIf an immediate upgrade is not possible, administrators should restrict access to certificate template management to trusted users and avoid delegating team administrator permissions where not strictly required.\n\n### For more information\n\nIf there are any questions or comments about this advisory:\n\nEmail Fleet at [security@fleetdm.com](mailto:security@fleetdm.com)  \nJoin #fleet in [osquery Slack](https://join.slack.com/t/osquery/shared_invite/zt-h29zm0gk-s2DBtGUTW4CFel0f0IjTEw)\n\n### Credits\n\nFleet thanks @secfox-ai for responsibly reporting this issue.",
  "id": "GHSA-5jvp-m9h4-253h",
  "modified": "2026-02-26T19:40:10Z",
  "published": "2026-02-26T19:40:10Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/fleetdm/fleet/security/advisories/GHSA-5jvp-m9h4-253h"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-25963"
    },
    {
      "type": "WEB",
      "url": "https://github.com/fleetdm/fleet/commit/d27d0362db390fe835e3b5328525f25018df0fb7"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/fleetdm/fleet"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N/E:U",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Fleet: Authorization Bypass in certificate template batch deletion for team administrators"
}

GHSA-5M8H-WGCR-7X2W

Vulnerability from github – Published: 2022-05-13 01:09 – Updated: 2025-04-12 12:43
VLAI
Details

mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2014-8109"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2014-12-29T23:59:00Z",
    "severity": "MODERATE"
  },
  "details": "mod_lua.c in the mod_lua module in the Apache HTTP Server 2.3.x and 2.4.x through 2.4.10 does not support an httpd configuration in which the same Lua authorization provider is used with different arguments within different contexts, which allows remote attackers to bypass intended access restrictions in opportunistic circumstances by leveraging multiple Require directives, as demonstrated by a configuration that specifies authorization for one group to access a certain directory, and authorization for a second group to access a second directory.",
  "id": "GHSA-5m8h-wgcr-7x2w",
  "modified": "2025-04-12T12:43:30Z",
  "published": "2022-05-13T01:09:46Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-8109"
    },
    {
      "type": "WEB",
      "url": "https://github.com/apache/httpd/commit/3f1693d558d0758f829c8b53993f1749ddf6ffcb"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/kb/HT205031"
    },
    {
      "type": "WEB",
      "url": "https://support.apple.com/HT205219"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rf6449464fd8b7437704c55f88361b66f12d5b5f90bcce66af4be4ba9%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/re3d27b6250aa8548b8845d314bb8a350b3df326cacbbfdfe4d455234%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rd18c3c43602e66f9cdcf09f1de233804975b9572b0456cc582390b6f%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rcc44594d4d6579b90deccd4536b5d31f099ef563df39b094be286b9e%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rc998b18880df98bafaade071346690c2bc1444adaa1a1ea464b93f0a%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/rb14daf9cc4e28d18cdc15d6a6ca74e565672fabf7ad89541071d008b%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/ra7f6aeb28661fbf826969526585f16856abc4615877875f9d3b35ef4%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r9f93cf6dde308d42a9c807784e8102600d0397f5f834890708bf6920%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r83109088737656fa6307bd99ab40f8ff0269ae58d3f7272d7048494a%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/r76142b8c5119df2178be7c2dba88fde552eedeec37ea993dfce68d1d%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/84a3714f0878781f6ed84473d1a503d2cc382277e100450209231830%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba@%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://lists.apache.org/thread.html/56c2e7cc9deb1c12a843d0dc251ea7fd3e7e80293cde02fcd65286ba%40%3Ccvs.httpd.apache.org%3E"
    },
    {
      "type": "WEB",
      "url": "https://issues.apache.org/bugzilla/show_bug.cgi?id=57204"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1174077"
    },
    {
      "type": "WEB",
      "url": "http://advisories.mageia.org/MGASA-2015-0011.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2015/Aug/msg00001.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html"
    },
    {
      "type": "WEB",
      "url": "http://lists.fedoraproject.org/pipermail/package-announce/2015-June/159352.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2014/11/28/5"
    },
    {
      "type": "WEB",
      "url": "http://www.oracle.com/technetwork/topics/security/cpujan2016-2367955.html"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/73040"
    },
    {
      "type": "WEB",
      "url": "http://www.ubuntu.com/usn/USN-2523-1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-5MCP-H82R-F9V7

Vulnerability from github – Published: 2023-04-27 03:30 – Updated: 2024-04-04 03:42
VLAI
Details

An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the version check in order to install any firmware version (e.g., newer, older, or customized). This indirectly allows an attacker to install custom firmware in the IVI system.

Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-26245"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-269",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-04-27T01:15:08Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in the Hyundai Gen5W_L in-vehicle infotainment system AE_E_PE_EUR.S5W_L001.001.211214. The AppUpgrade binary file, which is used during the firmware installation process, can be modified by an attacker to bypass the version check in order to install any firmware version (e.g., newer, older, or customized). This indirectly allows an attacker to install custom firmware in the IVI system.",
  "id": "GHSA-5mcp-h82r-f9v7",
  "modified": "2024-04-04T03:42:32Z",
  "published": "2023-04-27T03:30:23Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-26245"
    },
    {
      "type": "WEB",
      "url": "https://sowhat.iit.cnr.it"
    },
    {
      "type": "WEB",
      "url": "https://sowhat.iit.cnr.it:8443/can-work/chimaera"
    },
    {
      "type": "WEB",
      "url": "https://sowhat.iit.cnr.it:8443/can-work/chimaera/-/blob/main/Report/IIT-01-2023.pdf"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list