Search
Find a vulnerability
Search criteria
ⓘ
Use this form to refine search results.
Full-text search supports keyword queries with ranking and filtering.
You can combine vendor, product, and sources to narrow results.
Enable “Apply ordering” to sort by date instead of relevance.
14 vulnerabilities by Countly
CVE-2026-44977 (GCVE-0-2026-44977)
Vulnerability from nvd – Published: 2026-10-16 16:04 – Updated: 2026-10-16 16:04
VLAI
EPSS
VEX
Title
countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context
Summary
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.
Severity
9 (Critical)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Countly/countly-server/securit… | x_refsource_CONFIRM |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Countly | countly-server |
Affected:
< 24.05.50
Affected: >= 25.03, < 25.03.44 |
{
"containers": {
"cna": {
"affected": [
{
"product": "countly-server",
"vendor": "Countly",
"versions": [
{
"status": "affected",
"version": "\u003c 24.05.50"
},
{
"status": "affected",
"version": "\u003e= 25.03, \u003c 25.03.44"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:04:45.868Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Countly/countly-server/security/advisories/GHSA-jqp4-p86c-phxc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-jqp4-p86c-phxc"
},
{
"name": "https://github.com/Countly/countly-server/commit/ae899f37bc6d70c1b44859756ce80a204ae72631",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/ae899f37bc6d70c1b44859756ce80a204ae72631"
},
{
"name": "https://github.com/Countly/countly-server/commit/fcb16c808c0fdb6dc99fe9c66de7fc560b3a9c41",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/fcb16c808c0fdb6dc99fe9c66de7fc560b3a9c41"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/24.05.50",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/24.05.50"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/25.03.44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/25.03.44"
}
],
"source": {
"advisory": "GHSA-jqp4-p86c-phxc",
"discovery": "UNKNOWN"
},
"title": "countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44977",
"datePublished": "2026-10-16T16:04:45.868Z",
"dateReserved": "2026-05-08T16:23:33.264Z",
"dateUpdated": "2026-10-16T16:04:45.868Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42270 (GCVE-0-2026-42270)
Vulnerability from nvd – Published: 2026-10-16 16:02 – Updated: 2026-10-16 16:52
VLAI
EPSS
VEX
Title
countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception
Summary
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:52 UTC
CWE
- CWE-248 - Uncaught Exception
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Countly/countly-server/securit… | x_refsource_CONFIRM |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Countly | countly-server |
Affected:
< 24.05.50
Affected: >= 25.03, < 25.03.44 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42270",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:52:07.011789Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:52:38.647Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-86cv-qwp9-jwp3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "countly-server",
"vendor": "Countly",
"versions": [
{
"status": "affected",
"version": "\u003c 24.05.50"
},
{
"status": "affected",
"version": "\u003e= 25.03, \u003c 25.03.44"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:02:00.196Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Countly/countly-server/security/advisories/GHSA-86cv-qwp9-jwp3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-86cv-qwp9-jwp3"
},
{
"name": "https://github.com/Countly/countly-server/commit/72f19bc5161117fa02a224bf9f7316bf42dae58d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/72f19bc5161117fa02a224bf9f7316bf42dae58d"
},
{
"name": "https://github.com/Countly/countly-server/commit/f9ad31480f94ee3ccc0f12708c8804be9c803f95",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/f9ad31480f94ee3ccc0f12708c8804be9c803f95"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/24.05.50",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/24.05.50"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/25.03.44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/25.03.44"
}
],
"source": {
"advisory": "GHSA-86cv-qwp9-jwp3",
"discovery": "UNKNOWN"
},
"title": "countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42270",
"datePublished": "2026-10-16T16:02:00.196Z",
"dateReserved": "2026-04-26T11:53:27.707Z",
"dateUpdated": "2026-10-16T16:52:38.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42269 (GCVE-0-2026-42269)
Vulnerability from nvd – Published: 2026-10-16 15:59 – Updated: 2026-10-16 17:05
VLAI
EPSS
VEX
Title
countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion
Summary
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:32 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Countly/countly-server/securit… | x_refsource_CONFIRM |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/blob/ma… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Countly | countly-server |
Affected:
< 24.05.50
Affected: >= 25.03, < 25.03.44 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42269",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:32:12.813140Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:05:51.713Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "countly-server",
"vendor": "Countly",
"versions": [
{
"status": "affected",
"version": "\u003c 24.05.50"
},
{
"status": "affected",
"version": "\u003e= 25.03, \u003c 25.03.44"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:59:04.637Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Countly/countly-server/security/advisories/GHSA-5pmc-54j6-jcgq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-5pmc-54j6-jcgq"
},
{
"name": "https://github.com/Countly/countly-server/commit/764e2a1d86f9af600113f77422d520338c214229",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/764e2a1d86f9af600113f77422d520338c214229"
},
{
"name": "https://github.com/Countly/countly-server/commit/b652ee8dafa91602705004d0edb602a91a0d845e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/b652ee8dafa91602705004d0edb602a91a0d845e"
},
{
"name": "https://github.com/Countly/countly-server/blob/master/CHANGELOG.md#version-250344",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/blob/master/CHANGELOG.md#version-250344"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/24.05.50",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/24.05.50"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/25.03.44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/25.03.44"
}
],
"source": {
"advisory": "GHSA-5pmc-54j6-jcgq",
"discovery": "UNKNOWN"
},
"title": "countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42269",
"datePublished": "2026-10-16T15:59:04.637Z",
"dateReserved": "2026-04-26T11:53:27.706Z",
"dateUpdated": "2026-10-16T17:05:51.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41582 (GCVE-0-2026-41582)
Vulnerability from nvd – Published: 2026-10-16 16:03 – Updated: 2026-10-19 12:37
VLAI
EPSS
VEX
Title
countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files
Summary
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 12:35 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Countly/countly-server/securit… | x_refsource_CONFIRM |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Countly | countly-server |
Affected:
< 24.05.50
Affected: >= 25.03, < 25.03.44 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41582",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T12:35:23.231913Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T12:37:13.079Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-fqgp-6rm9-8696"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "countly-server",
"vendor": "Countly",
"versions": [
{
"status": "affected",
"version": "\u003c 24.05.50"
},
{
"status": "affected",
"version": "\u003e= 25.03, \u003c 25.03.44"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:03:39.860Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Countly/countly-server/security/advisories/GHSA-fqgp-6rm9-8696",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-fqgp-6rm9-8696"
},
{
"name": "https://github.com/Countly/countly-server/commit/405cb229ed37c744f6d61c42bf86fee5a7ee3530",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/405cb229ed37c744f6d61c42bf86fee5a7ee3530"
},
{
"name": "https://github.com/Countly/countly-server/commit/8004d29d3c789b70a79bf6e0380f0d546dbf42a9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/8004d29d3c789b70a79bf6e0380f0d546dbf42a9"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/24.05.50",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/24.05.50"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/25.03.44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/25.03.44"
}
],
"source": {
"advisory": "GHSA-fqgp-6rm9-8696",
"discovery": "UNKNOWN"
},
"title": "countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-41582",
"datePublished": "2026-10-16T16:03:39.860Z",
"dateReserved": "2026-04-21T14:15:21.959Z",
"dateUpdated": "2026-10-19T12:37:13.079Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87803 (GCVE-0-2026-87803)
Vulnerability from nvd – Published: 2026-09-10 09:54 – Updated: 2026-09-10 13:17
VLAI
EPSS
VEX
Summary
An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested array is a sub-pipeline by checking if every element contains a key present in a hardcoded KNOWN_STAGE_OPERATORS set. If any element contains an unrecognized stage key, such as the undocumented MongoDB-internal $_internalInhibitOptimization, the sanitizer misclassifies the entire branch as a generic array and skips stage-level stripping for all sibling stages. This allows a non-admin user with DBViewer read permission to inject forbidden operators like $lookup inside $facet sub-pipelines, performing cross-collection joins into restricted collections. This leads to unauthorized read access to sensitive data including password-reset tokens (prid), enabling account takeover.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:16 UTC
CWE
- CWE-863 - Countly DBViewer authorization bypass via nested aggregation stage poisoning
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Countly | countly-server |
Affected:
0 , < 25.03.53-LTS
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87803",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:16:57.956270Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:17:16.963Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "countly-server",
"vendor": "Countly",
"versions": [
{
"lessThan": "25.03.53-LTS",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Catalin Iovita (Snyk Security Research)"
}
],
"descriptions": [
{
"lang": "en",
"value": "An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested array is a sub-pipeline by checking if every element contains a key present in a hardcoded KNOWN_STAGE_OPERATORS set. If any element contains an unrecognized stage key, such as the undocumented MongoDB-internal $_internalInhibitOptimization, the sanitizer misclassifies the entire branch as a generic array and skips stage-level stripping for all sibling stages. This allows a non-admin user with DBViewer read permission to inject forbidden operators like $lookup inside $facet sub-pipelines, performing cross-collection joins into restricted collections. This leads to unauthorized read access to sensitive data including password-reset tokens (prid), enabling account takeover."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Countly DBViewer authorization bypass via nested aggregation stage poisoning",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T12:00:48.815Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"url": "https://github.com/Countly/countly-server/pull/7868"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2026-87803",
"datePublished": "2026-09-10T09:54:01.912Z",
"dateReserved": "2026-09-09T10:11:56.597Z",
"dateUpdated": "2026-09-10T13:17:16.963Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-32852 (GCVE-0-2021-32852)
Vulnerability from nvd – Published: 2023-02-20 00:00 – Updated: 2025-03-10 21:09
VLAI
EPSS
VEX
Title
countly-server vulnerable to Cross-site Scripting
Summary
Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edition. The victim must follow a malicious link or be redirected there from malicious web site. The attacker must have an account or be able to create one. This issue is patched in version 21.11.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-10 21:00 UTC
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Countly | countly-server |
Affected:
21.11 , < 21.11
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:56.093Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securitylab.github.com/advisories/GHSL-2021-104-countly-server/"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Countly/countly-server/releases/tag/v21.11"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/views/reset.html#L95"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/app.js#L1112"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-32852",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-10T21:00:32.376074Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-10T21:09:07.859Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "countly-server",
"vendor": "Countly",
"versions": [
{
"lessThan": "21.11",
"status": "affected",
"version": "21.11",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edition. The victim must follow a malicious link or be redirected there from malicious web site. The attacker must have an account or be able to create one. This issue is patched in version 21.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-20T00:00:00.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://securitylab.github.com/advisories/GHSL-2021-104-countly-server/"
},
{
"url": "https://github.com/Countly/countly-server/releases/tag/v21.11"
},
{
"url": "https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/views/reset.html#L95"
},
{
"url": "https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/app.js#L1112"
}
],
"source": {
"advisory": "GHSL-2021-104",
"defect": [
"GHSL-2021-104"
],
"discovery": "UNKNOWN"
},
"title": "countly-server vulnerable to Cross-site Scripting",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-32852",
"datePublished": "2023-02-20T00:00:00.000Z",
"dateReserved": "2021-05-12T00:00:00.000Z",
"dateUpdated": "2025-03-10T21:09:07.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-29174 (GCVE-0-2022-29174)
Vulnerability from nvd – Published: 2022-05-17 20:45 – Updated: 2025-04-23 18:25
VLAI
EPSS
VEX
Title
Predictable password reset token may lead to account takeover in countly-server
Summary
countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-23 15:53 UTC
CWE
- CWE-640 - Weak Password Recovery Mechanism for Forgotten Password
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Countly/countly-server/securit… | x_refsource_CONFIRM |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Countly | countly-server |
Affected:
< 21.11.4
Affected: >= 22.0.0, < 22.03.7 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:17:53.998Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-29174",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T15:53:12.624160Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T18:25:30.812Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "countly-server",
"vendor": "Countly",
"versions": [
{
"status": "affected",
"version": "\u003c 21.11.4"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.03.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-17T20:45:10.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999"
}
],
"source": {
"advisory": "GHSA-98vh-wqw5-p23v",
"discovery": "UNKNOWN"
},
"title": "Predictable password reset token may lead to account takeover in countly-server",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-29174",
"STATE": "PUBLIC",
"TITLE": "Predictable password reset token may lead to account takeover in countly-server"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "countly-server",
"version": {
"version_data": [
{
"version_value": "\u003c 21.11.4"
},
{
"version_value": "\u003e= 22.0.0, \u003c 22.03.7"
}
]
}
}
]
},
"vendor_name": "Countly"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v",
"refsource": "CONFIRM",
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v"
},
{
"name": "https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999",
"refsource": "MISC",
"url": "https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999"
}
]
},
"source": {
"advisory": "GHSA-98vh-wqw5-p23v",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-29174",
"datePublished": "2022-05-17T20:45:10.000Z",
"dateReserved": "2022-04-13T00:00:00.000Z",
"dateUpdated": "2025-04-23T18:25:30.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2026-44977 (GCVE-0-2026-44977)
Vulnerability from cvelistv5 – Published: 2026-10-16 16:04 – Updated: 2026-10-16 16:04
VLAI
EPSS
VEX
Title
countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context
Summary
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44.
Severity
9 (Critical)
CWE
- CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Countly/countly-server/securit… | x_refsource_CONFIRM |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Countly | countly-server |
Affected:
< 24.05.50
Affected: >= 25.03, < 25.03.44 |
{
"containers": {
"cna": {
"affected": [
{
"product": "countly-server",
"vendor": "Countly",
"versions": [
{
"status": "affected",
"version": "\u003c 24.05.50"
},
{
"status": "affected",
"version": "\u003e= 25.03, \u003c 25.03.44"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, plugins/star-rating/api/api.js allows a non-global application administrator to use uploadFeedbackFile to store attacker-controlled active content while trusting the supplied MIME type. plugins/star-rating/frontend/app.js publicly serves the stored content from feedback/preview/ with the attacker-influenced Content-Type, so a global administrator who opens the preview executes the payload in the Countly origin and exposes authenticated session capabilities, including auth_token and csrf_token values. This issue is fixed in versions 24.05.50 and 25.03.44."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 9,
"baseSeverity": "CRITICAL",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:04:45.868Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Countly/countly-server/security/advisories/GHSA-jqp4-p86c-phxc",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-jqp4-p86c-phxc"
},
{
"name": "https://github.com/Countly/countly-server/commit/ae899f37bc6d70c1b44859756ce80a204ae72631",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/ae899f37bc6d70c1b44859756ce80a204ae72631"
},
{
"name": "https://github.com/Countly/countly-server/commit/fcb16c808c0fdb6dc99fe9c66de7fc560b3a9c41",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/fcb16c808c0fdb6dc99fe9c66de7fc560b3a9c41"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/24.05.50",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/24.05.50"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/25.03.44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/25.03.44"
}
],
"source": {
"advisory": "GHSA-jqp4-p86c-phxc",
"discovery": "UNKNOWN"
},
"title": "countly-server: Stored XSS in feedback upload enables app-admin to compromise global admin session context"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-44977",
"datePublished": "2026-10-16T16:04:45.868Z",
"dateReserved": "2026-05-08T16:23:33.264Z",
"dateUpdated": "2026-10-16T16:04:45.868Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-41582 (GCVE-0-2026-41582)
Vulnerability from cvelistv5 – Published: 2026-10-16 16:03 – Updated: 2026-10-19 12:37
VLAI
EPSS
VEX
Title
countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files
Summary
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-19 12:35 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Countly/countly-server/securit… | x_refsource_CONFIRM |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Countly | countly-server |
Affected:
< 24.05.50
Affected: >= 25.03, < 25.03.44 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-41582",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-19T12:35:23.231913Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T12:37:13.079Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-fqgp-6rm9-8696"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "countly-server",
"vendor": "Countly",
"versions": [
{
"status": "affected",
"version": "\u003c 24.05.50"
},
{
"status": "affected",
"version": "\u003e= 25.03, \u003c 25.03.44"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, public image and screenshot routes implemented in frontend/express/app.js, plugins/star-rating/frontend/app.js, and plugins/dashboards/frontend/app.js concatenate attacker-controlled wildcard paths without containment validation. On deployments using the local filesystem backend, an unauthenticated request can traverse outside the intended asset directories and reach getStats or getStream in api/utils/countlyFs.js, allowing arbitrary readable server files to be disclosed. The affected routes include /appimages/*, /memberimages/*, */screenshots/*, /star-rating/images/*, and /dashboards/images/screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:03:39.860Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Countly/countly-server/security/advisories/GHSA-fqgp-6rm9-8696",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-fqgp-6rm9-8696"
},
{
"name": "https://github.com/Countly/countly-server/commit/405cb229ed37c744f6d61c42bf86fee5a7ee3530",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/405cb229ed37c744f6d61c42bf86fee5a7ee3530"
},
{
"name": "https://github.com/Countly/countly-server/commit/8004d29d3c789b70a79bf6e0380f0d546dbf42a9",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/8004d29d3c789b70a79bf6e0380f0d546dbf42a9"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/24.05.50",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/24.05.50"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/25.03.44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/25.03.44"
}
],
"source": {
"advisory": "GHSA-fqgp-6rm9-8696",
"discovery": "UNKNOWN"
},
"title": "countly-server: Unauthenticated Path Traversal via Public Image and Screenshot Routes Leads to Read Internal Files"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-41582",
"datePublished": "2026-10-16T16:03:39.860Z",
"dateReserved": "2026-04-21T14:15:21.959Z",
"dateUpdated": "2026-10-19T12:37:13.079Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42270 (GCVE-0-2026-42270)
Vulnerability from cvelistv5 – Published: 2026-10-16 16:02 – Updated: 2026-10-16 16:52
VLAI
EPSS
VEX
Title
countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception
Summary
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:52 UTC
CWE
- CWE-248 - Uncaught Exception
Assigner
References
5 references
| URL | Tags |
|---|---|
| https://github.com/Countly/countly-server/securit… | x_refsource_CONFIRM |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Countly | countly-server |
Affected:
< 24.05.50
Affected: >= 25.03, < 25.03.44 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42270",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:52:07.011789Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:52:38.647Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-86cv-qwp9-jwp3"
}
],
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "countly-server",
"vendor": "Countly",
"versions": [
{
"status": "affected",
"version": "\u003c 24.05.50"
},
{
"status": "affected",
"version": "\u003e= 25.03, \u003c 25.03.44"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, star-rating/images/ and dashboards/images/screenshots/ are among public image and screenshot routes using the local fs storage backend that call getStream and pipe filesystem streams to HTTP responses without an error listener. An unauthenticated request containing a URL-encoded dot can make createReadStream open a directory, emit an asynchronous EISDIR error, and terminate the Node.js process as an unhandled exception, allowing repeated requests to keep the analytics API unavailable. The affected routes also include /appimages/*, /memberimages/*, and */screenshots/*. This issue is fixed in versions 24.05.50 and 25.03.44."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-248",
"description": "CWE-248: Uncaught Exception",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T16:02:00.196Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Countly/countly-server/security/advisories/GHSA-86cv-qwp9-jwp3",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-86cv-qwp9-jwp3"
},
{
"name": "https://github.com/Countly/countly-server/commit/72f19bc5161117fa02a224bf9f7316bf42dae58d",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/72f19bc5161117fa02a224bf9f7316bf42dae58d"
},
{
"name": "https://github.com/Countly/countly-server/commit/f9ad31480f94ee3ccc0f12708c8804be9c803f95",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/f9ad31480f94ee3ccc0f12708c8804be9c803f95"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/24.05.50",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/24.05.50"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/25.03.44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/25.03.44"
}
],
"source": {
"advisory": "GHSA-86cv-qwp9-jwp3",
"discovery": "UNKNOWN"
},
"title": "countly-server: Unauthenticated Denial of Service (DoS) via Unhandled Stream Exception"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42270",
"datePublished": "2026-10-16T16:02:00.196Z",
"dateReserved": "2026-04-26T11:53:27.707Z",
"dateUpdated": "2026-10-16T16:52:38.647Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-42269 (GCVE-0-2026-42269)
Vulnerability from cvelistv5 – Published: 2026-10-16 15:59 – Updated: 2026-10-16 17:05
VLAI
EPSS
VEX
Title
countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion
Summary
countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 16:32 UTC
CWE
- CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Assigner
References
6 references
| URL | Tags |
|---|---|
| https://github.com/Countly/countly-server/securit… | x_refsource_CONFIRM |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
| https://github.com/Countly/countly-server/blob/ma… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
| https://github.com/Countly/countly-server/release… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Countly | countly-server |
Affected:
< 24.05.50
Affected: >= 25.03, < 25.03.44 |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42269",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T16:32:12.813140Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T17:05:51.713Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "countly-server",
"vendor": "Countly",
"versions": [
{
"status": "affected",
"version": "\u003c 24.05.50"
},
{
"status": "affected",
"version": "\u003e= 25.03, \u003c 25.03.44"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to 24.05.50 and 25.03.44, the authenticated data-migration deletion route in plugins/data_migration/api/api.js passes the user-controlled exportid to clean_up_data without path validation. plugins/data_migration/api/data_migration_helper.js concatenates that identifier into a path resolved outside the intended import directory and calls remove recursively, allowing an application administrator or user with migration permission to delete writable files or directory trees and cause data loss or service disruption. This issue is fixed in versions 24.05.50 and 25.03.44."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-22",
"description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:59:04.637Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/Countly/countly-server/security/advisories/GHSA-5pmc-54j6-jcgq",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-5pmc-54j6-jcgq"
},
{
"name": "https://github.com/Countly/countly-server/commit/764e2a1d86f9af600113f77422d520338c214229",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/764e2a1d86f9af600113f77422d520338c214229"
},
{
"name": "https://github.com/Countly/countly-server/commit/b652ee8dafa91602705004d0edb602a91a0d845e",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/b652ee8dafa91602705004d0edb602a91a0d845e"
},
{
"name": "https://github.com/Countly/countly-server/blob/master/CHANGELOG.md#version-250344",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/blob/master/CHANGELOG.md#version-250344"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/24.05.50",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/24.05.50"
},
{
"name": "https://github.com/Countly/countly-server/releases/tag/25.03.44",
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/releases/tag/25.03.44"
}
],
"source": {
"advisory": "GHSA-5pmc-54j6-jcgq",
"discovery": "UNKNOWN"
},
"title": "countly-server: Path Traversal in delete_import Endpoint Allows Arbitrary File and Directory Deletion"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42269",
"datePublished": "2026-10-16T15:59:04.637Z",
"dateReserved": "2026-04-26T11:53:27.706Z",
"dateUpdated": "2026-10-16T17:05:51.713Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2026-87803 (GCVE-0-2026-87803)
Vulnerability from cvelistv5 – Published: 2026-09-10 09:54 – Updated: 2026-09-10 13:17
VLAI
EPSS
VEX
Summary
An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested array is a sub-pipeline by checking if every element contains a key present in a hardcoded KNOWN_STAGE_OPERATORS set. If any element contains an unrecognized stage key, such as the undocumented MongoDB-internal $_internalInhibitOptimization, the sanitizer misclassifies the entire branch as a generic array and skips stage-level stripping for all sibling stages. This allows a non-admin user with DBViewer read permission to inject forbidden operators like $lookup inside $facet sub-pipelines, performing cross-collection joins into restricted collections. This leads to unauthorized read access to sensitive data including password-reset tokens (prid), enabling account takeover.
Severity
7.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-09-10 13:16 UTC
CWE
- CWE-863 - Countly DBViewer authorization bypass via nested aggregation stage poisoning
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Countly | countly-server |
Affected:
0 , < 25.03.53-LTS
(semver)
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-87803",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-09-10T13:16:57.956270Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T13:17:16.963Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "countly-server",
"vendor": "Countly",
"versions": [
{
"lessThan": "25.03.53-LTS",
"status": "affected",
"version": "0",
"versionType": "semver"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Catalin Iovita (Snyk Security Research)"
}
],
"descriptions": [
{
"lang": "en",
"value": "An authorization bypass vulnerability exists in the Countly Server DBViewer due to flawed sub-pipeline detection in the aggregation stage sanitizer. The /o/db aggregation endpoint parses user-controlled aggregation JSON and passes it through a stage sanitizer that determines whether a nested array is a sub-pipeline by checking if every element contains a key present in a hardcoded KNOWN_STAGE_OPERATORS set. If any element contains an unrecognized stage key, such as the undocumented MongoDB-internal $_internalInhibitOptimization, the sanitizer misclassifies the entire branch as a generic array and skips stage-level stripping for all sibling stages. This allows a non-admin user with DBViewer read permission to inject forbidden operators like $lookup inside $facet sub-pipelines, performing cross-collection joins into restricted collections. This leads to unauthorized read access to sensitive data including password-reset tokens (prid), enabling account takeover."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"exploitCodeMaturity": "NOT_DEFINED",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"cvssV4_0": {
"attackComplexity": "LOW",
"attackRequirements": "NONE",
"attackVector": "NETWORK",
"baseScore": 7.1,
"baseSeverity": "HIGH",
"exploitMaturity": "NOT_DEFINED",
"privilegesRequired": "LOW",
"subAvailabilityImpact": "NONE",
"subConfidentialityImpact": "NONE",
"subIntegrityImpact": "NONE",
"userInteraction": "NONE",
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"version": "4.0",
"vulnAvailabilityImpact": "NONE",
"vulnConfidentialityImpact": "HIGH",
"vulnIntegrityImpact": "LOW"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-863",
"description": "Countly DBViewer authorization bypass via nested aggregation stage poisoning",
"lang": "en"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-09-10T12:00:48.815Z",
"orgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"shortName": "snyk"
},
"references": [
{
"url": "https://github.com/Countly/countly-server/pull/7868"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "bae035ff-b466-4ff4-94d0-fc9efd9e1730",
"assignerShortName": "snyk",
"cveId": "CVE-2026-87803",
"datePublished": "2026-09-10T09:54:01.912Z",
"dateReserved": "2026-09-09T10:11:56.597Z",
"dateUpdated": "2026-09-10T13:17:16.963Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
CVE-2021-32852 (GCVE-0-2021-32852)
Vulnerability from cvelistv5 – Published: 2023-02-20 00:00 – Updated: 2025-03-10 21:09
VLAI
EPSS
VEX
Title
countly-server vulnerable to Cross-site Scripting
Summary
Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edition. The victim must follow a malicious link or be redirected there from malicious web site. The attacker must have an account or be able to create one. This issue is patched in version 21.11.
Severity
5.4 (Medium)
SSVC
Exploitation: poc
Automatable: no
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-03-10 21:00 UTC
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Countly | countly-server |
Affected:
21.11 , < 21.11
(custom)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T23:33:56.093Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://securitylab.github.com/advisories/GHSL-2021-104-countly-server/"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Countly/countly-server/releases/tag/v21.11"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/views/reset.html#L95"
},
{
"tags": [
"x_transferred"
],
"url": "https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/app.js#L1112"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2021-32852",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-03-10T21:00:32.376074Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-03-10T21:09:07.859Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "countly-server",
"vendor": "Countly",
"versions": [
{
"lessThan": "21.11",
"status": "affected",
"version": "21.11",
"versionType": "custom"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Countly, a product analytics solution, is vulnerable to cross-site scripting prior to version 21.11 of the community edition. The victim must follow a malicious link or be redirected there from malicious web site. The attacker must have an account or be able to create one. This issue is patched in version 21.11."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "LOW",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-02-20T00:00:00.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"url": "https://securitylab.github.com/advisories/GHSL-2021-104-countly-server/"
},
{
"url": "https://github.com/Countly/countly-server/releases/tag/v21.11"
},
{
"url": "https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/views/reset.html#L95"
},
{
"url": "https://github.com/Countly/countly-server/blob/6b90bb775e747cabe46fe197c6a6989acc6c3417/frontend/express/app.js#L1112"
}
],
"source": {
"advisory": "GHSL-2021-104",
"defect": [
"GHSL-2021-104"
],
"discovery": "UNKNOWN"
},
"title": "countly-server vulnerable to Cross-site Scripting",
"x_generator": {
"engine": "Vulnogram 0.0.9"
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2021-32852",
"datePublished": "2023-02-20T00:00:00.000Z",
"dateReserved": "2021-05-12T00:00:00.000Z",
"dateUpdated": "2025-03-10T21:09:07.859Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-29174 (GCVE-0-2022-29174)
Vulnerability from cvelistv5 – Published: 2022-05-17 20:45 – Updated: 2025-04-23 18:25
VLAI
EPSS
VEX
Title
Predictable password reset token may lead to account takeover in countly-server
Summary
countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface.
Severity
8.1 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2025-04-23 15:53 UTC
CWE
- CWE-640 - Weak Password Recovery Mechanism for Forgotten Password
Assigner
References
2 references
| URL | Tags |
|---|---|
| https://github.com/Countly/countly-server/securit… | x_refsource_CONFIRM |
| https://github.com/Countly/countly-server/commit/… | x_refsource_MISC |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| Countly | countly-server |
Affected:
< 21.11.4
Affected: >= 22.0.0, < 22.03.7 |
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T06:17:53.998Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2022-29174",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-04-23T15:53:12.624160Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-04-23T18:25:30.812Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"product": "countly-server",
"vendor": "Countly",
"versions": [
{
"status": "affected",
"version": "\u003c 21.11.4"
},
{
"status": "affected",
"version": "\u003e= 22.0.0, \u003c 22.03.7"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-640",
"description": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-05-17T20:45:10.000Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999"
}
],
"source": {
"advisory": "GHSA-98vh-wqw5-p23v",
"discovery": "UNKNOWN"
},
"title": "Predictable password reset token may lead to account takeover in countly-server",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "security-advisories@github.com",
"ID": "CVE-2022-29174",
"STATE": "PUBLIC",
"TITLE": "Predictable password reset token may lead to account takeover in countly-server"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "countly-server",
"version": {
"version_data": [
{
"version_value": "\u003c 21.11.4"
},
{
"version_value": "\u003e= 22.0.0, \u003c 22.03.7"
}
]
}
}
]
},
"vendor_name": "Countly"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "countly-server is the server-side part of Countly, a product analytics solution. Prior to versions 22.03.7 and 21.11.4, a malicious actor who knows an account email address/username and full name specified in the database is capable of guessing the password reset token. The actor may use this information to reset the password and take over the account. The problem has been patched in Countly Server version 22.03.7 for servers using the new user interface and in 21.11.4 for servers using the old user interface."
}
]
},
"impact": {
"cvss": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 8.1,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
}
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-640: Weak Password Recovery Mechanism for Forgotten Password"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v",
"refsource": "CONFIRM",
"url": "https://github.com/Countly/countly-server/security/advisories/GHSA-98vh-wqw5-p23v"
},
{
"name": "https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999",
"refsource": "MISC",
"url": "https://github.com/Countly/countly-server/commit/2bfa1ee1fa46e9bb007cf8687ad197ab9c604999"
}
]
},
"source": {
"advisory": "GHSA-98vh-wqw5-p23v",
"discovery": "UNKNOWN"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2022-29174",
"datePublished": "2022-05-17T20:45:10.000Z",
"dateReserved": "2022-04-13T00:00:00.000Z",
"dateUpdated": "2025-04-23T18:25:30.812Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}