CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5489 vulnerabilities reference this CWE, most recent first.
GHSA-HMGR-67HW-J2CQ
Vulnerability from github – Published: 2026-05-08 20:01 – Updated: 2026-05-15 23:53Deactivated Channel Members Retain Full Access to Group/DM Channels
Affected Component
Channel membership authorization check:
- backend/open_webui/models/channels.py (lines 663-673, is_user_channel_member)
- Used at 15 locations in backend/open_webui/routers/channels.py
Affected Versions
Current main branch (commit 6fdd19bf1) and likely all versions with the group/DM channel feature.
Description
The is_user_channel_member function checks whether a ChannelMember row exists but does not check the is_active field. When a user is deactivated from a group or DM channel (removed by the channel owner, or leaves voluntarily), their membership row persists with is_active=False and status='left'. Because the authorization check ignores this field, the deactivated user retains full read and write access to the channel via direct API calls.
The channel correctly disappears from the deactivated user's channel list (the listing query at get_channels_by_user_id properly filters on is_active), but all 15 message-level endpoints in the router rely on is_user_channel_member for authorization, which does not filter on is_active.
# models/channels.py:663 — missing is_active check
def is_user_channel_member(self, channel_id, user_id, db=None):
membership = db.query(ChannelMember).filter(
ChannelMember.channel_id == channel_id,
ChannelMember.user_id == user_id,
).first()
return membership is not None # True even when is_active=False
Compare with get_channel_by_id_and_user_id (line 778) which correctly checks ChannelMember.is_active.is_(True).
CVSS 3.1 Breakdown
| Metric | Value | Rationale |
|---|---|---|
| Attack Vector | Network (N) | Exploited remotely via API calls |
| Attack Complexity | Low (L) | No special conditions beyond knowing the channel ID (which the user had as a former member) |
| Privileges Required | Low (L) | Requires a valid user account and prior channel membership |
| User Interaction | None (N) | No victim interaction required |
| Scope | Unchanged (U) | Impact is within the same authorization boundary (the channel) |
| Confidentiality | Low (L) | Can read messages in a channel the user should no longer access |
| Integrity | Low (L) | Can post, edit, and delete messages in the channel |
| Availability | None (N) | No denial of service |
Attack Scenario
- User A and User B are members of a private group channel.
- The channel owner removes User B (or User B leaves). User B's membership is set to
is_active=False, status='left'. - The channel disappears from User B's UI — but User B noted the channel ID while they were a member.
- User B calls the API directly:
GET /api/v1/channels/{channel_id}/messages— reads all messages, including those posted after deactivationPOST /api/v1/channels/{channel_id}/messages/post— posts new messagesPOST /api/v1/channels/{channel_id}/messages/{id}/update— edits messagesDELETE /api/v1/channels/{channel_id}/messages/{id}/delete— deletes messages- All requests succeed because
is_user_channel_memberreturnsTrue.
Impact
- Deactivated users can continue reading all new messages posted after their removal (confidentiality breach)
- Deactivated users can post, edit, and delete messages (integrity breach)
- The deactivation mechanism provides a false sense of security — channel owners believe removed users have lost access
Preconditions
- Channels feature must be enabled (disabled by default)
- Attacker must have a valid user account
- Attacker must have been a member of the channel at some point (and thus knows the channel ID)
Recommended Fix
Add is_active filtering to is_user_channel_member:
def is_user_channel_member(self, channel_id, user_id, db=None):
membership = db.query(ChannelMember).filter(
ChannelMember.channel_id == channel_id,
ChannelMember.user_id == user_id,
ChannelMember.is_active.is_(True),
).first()
return membership is not None
This aligns it with the existing get_channel_by_id_and_user_id method which already applies this filter correctly.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 0.8.12"
},
"package": {
"ecosystem": "PyPI",
"name": "open-webui"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.9.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-44561"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-08T20:01:45Z",
"nvd_published_at": "2026-05-15T20:16:47Z",
"severity": "MODERATE"
},
"details": "# Deactivated Channel Members Retain Full Access to Group/DM Channels\n\n## Affected Component\n\nChannel membership authorization check:\n- `backend/open_webui/models/channels.py` (lines 663-673, `is_user_channel_member`)\n- Used at 15 locations in `backend/open_webui/routers/channels.py`\n\n## Affected Versions\n\nCurrent main branch (commit `6fdd19bf1`) and likely all versions with the group/DM channel feature.\n\n## Description\n\nThe `is_user_channel_member` function checks whether a `ChannelMember` row exists but does not check the `is_active` field. When a user is deactivated from a group or DM channel (removed by the channel owner, or leaves voluntarily), their membership row persists with `is_active=False` and `status=\u0027left\u0027`. Because the authorization check ignores this field, the deactivated user retains full read and write access to the channel via direct API calls.\n\nThe channel correctly disappears from the deactivated user\u0027s channel list (the listing query at `get_channels_by_user_id` properly filters on `is_active`), but all 15 message-level endpoints in the router rely on `is_user_channel_member` for authorization, which does not filter on `is_active`.\n\n```python\n# models/channels.py:663 \u2014 missing is_active check\ndef is_user_channel_member(self, channel_id, user_id, db=None):\n membership = db.query(ChannelMember).filter(\n ChannelMember.channel_id == channel_id,\n ChannelMember.user_id == user_id,\n ).first()\n return membership is not None # True even when is_active=False\n```\n\nCompare with `get_channel_by_id_and_user_id` (line 778) which correctly checks `ChannelMember.is_active.is_(True)`.\n\n## CVSS 3.1 Breakdown\n\n| Metric | Value | Rationale |\n|--------|-------|-----------|\n| Attack Vector | Network (N) | Exploited remotely via API calls |\n| Attack Complexity | Low (L) | No special conditions beyond knowing the channel ID (which the user had as a former member) |\n| Privileges Required | Low (L) | Requires a valid user account and prior channel membership |\n| User Interaction | None (N) | No victim interaction required |\n| Scope | Unchanged (U) | Impact is within the same authorization boundary (the channel) |\n| Confidentiality | Low (L) | Can read messages in a channel the user should no longer access |\n| Integrity | Low (L) | Can post, edit, and delete messages in the channel |\n| Availability | None (N) | No denial of service |\n\n## Attack Scenario\n\n1. User A and User B are members of a private group channel.\n2. The channel owner removes User B (or User B leaves). User B\u0027s membership is set to `is_active=False, status=\u0027left\u0027`.\n3. The channel disappears from User B\u0027s UI \u2014 but User B noted the channel ID while they were a member.\n4. User B calls the API directly:\n - `GET /api/v1/channels/{channel_id}/messages` \u2014 reads all messages, including those posted after deactivation\n - `POST /api/v1/channels/{channel_id}/messages/post` \u2014 posts new messages\n - `POST /api/v1/channels/{channel_id}/messages/{id}/update` \u2014 edits messages\n - `DELETE /api/v1/channels/{channel_id}/messages/{id}/delete` \u2014 deletes messages\n5. All requests succeed because `is_user_channel_member` returns `True`.\n\n## Impact\n\n- Deactivated users can continue reading all new messages posted after their removal (confidentiality breach)\n- Deactivated users can post, edit, and delete messages (integrity breach)\n- The deactivation mechanism provides a false sense of security \u2014 channel owners believe removed users have lost access\n\n## Preconditions\n\n- Channels feature must be enabled (disabled by default)\n- Attacker must have a valid user account\n- Attacker must have been a member of the channel at some point (and thus knows the channel ID)\n\n## Recommended Fix\n\nAdd `is_active` filtering to `is_user_channel_member`:\n\n```python\ndef is_user_channel_member(self, channel_id, user_id, db=None):\n membership = db.query(ChannelMember).filter(\n ChannelMember.channel_id == channel_id,\n ChannelMember.user_id == user_id,\n ChannelMember.is_active.is_(True),\n ).first()\n return membership is not None\n```\n\nThis aligns it with the existing `get_channel_by_id_and_user_id` method which already applies this filter correctly.",
"id": "GHSA-hmgr-67hw-j2cq",
"modified": "2026-05-15T23:53:24Z",
"published": "2026-05-08T20:01:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/open-webui/open-webui/security/advisories/GHSA-hmgr-67hw-j2cq"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44561"
},
{
"type": "PACKAGE",
"url": "https://github.com/open-webui/open-webui"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Open WebUI: Deactivated Channel Members Retain Full Access to Group/DM Channels"
}
GHSA-HMGR-RM4X-VVJH
Vulnerability from github – Published: 2024-09-04 06:30 – Updated: 2024-09-04 06:30Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information.
{
"affected": [],
"aliases": [
"CVE-2024-34642"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-09-04T06:15:12Z",
"severity": "MODERATE"
},
"details": "Improper authorization in One UI Home prior to SMR Sep-2024 Release 1 allows physical attackers to temporarily access sensitive information.",
"id": "GHSA-hmgr-rm4x-vvjh",
"modified": "2024-09-04T06:30:41Z",
"published": "2024-09-04T06:30:41Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-34642"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2024\u0026month=09"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HMHP-GH8M-C8XP
Vulnerability from github – Published: 2025-12-30 21:30 – Updated: 2026-01-02 15:46When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different namespace than the namespace authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without authorizing the caller for that target namespace. This can allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace. This issue affects Temporal: through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "go.temporal.io/server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.27.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "go.temporal.io/server"
},
"ranges": [
{
"events": [
{
"introduced": "1.28.0"
},
{
"fixed": "1.28.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "go.temporal.io/server"
},
"ranges": [
{
"events": [
{
"introduced": "1.29.0"
},
{
"fixed": "1.29.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "go.temporal.io/server"
},
"ranges": [
{
"events": [
{
"introduced": "1.29.0-0"
},
{
"fixed": "1.29.0-135.0.0.20251218190115-b292a32bacdf"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-14987"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-01-02T15:46:14Z",
"nvd_published_at": "2025-12-30T21:15:43Z",
"severity": "MODERATE"
},
"details": "When system.enableCrossNamespaceCommands is enabled (on by default), the Temporal server permits certain workflow task commands (e.g. StartChildWorkflowExecution, SignalExternalWorkflowExecution, RequestCancelExternalWorkflowExecution) to target a different namespace than the namespace authorized at the gRPC boundary. The frontend authorizes RespondWorkflowTaskCompleted based on the outer request namespace, but the history service later resolves and executes the command using the namespace embedded in command attributes without authorizing the caller for that target namespace. This can allow a worker authorized for one namespace to create, signal, or cancel workflows in another namespace.\nThis issue affects Temporal: through 1.29.1. Fixed in 1.27.4, 1.28.2, 1.29.2.",
"id": "GHSA-hmhp-gh8m-c8xp",
"modified": "2026-01-02T15:46:14Z",
"published": "2025-12-30T21:30:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-14987"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal/commit/b292a32bacdfa6472affd90f0a940408d5839cfa"
},
{
"type": "PACKAGE",
"url": "https://github.com/temporalio/temporal"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal/releases/tag/v1.27.4"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal/releases/tag/v1.28.2"
},
{
"type": "WEB",
"url": "https://github.com/temporalio/temporal/releases/tag/v1.29.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L",
"type": "CVSS_V4"
}
],
"summary": "Temporal has an Incorrect Authorization vulnerability"
}
GHSA-HMPX-XG9M-66VP
Vulnerability from github – Published: 2022-05-24 17:28 – Updated: 2022-05-24 17:28In PackageManager, there is a missing permission check. This could lead to local information disclosure across user boundaries with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153995991
{
"affected": [],
"aliases": [
"CVE-2020-0288"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-09-17T21:15:00Z",
"severity": "MODERATE"
},
"details": "In PackageManager, there is a missing permission check. This could lead to local information disclosure across user boundaries with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-11Android ID: A-153995991",
"id": "GHSA-hmpx-xg9m-66vp",
"modified": "2022-05-24T17:28:35Z",
"published": "2022-05-24T17:28:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-0288"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/android-11"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-HMQR-WJMJ-376C
Vulnerability from github – Published: 2026-03-09 17:27 – Updated: 2026-03-11 20:38The Authorise middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication (hostAllowed=true), a valid host token bypasses all subsequent authorisation checks without verifying that the host is authorised to access the specific requested resource. Any entity possessing knowledge of object identifiers (node IDs, host IDs) can craft a request with an arbitrary valid host token to access, modify, or delete resources belonging to other hosts. Affected endpoints include node info retrieval, host deletion, MQTT signal transmission, fallback host updates, and failover operations.
Credits Artem Danilov (Positive Technologies)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/gravitl/netmaker"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-29194"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-09T17:27:46Z",
"nvd_published_at": "2026-03-07T16:15:54Z",
"severity": "HIGH"
},
"details": "The Authorise middleware in Netmaker incorrectly validates host JWT tokens. When a route permits host authentication (hostAllowed=true), a valid host token bypasses all subsequent authorisation checks without verifying that the host is authorised to access the specific requested resource. Any entity possessing knowledge of object identifiers (node IDs, host IDs) can craft a request with an arbitrary valid host token to access, modify, or delete resources belonging to other hosts. Affected endpoints include node info retrieval, host deletion, MQTT signal transmission, fallback host updates, and failover operations.\n\n\n\u003e Credits\n\u003e Artem Danilov (Positive Technologies)",
"id": "GHSA-hmqr-wjmj-376c",
"modified": "2026-03-11T20:38:58Z",
"published": "2026-03-09T17:27:46Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/gravitl/netmaker/security/advisories/GHSA-hmqr-wjmj-376c"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-29194"
},
{
"type": "PACKAGE",
"url": "https://github.com/gravitl/netmaker"
},
{
"type": "WEB",
"url": "https://github.com/gravitl/netmaker/releases/tag/v1.5.0"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "Netmaker has Insufficient Authorization in Host Token Verification"
}
GHSA-HMR3-XC3F-VFCX
Vulnerability from github – Published: 2026-07-10 06:31 – Updated: 2026-07-10 06:31The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the 'subscription_id' parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users' subscriptions.
{
"affected": [],
"aliases": [
"CVE-2026-5069"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-10T04:17:52Z",
"severity": "MODERATE"
},
"details": "The Fluent Forms plugin for WordPress is vulnerable to incorrect authorization via the \u0027subscription_id\u0027 parameter in versions up to, and including, 6.2.1. This is due to insufficient ownership authorization checks in the payment cancellation AJAX flow. This makes it possible for authenticated attackers, with subscriber-level access and above, to submit cancellation requests for other users\u0027 subscriptions.",
"id": "GHSA-hmr3-xc3f-vfcx",
"modified": "2026-07-10T06:31:20Z",
"published": "2026-07-10T06:31:20Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5069"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/changeset/3513845/fluentform"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e7521577-ce13-4b60-ae11-9c0f9c077cf9?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-HMVH-HR6V-F5W7
Vulnerability from github – Published: 2022-05-24 19:02 – Updated: 2022-05-24 19:02Windows Container Manager Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-31167, CVE-2021-31168, CVE-2021-31169, CVE-2021-31208.
{
"affected": [],
"aliases": [
"CVE-2021-31165"
],
"database_specific": {
"cwe_ids": [
"CWE-269",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-05-11T19:15:00Z",
"severity": "HIGH"
},
"details": "Windows Container Manager Service Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-31167, CVE-2021-31168, CVE-2021-31169, CVE-2021-31208.",
"id": "GHSA-hmvh-hr6v-f5w7",
"modified": "2022-05-24T19:02:03Z",
"published": "2022-05-24T19:02:03Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-31165"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-31165"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/162555/Windows-Container-Manager-Service-CmsRpcSrv_CreateContainer-Privilege-Escalation.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-HMVR-FWH8-P62R
Vulnerability from github – Published: 2022-05-13 01:49 – Updated: 2022-05-13 01:49An issue was discovered on D-Link DIR-890L with firmware 1.21B02beta01 and earlier, DIR-885L/R with firmware 1.21B03beta01 and earlier, and DIR-895L/R with firmware 1.21B04beta04 and earlier devices (all hardware revisions). Due to the predictability of the /docs/captcha_(number).jpeg URI, being local to the network, but unauthenticated to the administrator's panel, an attacker can disclose the CAPTCHAs used by the access point and can elect to load the CAPTCHA of their choosing, leading to unauthorized login attempts to the access point.
{
"affected": [],
"aliases": [
"CVE-2018-12103"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-05T20:29:00Z",
"severity": "MODERATE"
},
"details": "An issue was discovered on D-Link DIR-890L with firmware 1.21B02beta01 and earlier, DIR-885L/R with firmware 1.21B03beta01 and earlier, and DIR-895L/R with firmware 1.21B04beta04 and earlier devices (all hardware revisions). Due to the predictability of the /docs/captcha_(number).jpeg URI, being local to the network, but unauthenticated to the administrator\u0027s panel, an attacker can disclose the CAPTCHAs used by the access point and can elect to load the CAPTCHA of their choosing, leading to unauthorized login attempts to the access point.",
"id": "GHSA-hmvr-fwh8-p62r",
"modified": "2022-05-13T01:49:28Z",
"published": "2022-05-13T01:49:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-12103"
},
{
"type": "WEB",
"url": "https://securityadvisories.dlink.com/announcement/publication.aspx?name=SAP10099"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2018/Jul/13"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HMWW-M5WM-539P
Vulnerability from github – Published: 2023-07-06 15:30 – Updated: 2024-04-04 05:26Inappropriate authorization vulnerability in the system apps. Successful exploitation of this vulnerability may affect service integrity.
{
"affected": [],
"aliases": [
"CVE-2022-48508"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-06T13:15:10Z",
"severity": "HIGH"
},
"details": " Inappropriate authorization vulnerability in the system apps. Successful exploitation of this vulnerability may affect service integrity.",
"id": "GHSA-hmww-m5wm-539p",
"modified": "2024-04-04T05:26:05Z",
"published": "2023-07-06T15:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-48508"
},
{
"type": "WEB",
"url": "https://consumer.huawei.com/en/support/bulletin/2023/7"
},
{
"type": "WEB",
"url": "https://device.harmonyos.com/en/docs/security/update/security-bulletins-202307-0000001587168858"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-HP2J-X7VV-R597
Vulnerability from github – Published: 2023-01-31 15:30 – Updated: 2023-02-08 03:30IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6, and all prior versions allow authenticated users assigned the Identity Administrator capability or any custom capability that contains the SetIdentityForwarding right to modify the work item forwarding configuration for identities other than the ones that should be allowed by Lifecycle Manager Quicklink Population configuration.
{
"affected": [],
"aliases": [
"CVE-2022-45435"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-01-31T15:15:00Z",
"severity": "MODERATE"
},
"details": "IdentityIQ 8.3 and all 8.3 patch levels prior to 8.3p2, IdentityIQ 8.2 and all 8.2 patch levels prior to 8.2p5, IdentityIQ 8.1 and all 8.1 patch levels prior to 8.1p7, IdentityIQ 8.0 and all 8.0 patch levels prior to 8.0p6, and all prior versions allow authenticated users assigned the Identity Administrator capability or any custom capability that contains the SetIdentityForwarding right to modify the work item forwarding configuration for identities other than the ones that should be allowed by Lifecycle Manager Quicklink Population configuration.",
"id": "GHSA-hp2j-x7vv-r597",
"modified": "2023-02-08T03:30:25Z",
"published": "2023-01-31T15:30:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-45435"
},
{
"type": "WEB",
"url": "https://www.sailpoint.com/security-advisories/sailpoint-identityiq-identity-forwarding-vulnerability-cve-2022-45435"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.