Common Weakness Enumeration
CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5686 vulnerabilities reference this CWE, most recent first.
GHSA-H5HG-H7RR-GPF3
Vulnerability from github – Published: 2026-04-03 03:18 – Updated: 2026-04-06 19:42
VLAI
Summary
OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection
Details
Summary
Node browser proxy allowProfiles bypass through persistent profile mutation and runtime profile selection
Current Maintainer Triage
- Status: open
- Normalized severity: high
- Assessment: Real released allowProfiles bypass through profile mutation and runtime profile selection, fixed and shipped in v2026.3.22+, so keep open for publish rather than close.
Affected Packages / Versions
- Package:
openclaw(npm) - Latest published npm version:
2026.3.31 - Vulnerable version range:
<=2026.3.13-1 - Patched versions:
>= 2026.3.22 - First stable tag containing the fix:
v2026.3.22
Fix Commit(s)
eac93507c36ccd0c359fba18fa466ef6448be8a5— 2026-03-23T00:56:44-07:00
Release Process Note
- The fix is already present in released version
2026.3.22. - This draft looks ready for final maintainer disposition or publication, not additional code-fix work.
Thanks @smaeljaish771 for reporting.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2026.3.13-1"
},
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.3.22"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-03T03:18:10Z",
"nvd_published_at": null,
"severity": "HIGH"
},
"details": "## Summary\nNode browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection\n\n## Current Maintainer Triage\n- Status: open\n- Normalized severity: high\n- Assessment: Real released allowProfiles bypass through profile mutation and runtime profile selection, fixed and shipped in v2026.3.22+, so keep open for publish rather than close.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Latest published npm version: `2026.3.31`\n- Vulnerable version range: `\u003c=2026.3.13-1`\n- Patched versions: `\u003e= 2026.3.22`\n- First stable tag containing the fix: `v2026.3.22`\n\n## Fix Commit(s)\n- `eac93507c36ccd0c359fba18fa466ef6448be8a5` \u2014 2026-03-23T00:56:44-07:00\n\n## Release Process Note\n- The fix is already present in released version `2026.3.22`.\n- This draft looks ready for final maintainer disposition or publication, not additional code-fix work.\n\nThanks @smaeljaish771 for reporting.",
"id": "GHSA-h5hg-h7rr-gpf3",
"modified": "2026-04-06T19:42:23Z",
"published": "2026-04-03T03:18:10Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-h5hg-h7rr-gpf3"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/eac93507c36ccd0c359fba18fa466ef6448be8a5"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Node browser proxy `allowProfiles` bypass through persistent profile mutation and runtime profile selection"
}
GHSA-H5JH-RP76-Q242
Vulnerability from github – Published: 2025-01-29 15:31 – Updated: 2025-02-06 19:54
VLAI
Summary
RuoYi has insecure permissions
Details
Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles.
Severity
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "com.ruoyi:ruoyi"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"last_affected": "4.8.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2024-57438"
],
"database_specific": {
"cwe_ids": [
"CWE-276",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-01-29T19:20:33Z",
"nvd_published_at": "2025-01-29T15:15:17Z",
"severity": "MODERATE"
},
"details": "Insecure permissions in RuoYi v4.8.0 allows authenticated attackers to escalate privileges by assigning themselves higher level roles.",
"id": "GHSA-h5jh-rp76-q242",
"modified": "2025-02-06T19:54:08Z",
"published": "2025-01-29T15:31:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-57438"
},
{
"type": "PACKAGE",
"url": "https://gitee.com/y_project/RuoYi"
},
{
"type": "WEB",
"url": "https://github.com/peccc/restful_vul/blob/main/ruoyi_insecure_role_assignments/ruoyi_insecure_role_assignments.md"
},
{
"type": "WEB",
"url": "https://github.com/yangzongzhuan/RuoYi"
},
{
"type": "WEB",
"url": "https://ruoyi.vip"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:P",
"type": "CVSS_V4"
}
],
"summary": "RuoYi has insecure permissions"
}
GHSA-H5RX-J572-XRP9
Vulnerability from github – Published: 2023-07-13 00:30 – Updated: 2024-04-04 06:05
VLAI
Details
In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.
Severity
7.8 (High)
{
"affected": [],
"aliases": [
"CVE-2023-21256"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-13T00:15:24Z",
"severity": "HIGH"
},
"details": "In SettingsHomepageActivity.java, there is a possible way to launch arbitrary activities via Settings due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is needed for exploitation.\n\n",
"id": "GHSA-h5rx-j572-xrp9",
"modified": "2024-04-04T06:05:29Z",
"published": "2023-07-13T00:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21256"
},
{
"type": "WEB",
"url": "https://android.googlesource.com/platform/packages/apps/Settings/+/62fc1d269f5e754fc8f00b6167d79c3933b4c1f4"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2023-07-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H5V5-8746-G7MM
Vulnerability from github – Published: 2026-07-22 23:13 – Updated: 2026-07-22 23:13
VLAI
Summary
JupyterLab PluginManager lock-rule enforcement bypass
Details
JupyterLab's plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected plugins. Two server-side enforcement gaps let an authenticated user bypass those controls with direct requests to /lab/api/plugins.
Impact
Users could workaround the plugin manager lock rules via direct API access for either: - child plugins of extensions covering multiple plugins - when "lock all" was issued by the administrator
The integrity of data can be impacted, and any hardening or restrictions on permitted user actions (e.g. download/upload limits) within the single-user server can be circumvented if those were implemented with plugins that were locked using the faulty mechanisms.
Patches
JupyterLab v4.6.2 and v4.5.10 contain the patch.
Users of applications that depend on JupyterLab, such as Notebook v7+, should update jupyterlab package too.
Workarounds
Manually lock all plugins that should be locked. The core plugin identifiers can be found in the documentation and identifiers for all installed extensions are listed in the Plugin Manager.
Severity
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.6.1"
},
"package": {
"ecosystem": "PyPI",
"name": "jupyterlab"
},
"ranges": [
{
"events": [
{
"introduced": "4.6.0"
},
{
"fixed": "4.6.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.5.9"
},
"package": {
"ecosystem": "PyPI",
"name": "jupyterlab"
},
"ranges": [
{
"events": [
{
"introduced": "4.1.0"
},
{
"fixed": "4.5.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-602",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-22T23:13:34Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "JupyterLab\u0027s plugin manager exposes administrator controls intended to prevent users from enabling or disabling selected plugins. Two server-side enforcement gaps let an authenticated user bypass those controls with direct requests to `/lab/api/plugins`.\n\n### Impact\n\nUsers could workaround the plugin manager lock rules via direct API access for either:\n- child plugins of extensions covering multiple plugins\n- when \"lock all\" was issued by the administrator\n\nThe integrity of data can be impacted, and any hardening or restrictions on permitted user actions (e.g. download/upload limits) within the single-user server can be circumvented if those were implemented with plugins that were locked using the faulty mechanisms.\n\n### Patches\n\nJupyterLab [`v4.6.2`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2) and [`v4.5.10`](https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10) contain the patch.\n\nUsers of applications that depend on JupyterLab, such as Notebook v7+, should update `jupyterlab` package too.\n\n### Workarounds\n\nManually lock all plugins that should be locked. The core plugin identifiers can be found in [the documentation](https://jupyterlab.readthedocs.io/en/latest/extension/extension_points.html#core-plugins) and identifiers for all installed extensions are listed in the [Plugin Manager](https://jupyterlab.readthedocs.io/en/latest/user/extensions.html#managing-plugins-with-plugin-manager).",
"id": "GHSA-h5v5-8746-g7mm",
"modified": "2026-07-22T23:13:34Z",
"published": "2026-07-22T23:13:34Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/security/advisories/GHSA-h5v5-8746-g7mm"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/pull/19184"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/pull/19185"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/pull/19186"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/commit/be9303f5bcd5308eaeae953c5a3c903046682c2c"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/commit/f1beab4a2027af4719d6edc07d52d6cf5a39a432"
},
{
"type": "PACKAGE",
"url": "https://github.com/jupyterlab/jupyterlab"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.5.10"
},
{
"type": "WEB",
"url": "https://github.com/jupyterlab/jupyterlab/releases/tag/v4.6.2"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N",
"type": "CVSS_V4"
}
],
"summary": "JupyterLab PluginManager lock-rule enforcement bypass"
}
GHSA-H5V9-XW2G-7HRQ
Vulnerability from github – Published: 2025-03-21 09:30 – Updated: 2025-03-21 22:37
VLAI
Summary
Mattermost allows members with permission to convert public channels to private and convert private to public
Details
Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8 fail to to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public.
Severity
5.4 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "10.4.0"
},
{
"fixed": "10.4.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "10.3.0"
},
{
"fixed": "10.3.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "9.11.0"
},
{
"fixed": "9.11.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "9.11.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "8.0.0-20250218135018-e644e3c8e393"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-27933"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2025-03-21T22:37:03Z",
"nvd_published_at": "2025-03-21T09:15:13Z",
"severity": "MODERATE"
},
"details": "Mattermost versions 10.4.x \u003c= 10.4.2, 10.3.x \u003c= 10.3.3, 9.11.x \u003c= 9.11.8 fail to to enforce channel conversion restrictions, which allows members with permission to convert public channels to private ones to also convert private ones to public.",
"id": "GHSA-h5v9-xw2g-7hrq",
"modified": "2025-03-21T22:37:04Z",
"published": "2025-03-21T09:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-27933"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mattermost allows members with permission to convert public channels to private and convert private to public"
}
GHSA-H5WH-487C-MRJG
Vulnerability from github – Published: 2022-04-23 00:40 – Updated: 2022-04-23 00:40
VLAI
Details
cups (Common Unix Printing System) 'Listen localhost:631' option not honored correctly which could provide unauthorized access to the system
{
"affected": [],
"aliases": [
"CVE-2012-6094"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-12-20T15:15:00Z",
"severity": "MODERATE"
},
"details": "cups (Common Unix Printing System) \u0027Listen localhost:631\u0027 option not honored correctly which could provide unauthorized access to the system",
"id": "GHSA-h5wh-487c-mrjg",
"modified": "2022-04-23T00:40:25Z",
"published": "2022-04-23T00:40:25Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6094"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/cve-2012-6094"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2012-6094"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=CVE-2012-6094"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82451"
},
{
"type": "WEB",
"url": "https://security-tracker.debian.org/tracker/CVE-2012-6094"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/01/04/5"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/57158"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-H66J-QWJ8-P6M9
Vulnerability from github – Published: 2024-02-02 15:30 – Updated: 2024-02-02 15:30
VLAI
Details
IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 could allow an attacker on the organization's local network to escalate their privileges due to unauthorized API access. IBM X-Force ID: 270267.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2023-47142"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-02T14:15:54Z",
"severity": "HIGH"
},
"details": "IBM Tivoli Application Dependency Discovery Manager 7.3.0.0 through 7.3.0.10 could allow an attacker on the organization\u0027s local network to escalate their privileges due to unauthorized API access. IBM X-Force ID: 270267.",
"id": "GHSA-h66j-qwj8-p6m9",
"modified": "2024-02-02T15:30:28Z",
"published": "2024-02-02T15:30:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-47142"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/270267"
},
{
"type": "WEB",
"url": "https://www.ibm.com/support/pages/node/7105139"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H67H-6HV5-VFG2
Vulnerability from github – Published: 2025-11-26 18:31 – Updated: 2025-12-02 18:30
VLAI
Details
Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend.
Severity
9.8 (Critical)
{
"affected": [],
"aliases": [
"CVE-2025-55469"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-11-26T18:15:48Z",
"severity": "CRITICAL"
},
"details": "Incorrect access control in youlai-boot v2.21.1 allows attackers to escalate privileges and access the Administrator backend.",
"id": "GHSA-h67h-6hv5-vfg2",
"modified": "2025-12-02T18:30:29Z",
"published": "2025-11-26T18:31:04Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-55469"
},
{
"type": "WEB",
"url": "https://gist.github.com/old6ma/d6e19c9efbe28431f4c27c063cc9cbb8"
},
{
"type": "WEB",
"url": "https://gitee.com/youlaiorg/youlai-boot"
},
{
"type": "WEB",
"url": "https://gitee.com/youlaiorg/youlai-boot/issues/ICFCOK"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-H68G-FQF5-WF74
Vulnerability from github – Published: 2022-05-24 17:19 – Updated: 2022-05-24 17:19
VLAI
Details
Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fails to check that a request was submitted by an administrator. Consequently, a normal user can perform actions including, but not limited to, creating/modifying the file store, creating/modifying alerts, creating/modifying users, etc.
{
"affected": [],
"aliases": [
"CVE-2020-11680"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2020-06-04T19:15:00Z",
"severity": "MODERATE"
},
"details": "Castel NextGen DVR v1.0.0 is vulnerable to authorization bypass on all administrator functionality. The application fails to check that a request was submitted by an administrator. Consequently, a normal user can perform actions including, but not limited to, creating/modifying the file store, creating/modifying alerts, creating/modifying users, etc.",
"id": "GHSA-h68g-fqf5-wf74",
"modified": "2022-05-24T17:19:16Z",
"published": "2022-05-24T17:19:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-11680"
},
{
"type": "WEB",
"url": "https://www.securitymetrics.com/blog/attackers-known-unknown-authorization-bypass"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/157954/Castel-NextGen-DVR-1.0.0-Bypass-CSRF-Disclosure.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2020/Jun/8"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-H69V-MVH9-HFRQ
Vulnerability from github – Published: 2023-09-29 12:30 – Updated: 2023-10-03 21:16
VLAI
Summary
Mattermost Incorrect Authorization vulnerability
Details
Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a system/user manager to demote / deactivate another manager
Severity
4.3 (Medium)
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "8.1.0"
},
{
"fixed": "8.1.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"8.1.0"
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost/server/v8"
},
"ranges": [
{
"events": [
{
"introduced": "8.0.0"
},
{
"fixed": "8.0.2"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Go",
"name": "github.com/mattermost/mattermost-server/v6"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "7.8.10"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2023-5194"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2023-09-29T22:05:48Z",
"nvd_published_at": "2023-09-29T10:15:10Z",
"severity": "MODERATE"
},
"details": "Mattermost fails to properly validate permissions when demoting and deactivating a user allowing for a\u00a0system/user manager to demote / deactivate another manager\n\n",
"id": "GHSA-h69v-mvh9-hfrq",
"modified": "2023-10-03T21:16:24Z",
"published": "2023-09-29T12:30:16Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-5194"
},
{
"type": "PACKAGE",
"url": "https://github.com/mattermost/mattermost"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "Mattermost Incorrect Authorization vulnerability"
}
Mitigation
Architecture and Design
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Architecture and Design
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Architecture and Design
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
Architecture and Design
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
System Configuration
Installation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.