Common Weakness Enumeration

CWE-863

Allowed-with-Review

Incorrect Authorization

Abstraction: Class · Status: Incomplete

API response cwe.mitre.org

The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

5659 vulnerabilities reference this CWE, most recent first.

GHSA-8CHW-QPP9-9385

Vulnerability from github – Published: 2024-12-05 18:31 – Updated: 2024-12-05 18:31
VLAI
Details

Mattermost versions 9.7.x <= 9.7.5, 9.8.x <= 9.8.2 and 9.9.x <= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated.

Severity
4.6 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2024-12247"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-05T16:15:25Z",
    "severity": "MODERATE"
  },
  "details": "Mattermost versions 9.7.x \u003c= 9.7.5, 9.8.x \u003c= 9.8.2 and 9.9.x \u003c= 9.9.2 fail to properly propagate permission scheme updates across cluster nodes which allows a user to keep old permissions, even if the permission scheme has been updated.",
  "id": "GHSA-8chw-qpp9-9385",
  "modified": "2024-12-05T18:31:03Z",
  "published": "2024-12-05T18:31:03Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12247"
    },
    {
      "type": "WEB",
      "url": "https://mattermost.com/security-updates"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8CMM-J6C4-RR8V

Vulnerability from github – Published: 2026-03-25 21:17 – Updated: 2026-03-25 21:17
VLAI
Summary
Vikunja has Cross-Project Information Disclosure via Task Relations — Missing Authorization Check on Related Task Read
Details

Summary

When the Vikunja API returns tasks, it populates the related_tasks field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks' projects. An authenticated user who can read a task that has cross-project relations will receive full details (title, description, due dates, priority, percent completion, project ID, etc.) of tasks in projects they have no access to.

Details

The vulnerability is in addRelatedTasksToTasks() at pkg/models/tasks.go:496-548. This function is called by addMoreInfoToTasks() (line 773) during every task read operation — both project task listings (GET /api/v1/projects/{id}/views/{id}/tasks) and single task reads (GET /api/v1/tasks/{id}).

The function fetches all related tasks directly from the database without any permission filtering:

// pkg/models/tasks.go:496-548
func addRelatedTasksToTasks(s *xorm.Session, taskIDs []int64, taskMap map[int64]*Task, a web.Auth) (err error) {
    relatedTasks := []*TaskRelation{}
    err = s.In("task_id", taskIDs).Find(&relatedTasks)
    // ...
    fullRelatedTasks := make(map[int64]*Task)
    err = s.In("id", relatedTaskIDs).Find(&fullRelatedTasks)  // Line 514: NO permission check
    // ...
    for _, rt := range relatedTasks {
        // Directly adds to response without checking if user can read the related task
        taskMap[rt.TaskID].RelatedTasks[rt.RelationKind] = append(
            taskMap[rt.TaskID].RelatedTasks[rt.RelationKind], otherTask)
    }
}

The a web.Auth parameter is received but only used for determining favorites (line 519), never for access control on the related tasks themselves.

In contrast, addBucketsToTasks() (line 550+) in the same file correctly filters enrichment data by calling getAllRawProjects(s, a, ...) to scope results to projects the requesting user can access.

While task relation creation properly enforces authorization (task_relation_permissions.go:32-52 checks write access on the base task and read access on the other task), the relation display path does not re-check permissions for the current reader. This means a privileged user can create a relation that then leaks data to all other users who can read the base task.

PoC

Setup: Two users (User A, User B), two projects (Project-Shared, Project-Private). - User A has access to both projects. - User B has access only to Project-Shared. - Task 1 exists in Project-Shared, Task 2 exists in Project-Private.

Step 1: User A creates a relation between the two tasks

# As User A (who has access to both projects)
curl -X PUT "http://localhost:3456/api/v1/tasks/TASK1_ID/relations" \
  -H "Authorization: Bearer USER_A_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{"other_task_id": TASK2_ID, "relation_kind": "related"}'

Expected: 201 Created (User A has write on Task 1, read on Task 2).

Step 2: User B reads tasks from the shared project

# As User B (who has NO access to Project-Private)
curl "http://localhost:3456/api/v1/projects/PROJECT_SHARED_ID/views/VIEW_ID/tasks" \
  -H "Authorization: Bearer USER_B_TOKEN"

Expected: Task 1 should be returned, but related_tasks should NOT include Task 2.

Actual result: The response includes Task 1 with the related_tasks field containing the full Task 2 object, including its title, description, due_date, priority, percent_done, project_id, and other metadata — despite User B having no access to Project-Private.

Impact

  • Information disclosure: Any authenticated user can read the full metadata of tasks in projects they do not have access to, as long as a relation exists from a task they can read.
  • Leaked fields include: title, description, due dates, start dates, priority, percent completion, project ID, hex color, task index, done status, repeat configuration, cover image attachment ID, and creation/update timestamps.
  • Project structure disclosure: The project_id field reveals the existence and IDs of private projects.
  • No user interaction required: Once a privileged user creates a cross-project relation (which is intentionally allowed), the data leak is automatic for all readers of the base task.
  • Blast radius: Affects all Vikunja instances with cross-project task relations. In multi-tenant or team environments where projects have different access scopes, this undermines project-level access control.

Recommended Fix

Filter related tasks by the requesting user's read permissions before adding them to the response. In addRelatedTasksToTasks(), after fetching full task objects, check that the user can read each related task's project:

func addRelatedTasksToTasks(s *xorm.Session, taskIDs []int64, taskMap map[int64]*Task, a web.Auth) (err error) {
    relatedTasks := []*TaskRelation{}
    err = s.In("task_id", taskIDs).Find(&relatedTasks)
    if err != nil {
        return
    }

    var relatedTaskIDs []int64
    for _, rt := range relatedTasks {
        relatedTaskIDs = append(relatedTaskIDs, rt.OtherTaskID)
    }

    if len(relatedTaskIDs) == 0 {
        return
    }

    fullRelatedTasks := make(map[int64]*Task)
    err = s.In("id", relatedTaskIDs).Find(&fullRelatedTasks)
    if err != nil {
        return
    }

    // Filter related tasks by user's read permission
    allowedProjectIDs := make(map[int64]bool)
    checkedProjectIDs := make(map[int64]bool)
    for _, t := range fullRelatedTasks {
        if checkedProjectIDs[t.ProjectID] {
            continue
        }
        checkedProjectIDs[t.ProjectID] = true
        p := &Project{ID: t.ProjectID}
        canRead, _, err := p.CanRead(s, a)
        if err != nil {
            log.Errorf("Could not check project read permission: %v", err)
            continue
        }
        if canRead {
            allowedProjectIDs[t.ProjectID] = true
        }
    }

    taskFavorites, err := getFavorites(s, relatedTaskIDs, a, FavoriteKindTask)
    if err != nil {
        return err
    }

    for _, rt := range relatedTasks {
        task, has := fullRelatedTasks[rt.OtherTaskID]
        if !has {
            continue
        }
        // Skip related tasks the user cannot access
        if !allowedProjectIDs[task.ProjectID] {
            continue
        }
        fullRelatedTasks[rt.OtherTaskID].IsFavorite = taskFavorites[rt.OtherTaskID]
        otherTask := &Task{}
        err = copier.Copy(otherTask, fullRelatedTasks[rt.OtherTaskID])
        if err != nil {
            log.Errorf("Could not duplicate task object: %v", err)
            continue
        }
        otherTask.RelatedTasks = nil
        taskMap[rt.TaskID].RelatedTasks[rt.RelationKind] = append(
            taskMap[rt.TaskID].RelatedTasks[rt.RelationKind], otherTask)
    }

    return
}

This checks project-level read permission once per unique project ID (cached in allowedProjectIDs) and skips related tasks from projects the user cannot access.

Severity
6.5 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 2.2.0"
      },
      "package": {
        "ecosystem": "Go",
        "name": "code.vikunja.io/api"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "2.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-33676"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-25T21:17:12Z",
    "nvd_published_at": "2026-03-24T16:16:34Z",
    "severity": "MODERATE"
  },
  "details": "## Summary\n\nWhen the Vikunja API returns tasks, it populates the `related_tasks` field with full task objects for all related tasks without checking whether the requesting user has read permission on those tasks\u0027 projects. An authenticated user who can read a task that has cross-project relations will receive full details (title, description, due dates, priority, percent completion, project ID, etc.) of tasks in projects they have no access to.\n\n## Details\n\nThe vulnerability is in `addRelatedTasksToTasks()` at `pkg/models/tasks.go:496-548`. This function is called by `addMoreInfoToTasks()` (line 773) during every task read operation \u2014 both project task listings (`GET /api/v1/projects/{id}/views/{id}/tasks`) and single task reads (`GET /api/v1/tasks/{id}`).\n\nThe function fetches all related tasks directly from the database without any permission filtering:\n\n```go\n// pkg/models/tasks.go:496-548\nfunc addRelatedTasksToTasks(s *xorm.Session, taskIDs []int64, taskMap map[int64]*Task, a web.Auth) (err error) {\n    relatedTasks := []*TaskRelation{}\n    err = s.In(\"task_id\", taskIDs).Find(\u0026relatedTasks)\n    // ...\n    fullRelatedTasks := make(map[int64]*Task)\n    err = s.In(\"id\", relatedTaskIDs).Find(\u0026fullRelatedTasks)  // Line 514: NO permission check\n    // ...\n    for _, rt := range relatedTasks {\n        // Directly adds to response without checking if user can read the related task\n        taskMap[rt.TaskID].RelatedTasks[rt.RelationKind] = append(\n            taskMap[rt.TaskID].RelatedTasks[rt.RelationKind], otherTask)\n    }\n}\n```\n\nThe `a web.Auth` parameter is received but only used for determining favorites (line 519), never for access control on the related tasks themselves.\n\nIn contrast, `addBucketsToTasks()` (line 550+) in the same file correctly filters enrichment data by calling `getAllRawProjects(s, a, ...)` to scope results to projects the requesting user can access.\n\nWhile task relation **creation** properly enforces authorization (`task_relation_permissions.go:32-52` checks write access on the base task and read access on the other task), the relation **display** path does not re-check permissions for the current reader. This means a privileged user can create a relation that then leaks data to all other users who can read the base task.\n\n## PoC\n\n**Setup:** Two users (User A, User B), two projects (Project-Shared, Project-Private).\n- User A has access to both projects.\n- User B has access only to Project-Shared.\n- Task 1 exists in Project-Shared, Task 2 exists in Project-Private.\n\n**Step 1: User A creates a relation between the two tasks**\n\n```bash\n# As User A (who has access to both projects)\ncurl -X PUT \"http://localhost:3456/api/v1/tasks/TASK1_ID/relations\" \\\n  -H \"Authorization: Bearer USER_A_TOKEN\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"other_task_id\": TASK2_ID, \"relation_kind\": \"related\"}\u0027\n```\n\nExpected: 201 Created (User A has write on Task 1, read on Task 2).\n\n**Step 2: User B reads tasks from the shared project**\n\n```bash\n# As User B (who has NO access to Project-Private)\ncurl \"http://localhost:3456/api/v1/projects/PROJECT_SHARED_ID/views/VIEW_ID/tasks\" \\\n  -H \"Authorization: Bearer USER_B_TOKEN\"\n```\n\nExpected: Task 1 should be returned, but related_tasks should NOT include Task 2.\n\n**Actual result:** The response includes Task 1 with the `related_tasks` field containing the full Task 2 object, including its `title`, `description`, `due_date`, `priority`, `percent_done`, `project_id`, and other metadata \u2014 despite User B having no access to Project-Private.\n\n## Impact\n\n- **Information disclosure**: Any authenticated user can read the full metadata of tasks in projects they do not have access to, as long as a relation exists from a task they can read.\n- **Leaked fields include**: title, description, due dates, start dates, priority, percent completion, project ID, hex color, task index, done status, repeat configuration, cover image attachment ID, and creation/update timestamps.\n- **Project structure disclosure**: The `project_id` field reveals the existence and IDs of private projects.\n- **No user interaction required**: Once a privileged user creates a cross-project relation (which is intentionally allowed), the data leak is automatic for all readers of the base task.\n- **Blast radius**: Affects all Vikunja instances with cross-project task relations. In multi-tenant or team environments where projects have different access scopes, this undermines project-level access control.\n\n## Recommended Fix\n\nFilter related tasks by the requesting user\u0027s read permissions before adding them to the response. In `addRelatedTasksToTasks()`, after fetching full task objects, check that the user can read each related task\u0027s project:\n\n```go\nfunc addRelatedTasksToTasks(s *xorm.Session, taskIDs []int64, taskMap map[int64]*Task, a web.Auth) (err error) {\n    relatedTasks := []*TaskRelation{}\n    err = s.In(\"task_id\", taskIDs).Find(\u0026relatedTasks)\n    if err != nil {\n        return\n    }\n\n    var relatedTaskIDs []int64\n    for _, rt := range relatedTasks {\n        relatedTaskIDs = append(relatedTaskIDs, rt.OtherTaskID)\n    }\n\n    if len(relatedTaskIDs) == 0 {\n        return\n    }\n\n    fullRelatedTasks := make(map[int64]*Task)\n    err = s.In(\"id\", relatedTaskIDs).Find(\u0026fullRelatedTasks)\n    if err != nil {\n        return\n    }\n\n    // Filter related tasks by user\u0027s read permission\n    allowedProjectIDs := make(map[int64]bool)\n    checkedProjectIDs := make(map[int64]bool)\n    for _, t := range fullRelatedTasks {\n        if checkedProjectIDs[t.ProjectID] {\n            continue\n        }\n        checkedProjectIDs[t.ProjectID] = true\n        p := \u0026Project{ID: t.ProjectID}\n        canRead, _, err := p.CanRead(s, a)\n        if err != nil {\n            log.Errorf(\"Could not check project read permission: %v\", err)\n            continue\n        }\n        if canRead {\n            allowedProjectIDs[t.ProjectID] = true\n        }\n    }\n\n    taskFavorites, err := getFavorites(s, relatedTaskIDs, a, FavoriteKindTask)\n    if err != nil {\n        return err\n    }\n\n    for _, rt := range relatedTasks {\n        task, has := fullRelatedTasks[rt.OtherTaskID]\n        if !has {\n            continue\n        }\n        // Skip related tasks the user cannot access\n        if !allowedProjectIDs[task.ProjectID] {\n            continue\n        }\n        fullRelatedTasks[rt.OtherTaskID].IsFavorite = taskFavorites[rt.OtherTaskID]\n        otherTask := \u0026Task{}\n        err = copier.Copy(otherTask, fullRelatedTasks[rt.OtherTaskID])\n        if err != nil {\n            log.Errorf(\"Could not duplicate task object: %v\", err)\n            continue\n        }\n        otherTask.RelatedTasks = nil\n        taskMap[rt.TaskID].RelatedTasks[rt.RelationKind] = append(\n            taskMap[rt.TaskID].RelatedTasks[rt.RelationKind], otherTask)\n    }\n\n    return\n}\n```\n\nThis checks project-level read permission once per unique project ID (cached in `allowedProjectIDs`) and skips related tasks from projects the user cannot access.",
  "id": "GHSA-8cmm-j6c4-rr8v",
  "modified": "2026-03-25T21:17:12Z",
  "published": "2026-03-25T21:17:12Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/go-vikunja/vikunja/security/advisories/GHSA-8cmm-j6c4-rr8v"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33676"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-vikunja/vikunja/pull/2449"
    },
    {
      "type": "WEB",
      "url": "https://github.com/go-vikunja/vikunja/commit/833f2aec006ac0f6643c41872e45dd79220b9174"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/go-vikunja/vikunja"
    },
    {
      "type": "WEB",
      "url": "https://vikunja.io/changelog/vikunja-v2.2.2-was-released"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Vikunja has Cross-Project Information Disclosure via Task Relations \u2014 Missing Authorization Check on Related Task Read"
}

GHSA-8CPH-M685-6V6R

Vulnerability from github – Published: 2024-04-16 22:57 – Updated: 2024-04-17 17:05
VLAI
Summary
OpenFGA Authorization Bypass
Details

Overview

Some end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs.

Am I Affected?

You are very likely affected if your model involves exclusion (e.g. a but not b) or intersection (e.g. a and b) and you have any cyclical relationships. If you are using these, please update as soon as possible.

Fix

Update to v1.5.3

Backward Compatibility

This update is backward compatible.

Severity
8.1 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/openfga/openfga"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.5.0"
            },
            {
              "fixed": "1.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-31452"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-285",
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-04-16T22:57:58Z",
    "nvd_published_at": "2024-04-16T22:15:35Z",
    "severity": "HIGH"
  },
  "details": "# Overview\nSome end users of OpenFGA v1.5.0 or later are vulnerable to authorization bypass when calling Check or ListObjects APIs.\n\n# Am I Affected?\nYou are very likely affected if your model involves exclusion (e.g. `a but not b`) or intersection (e.g. `a and b`) and you have any cyclical relationships. If you are using these, please update as soon as possible.\n\n# Fix\nUpdate to v1.5.3\n\n# Backward Compatibility\nThis update is backward compatible.",
  "id": "GHSA-8cph-m685-6v6r",
  "modified": "2024-04-17T17:05:28Z",
  "published": "2024-04-16T22:57:58Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/openfga/openfga/security/advisories/GHSA-8cph-m685-6v6r"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-31452"
    },
    {
      "type": "WEB",
      "url": "https://github.com/openfga/openfga/commit/b6a6d99b2bdbf8c3781503989576076289f48ed2"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openfga/openfga"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenFGA Authorization Bypass"
}

GHSA-8CQV-PJ7F-PWPC

Vulnerability from github – Published: 2025-06-16 17:16 – Updated: 2025-06-18 14:15
VLAI
Summary
Teleport allows remote authentication bypass
Details

Impact

A full technical disclosure and open-source patch will be published after the embargo period, ending on June 30th, to allow all users to upgrade.

Teleport security engineers identified a critical security vulnerability that could allow remote authentication bypass of Teleport.

Teleport Cloud Infrastructure and CI/CD build, test, and release infrastructure aren’t affected.

For the full mitigation, upgrade both Proxy and Teleport agents. It is strongly recommend updating clients to the released patch versions as a precaution.

Have questions?

Patches

Fixed in versions: 17.5.2, 16.5.12, 15.5.3, 14.4.1, 13.4.27, 12.4.35.

These patches are available only on the official Teleport distribution channels.

These versions are designated as Critical Security Exception Versions.

For these specific patch versions of Teleport Community Edition, the Community Edition restrictions are removed on employee count or revenue thresholds, as long as you apply the patch within thirty (30) days of its official release.

Please read the full text of the updated Teleport Community Edition license for details.

Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gravitational/teleport"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "17.0.0"
            },
            {
              "fixed": "17.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gravitational/teleport"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "16.0.0"
            },
            {
              "fixed": "16.5.12"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gravitational/teleport"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "15.0.0"
            },
            {
              "fixed": "15.5.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gravitational/teleport"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "14.0.0"
            },
            {
              "fixed": "14.4.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gravitational/teleport"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "13.0.0"
            },
            {
              "fixed": "13.4.27"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gravitational/teleport"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0.0.11"
            },
            {
              "fixed": "12.4.35"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Go",
        "name": "github.com/gravitational/teleport"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "0.0.0-20250616162021-79b2f26125a1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-49825"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-16T17:16:31Z",
    "nvd_published_at": "2025-06-17T22:15:49Z",
    "severity": "CRITICAL"
  },
  "details": "### Impact\n\nA full technical disclosure and open-source patch will be published after the embargo period, ending on June 30th, to allow all users to upgrade.\n\nTeleport security engineers identified a critical security vulnerability that could allow remote authentication bypass of Teleport.  \n\nTeleport Cloud Infrastructure and CI/CD build, test, and release infrastructure aren\u2019t affected. \n\nFor the full mitigation, upgrade both Proxy and Teleport agents. It is strongly recommend updating clients to the released patch versions as a precaution.\n\n\nHave questions? \n\n- OSS Community: [opensource@goteleport.com](mailto:opensource@goteleport.com) \n- Legal: [legal@goteleport.com](mailto:legal@goteleport.com)\n- Security: [security@goteleport.com](mailto:security@goteleport.com)\n- Customer Support: [goteleport.com/support](https://goteleport.com/support)\n- Media Inquiries: [teleport@babelpr.com](mailto:teleport@babelpr.com)\n\n### Patches\n\nFixed in versions: 17.5.2, 16.5.12, 15.5.3, 14.4.1, 13.4.27, 12.4.35.\n\nThese patches are available only on the [official Teleport distribution channels](https://goteleport.com/docs/installation/). \n\nThese versions are designated as _Critical Security Exception Versions_. \n\n_For these specific patch versions of Teleport Community Edition, the Community Edition restrictions are removed on employee count or revenue thresholds, as long as you apply the patch within thirty (30) days of its official release._\n\n_Please read the full text of the updated Teleport Community Edition license for details._",
  "id": "GHSA-8cqv-pj7f-pwpc",
  "modified": "2025-06-18T14:15:07Z",
  "published": "2025-06-16T17:16:31Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/gravitational/teleport/security/advisories/GHSA-8cqv-pj7f-pwpc"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-49825"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/gravitational/teleport"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Teleport allows remote authentication bypass"
}

GHSA-8CXM-WRJW-F6QW

Vulnerability from github – Published: 2023-12-06 09:30 – Updated: 2025-05-28 18:33
VLAI
Details

Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.

Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-49246"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-12-06T09:15:08Z",
    "severity": "HIGH"
  },
  "details": "Unauthorized access vulnerability in the card management module. Successful exploitation of this vulnerability may affect service confidentiality.",
  "id": "GHSA-8cxm-wrjw-f6qw",
  "modified": "2025-05-28T18:33:05Z",
  "published": "2023-12-06T09:30:17Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-49246"
    },
    {
      "type": "WEB",
      "url": "https://consumer.huawei.com/en/support/bulletin/2023/12"
    },
    {
      "type": "WEB",
      "url": "https://https://device.harmonyos.com/en/docs/security/update/security-bulletins-202312-0000001758430245"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8F5W-V7HR-CXV5

Vulnerability from github – Published: 2023-09-29 09:30 – Updated: 2024-04-04 07:58
VLAI
Details

An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16.4 before 16.4.1. It was possible for a removed project member to write to protected branches using deploy keys.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2023-5198"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-284",
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2023-09-29T08:15:09Z",
    "severity": "MODERATE"
  },
  "details": "An issue has been discovered in GitLab affecting all versions prior to 16.2.7, all versions starting from 16.3 before 16.3.5, and all versions starting from 16.4 before 16.4.1. It was possible for a removed project member to write to protected branches using deploy keys.",
  "id": "GHSA-8f5w-v7hr-cxv5",
  "modified": "2024-04-04T07:58:21Z",
  "published": "2023-09-29T09:30:22Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5198"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/2041789"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/416957"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8F66-6FF4-3FJ6

Vulnerability from github – Published: 2022-05-24 19:19 – Updated: 2022-05-24 19:19
VLAI
Details

Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident.

Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2021-39902"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-11-04T23:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Incorrect Authorization in GitLab CE/EE 13.4 or above allows a user with guest membership in a project to modify the severity of an incident.",
  "id": "GHSA-8f66-6ff4-3fj6",
  "modified": "2022-05-24T19:19:55Z",
  "published": "2022-05-24T19:19:55Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39902"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1341674"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/cves/-/blob/master/2021/CVE-2021-39902.json"
    },
    {
      "type": "WEB",
      "url": "https://gitlab.com/gitlab-org/gitlab/-/issues/341479"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

GHSA-8F8H-5GG9-GVV4

Vulnerability from github – Published: 2022-06-18 00:00 – Updated: 2022-06-29 00:00
VLAI
Details

netgear wnap320 router WNAP320_V2.0.3_firmware is vulnerable to Incorrect Access Control via /recreate.php, which can leak all users cookies.

Severity
5.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [],
  "aliases": [
    "CVE-2022-31876"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2022-06-17T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "netgear wnap320 router WNAP320_V2.0.3_firmware is vulnerable to Incorrect Access Control via /recreate.php, which can leak all users cookies.",
  "id": "GHSA-8f8h-5gg9-gvv4",
  "modified": "2022-06-29T00:00:28Z",
  "published": "2022-06-18T00:00:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31876"
    },
    {
      "type": "WEB",
      "url": "https://github.com/jayus0821/uai-poc/blob/main/Netgear/WNAP320/unauth.md"
    },
    {
      "type": "WEB",
      "url": "https://www.netgear.com/about/security"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8F8M-WRVR-WCVF

Vulnerability from github – Published: 2026-05-28 21:32 – Updated: 2026-07-02 17:43
VLAI
Summary
OpenStack Keystone doesn't verify that the user supplied in the authentication request matches the owner of the application credential
Details

An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user's name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential's roles and the victim's actual roles on the project. This enables audit evasion, reading the victim's credentials, and acting as the victim within shared projects.

Severity
6.0 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "keystone"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "14.0.0"
            },
            {
              "fixed": "27.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "keystone"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "28.0.0"
            },
            {
              "fixed": "28.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "keystone"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "29.0.0"
            },
            {
              "fixed": "29.0.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-42998"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-07-02T17:43:19Z",
    "nvd_published_at": "2026-05-28T19:16:37Z",
    "severity": "MODERATE"
  },
  "details": "An issue was discovered in OpenStack Keystone before 29.0.2. The Keystone application credential authentication plugin does not verify that the user supplied in the authentication request matches the owner of the application credential. An attacker can authenticate with their own application credential ID and secret while specifying a different user\u0027s name and domain in the request body. Keystone issues a token attributed to the victim user. The impersonated token is project-scoped and carries the intersection of the application credential\u0027s roles and the victim\u0027s actual roles on the project. This enables audit evasion, reading the victim\u0027s credentials, and acting as the victim within shared projects.",
  "id": "GHSA-8f8m-wrvr-wcvf",
  "modified": "2026-07-02T17:43:19Z",
  "published": "2026-05-28T21:32:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42998"
    },
    {
      "type": "WEB",
      "url": "https://bugs.launchpad.net/keystone/+bug/2148477"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/openstack/keystone"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pypa/advisory-database/tree/main/vulns/keystone/PYSEC-2026-599.yaml"
    },
    {
      "type": "WEB",
      "url": "https://security.openstack.org/ossa/OSSA-2026-015.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L",
      "type": "CVSS_V3"
    }
  ],
  "summary": "OpenStack Keystone doesn\u0027t verify that the user supplied in the authentication request matches the owner of the application credential"
}

GHSA-8FCV-4QP9-PG32

Vulnerability from github – Published: 2025-10-23 12:31 – Updated: 2025-10-24 20:59
VLAI
Summary
Moodle sends quiz-related messages to inactive/suspended users
Details

Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information.

Severity
4.3 (Medium)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
Show details on source website
To clipboard 

{
  "affected": [
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "moodle/moodle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0-beta"
            },
            {
              "fixed": "5.0.3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "moodle/moodle"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.5.0-beta"
            },
            {
              "fixed": "4.5.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2025-62394"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-863"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2025-10-24T20:59:21Z",
    "nvd_published_at": "2025-10-23T12:15:31Z",
    "severity": "MODERATE"
  },
  "details": "Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information.",
  "id": "GHSA-8fcv-4qp9-pg32",
  "modified": "2025-10-24T20:59:21Z",
  "published": "2025-10-23T12:31:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-62394"
    },
    {
      "type": "WEB",
      "url": "https://github.com/moodle/moodle/commit/022bfbfb564d8f3866a43d26eed215213bbdd28a"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2025-62394"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2404427"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/moodle/moodle"
    },
    {
      "type": "WEB",
      "url": "https://moodle.org/mod/forum/discuss.php?d=470383"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Moodle sends quiz-related messages to inactive/suspended users"
}
Mitigation
Architecture and Design
  • Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
  • Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design

Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].

Mitigation MIT-4.4
Architecture and Design

Strategy: Libraries or Frameworks

  • Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
  • For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
  • For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
  • One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration Installation

Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.

No CAPEC attack patterns related to this CWE.

← Back to the CWE list