CWE-863
Allowed-with-ReviewIncorrect Authorization
Abstraction: Class · Status: Incomplete
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.
5839 vulnerabilities reference this CWE, most recent first.
GHSA-6WC4-XC3F-782R
Vulnerability from github – Published: 2023-07-17 18:31 – Updated: 2024-04-04 06:10Mattermost fails to disable public Boards after the "Enable Publicly-Shared Boards" configuration option is disabled, resulting in previously-shared public Boards to remain accessible.
{
"affected": [],
"aliases": [
"CVE-2023-3586"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-07-17T16:15:10Z",
"severity": "MODERATE"
},
"details": "Mattermost fails to disable\u00a0public Boards after the \"Enable Publicly-Shared Boards\" configuration option is disabled, resulting in\u00a0previously-shared\u00a0public Boards to remain accessible.\n\n",
"id": "GHSA-6wc4-xc3f-782r",
"modified": "2024-04-04T06:10:53Z",
"published": "2023-07-17T18:31:28Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-3586"
},
{
"type": "WEB",
"url": "https://mattermost.com/security-updates"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6WHF-Q6P5-84WG
Vulnerability from github – Published: 2021-09-29 17:16 – Updated: 2021-10-06 13:23Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user's system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.
{
"affected": [
{
"package": {
"ecosystem": "Packagist",
"name": "web-auth/webauthn-framework"
},
"ranges": [
{
"events": [
{
"introduced": "3.3.0"
},
{
"fixed": "3.3.4"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2021-38299"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2021-09-28T21:04:00Z",
"nvd_published_at": "2021-09-27T06:15:00Z",
"severity": "CRITICAL"
},
"details": "Webauthn Framework 3.3.x before 3.3.4 has Incorrect Access Control. An attacker that controls a user\u0027s system is able to login to a vulnerable service using an attached FIDO2 authenticator without passing a check of the user presence.",
"id": "GHSA-6whf-q6p5-84wg",
"modified": "2021-10-06T13:23:34Z",
"published": "2021-09-29T17:16:07Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-38299"
},
{
"type": "WEB",
"url": "https://github.com/web-auth/webauthn-framework/commit/572e239c5702667ca52487faf861abc768a46308"
},
{
"type": "PACKAGE",
"url": "https://github.com/web-auth/webauthn-framework"
},
{
"type": "WEB",
"url": "https://github.com/web-auth/webauthn-framework/releases"
},
{
"type": "WEB",
"url": "https://github.com/web-auth/webauthn-framework/releases/tag/v3.3.4"
},
{
"type": "WEB",
"url": "https://www.fzi.de/en/news/news/detail-en/artikel/fsa-2021-1-fehlende-ueberpruefung-von-user-presence-in-webauthn-framework"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Improper Access Control in Webauthn Framework"
}
GHSA-6WQF-WQM3-95WM
Vulnerability from github – Published: 2022-05-24 16:53 – Updated: 2024-04-04 01:36An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExtension of newAbsolutePath but not oldAbsolutePath. By leveraging this vulnerability, an adversary can make an inaccessible file be available (the credential of the app, for instance).
{
"affected": [],
"aliases": [
"CVE-2019-14924"
],
"database_specific": {
"cwe_ids": [
"CWE-200",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-08-10T19:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in GCDWebServer before 3.5.3. The method moveItem in the GCDWebUploader class checks the FileExtension of newAbsolutePath but not oldAbsolutePath. By leveraging this vulnerability, an adversary can make an inaccessible file be available (the credential of the app, for instance).",
"id": "GHSA-6wqf-wqm3-95wm",
"modified": "2024-04-04T01:36:33Z",
"published": "2022-05-24T16:53:05Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-14924"
},
{
"type": "WEB",
"url": "https://github.com/swisspol/GCDWebServer/issues/433"
},
{
"type": "WEB",
"url": "https://github.com/swisspol/GCDWebServer/commit/02738433bf2e1b820ef48f04edd15df304081802"
},
{
"type": "WEB",
"url": "https://github.com/swisspol/GCDWebServer/compare/3.5.2...3.5.3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6WQW-VHFR-9999
Vulnerability from github – Published: 2026-07-01 20:20 – Updated: 2026-07-01 20:20A record user could read records the table's SELECT permission expression should have hidden, when that expression referenced $value, $before, $after, or $event. Binding a chosen value to that name before registering a LIVE SELECT caused notifications to evaluate the permission against the attacker's input instead of the real document.
Impact
A record user binds a value to $value, $before, $after, or $event (e.g. LET $value = [$auth.id]) and registers LIVE SELECT * FROM person. The captured value shadows the real document at notification time, so a SELECT permission like WHERE $auth.id.id() IN $value passes for every record on the table — the subscriber receives notifications for records they should not see.
Read-only impact, bounded to one table. Permission expressions that reference only field names, $auth, or $session are unaffected.
Patches
A patch has been introduced that re-orders the LIVE notification parameter binding so captured user variables are added first and the trusted document-context and session parameters are added last.
- Versions 3.1.0 and later are not affected by this issue.
Workarounds
Affected users who are unable to update should avoid table-PERMISSIONS and LIVE WHERE expressions that read user-named variables ($value, $before, $after, $event) without also gating on a system-derived field such as the record id.
{
"affected": [
{
"package": {
"ecosystem": "crates.io",
"name": "surrealdb"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "3.1.0"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-07-01T20:20:00Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "A record user could read records the table\u0027s SELECT permission expression should have hidden, when that expression referenced `$value`, `$before`, `$after`, or `$event`. Binding a chosen value to that name before registering a `LIVE SELECT` caused notifications to evaluate the permission against the attacker\u0027s input instead of the real document.\n\n### Impact\n\nA record user binds a value to `$value`, `$before`, `$after`, or `$event` (e.g. `LET $value = [$auth.id]`) and registers `LIVE SELECT * FROM person`. The captured value shadows the real document at notification time, so a SELECT permission like `WHERE $auth.id.id() IN $value` passes for every record on the table \u2014 the subscriber receives notifications for records they should not see.\n\nRead-only impact, bounded to one table. Permission expressions that reference only field names, `$auth`, or `$session` are unaffected.\n\n### Patches\n\nA patch has been introduced that re-orders the LIVE notification parameter binding so captured user variables are added first and the trusted document-context and session parameters are added last.\n\n- Versions 3.1.0 and later are not affected by this issue.\n\n### Workarounds\n\nAffected users who are unable to update should avoid table-`PERMISSIONS` and LIVE `WHERE` expressions that read user-named variables (`$value`, `$before`, `$after`, `$event`) without also gating on a system-derived field such as the record id.",
"id": "GHSA-6wqw-vhfr-9999",
"modified": "2026-07-01T20:20:00Z",
"published": "2026-07-01T20:20:00Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/security/advisories/GHSA-6wqw-vhfr-9999"
},
{
"type": "WEB",
"url": "https://github.com/surrealdb/surrealdb/commit/6bcc55c9c0494a0d4d36821019b54459f7162af7"
},
{
"type": "WEB",
"url": "https://github.com/orgs/surrealdb/discussions/101"
},
{
"type": "PACKAGE",
"url": "https://github.com/surrealdb/surrealdb"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
],
"summary": "SurrealDB: Authenticated subscribers can read records hidden by SELECT permissions via LIVE subscriptions"
}
GHSA-6WRF-F8CG-6RH5
Vulnerability from github – Published: 2025-12-28 06:31 – Updated: 2025-12-28 06:31A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of the argument deptId results in improper authorization. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.
{
"affected": [],
"aliases": [
"CVE-2025-15119"
],
"database_specific": {
"cwe_ids": [
"CWE-266",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2025-12-28T04:16:04Z",
"severity": "LOW"
},
"details": "A vulnerability was detected in JeecgBoot up to 3.9.0. This issue affects the function queryPageList of the file /sys/sysDepartRole/list. The manipulation of the argument deptId results in improper authorization. The attack can be executed remotely. A high complexity level is associated with this attack. The exploitability is assessed as difficult. The exploit is now public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.",
"id": "GHSA-6wrf-f8cg-6rh5",
"modified": "2025-12-28T06:31:31Z",
"published": "2025-12-28T06:31:31Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-15119"
},
{
"type": "WEB",
"url": "https://github.com/Hwwg/cve/issues/32"
},
{
"type": "WEB",
"url": "https://vuldb.com/?ctiid.338497"
},
{
"type": "WEB",
"url": "https://vuldb.com/?id.338497"
},
{
"type": "WEB",
"url": "https://vuldb.com/?submit.711771"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
},
{
"score": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"type": "CVSS_V4"
}
]
}
GHSA-6WW5-4467-WVXF
Vulnerability from github – Published: 2022-05-24 19:20 – Updated: 2022-07-13 00:01Windows Hello Security Feature Bypass Vulnerability
{
"affected": [],
"aliases": [
"CVE-2021-42288"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-10T01:19:00Z",
"severity": "MODERATE"
},
"details": "Windows Hello Security Feature Bypass Vulnerability",
"id": "GHSA-6ww5-4467-wvxf",
"modified": "2022-07-13T00:01:42Z",
"published": "2022-05-24T19:20:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-42288"
},
{
"type": "WEB",
"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42288"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6WWJ-CRCH-J32J
Vulnerability from github – Published: 2022-04-12 00:00 – Updated: 2022-04-20 00:00Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALL_PHONE permission.
{
"affected": [],
"aliases": [
"CVE-2022-28777"
],
"database_specific": {
"cwe_ids": [
"CWE-284",
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-04-11T20:15:00Z",
"severity": "LOW"
},
"details": "Improper access control vulnerability in Samsung Members prior to version 13.6.08.5 allows local attacker to execute call function without CALL_PHONE permission.",
"id": "GHSA-6wwj-crch-j32j",
"modified": "2022-04-20T00:00:57Z",
"published": "2022-04-12T00:00:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28777"
},
{
"type": "WEB",
"url": "https://security.samsungmobile.com/serviceWeb.smsb?year=2022\u0026month=4"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-6X2M-HQFW-HVPJ
Vulnerability from github – Published: 2026-03-02 22:29 – Updated: 2026-03-02 22:29Summary
exec.approval requests for host=node were not explicitly bound to the target nodeId, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet.
Impact
An operator approval for a system.run request could be reused across nodes if the request payload did not carry node identity through approval and execution checks.
Affected Packages / Versions
- Package:
openclaw(npm) - Affected:
<= 2026.2.22-2 - Fixed:
2026.2.23(released)
Mitigation
Upgrade to 2026.2.23 or later once published.
Fix Details
The fix requires and persists nodeId for host=node approval requests and rejects execution when the approving node binding does not match the invoking node.
Fix Commit(s)
- 4a3f8438e527ac371a67fe7ac68a287f0dbe6063
Release Process Note
patched_versions is pre-set to the released version (2026.2.23). This advisory now reflects released fix version 2026.2.23.
OpenClaw thanks @tdjackey for reporting.
{
"affected": [
{
"package": {
"ecosystem": "npm",
"name": "openclaw"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2026.2.23"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-02T22:29:45Z",
"nvd_published_at": null,
"severity": "MODERATE"
},
"details": "## Summary\n`exec.approval` requests for `host=node` were not explicitly bound to the target `nodeId`, so an approval intended for one node could be replayed for a different node under the same operator-controlled gateway fleet.\n\n## Impact\nAn operator approval for a `system.run` request could be reused across nodes if the request payload did not carry node identity through approval and execution checks.\n\n## Affected Packages / Versions\n- Package: `openclaw` (npm)\n- Affected: `\u003c= 2026.2.22-2`\n- Fixed: `2026.2.23` (released)\n\n## Mitigation\nUpgrade to `2026.2.23` or later once published.\n\n## Fix Details\nThe fix requires and persists `nodeId` for `host=node` approval requests and rejects execution when the approving node binding does not match the invoking node.\n\n## Fix Commit(s)\n- 4a3f8438e527ac371a67fe7ac68a287f0dbe6063\n\n## Release Process Note\n`patched_versions` is pre-set to the released version (`2026.2.23`). This advisory now reflects released fix version `2026.2.23`.\n\nOpenClaw thanks @tdjackey for reporting.",
"id": "GHSA-6x2m-hqfw-hvpj",
"modified": "2026-03-02T22:29:45Z",
"published": "2026-03-02T22:29:45Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/security/advisories/GHSA-6x2m-hqfw-hvpj"
},
{
"type": "WEB",
"url": "https://github.com/openclaw/openclaw/commit/4a3f8438e527ac371a67fe7ac68a287f0dbe6063"
},
{
"type": "PACKAGE",
"url": "https://github.com/openclaw/openclaw"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:L/SA:N",
"type": "CVSS_V4"
}
],
"summary": "OpenClaw: Node exec approvals could be replayed across nodes"
}
GHSA-6X33-FGPV-F89F
Vulnerability from github – Published: 2022-05-24 19:21 – Updated: 2022-07-13 00:00Improper access control in some Intel(R) Thunderbolt(TM) Windows DCH Drivers before version 1.41.1054.0 may allow unauthenticated user to potentially enable denial of service via local access.
{
"affected": [],
"aliases": [
"CVE-2021-0110"
],
"database_specific": {
"cwe_ids": [
"CWE-863"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-11-17T20:15:00Z",
"severity": "MODERATE"
},
"details": "Improper access control in some Intel(R) Thunderbolt(TM) Windows DCH Drivers before version 1.41.1054.0 may allow unauthenticated user to potentially enable denial of service via local access.",
"id": "GHSA-6x33-fgpv-f89f",
"modified": "2022-07-13T00:00:54Z",
"published": "2022-05-24T19:21:00Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-0110"
},
{
"type": "WEB",
"url": "https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-00533.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-6X34-89P7-95WG
Vulnerability from github – Published: 2026-03-03 14:50 – Updated: 2026-03-03 14:50Impact
An issue was discovered in Rancher versions up to and including 2.5.15 and 2.6.6 where a flaw with authorization logic allows privilege escalation through cluster role template binding (CRTB) and project role template binding (PRTB). This issue does not affect the local cluster, it affects only downstream clusters.
The vulnerability can be exploited by any user who has permissions to create/edit cluster role template bindings or project role template bindings (such as cluster-owner, manage cluster members, project-owner and manage project members) to gain owner permission in another project in the same cluster or in another project on a different downstream cluster.
-
The user must have
kubectlaccess in the local cluster to exploit this scenario. -
This can only be abused to gain
cluster-ownerpermission on a different downstream cluster if the user is alreadycluster-owneron at least one downstream cluster. -
Example of a modified CRTB (note: the
clusterNamepoints to the cluster ID of the cluster that the privileges will be escalated andnamespacepoints to the current cluster ID that the user has permissions):
kubectl edit clusterroletemplatebindings crtb-<crtb-ID> -n c-<cluster-ID>
---
apiVersion: management.cattle.io/v3
clusterName: <ID-of-the-cluster-to-escalate>
kind: ClusterRoleTemplateBinding
metadata:
annotations:
<omitted>
finalizers:
- <omitted>
generateName: crtb-
labels:
<omitted>
cattle.io/creator: norman
name: crtb-<crtb-ID>
namespace: c-<current-cluster-ID>
roleTemplateName: cluster-owner
userName: u-<user-ID>
userPrincipalName: local://u-<user-ID>
An artifact to flag the exploitation of this issue is that the namespace of the CRTB/PRTB will not match the cluster name (clusterName) of the CRTB/PRTB. For example, every CRTB in the c-123xyz namespace should have a cluster name of c-123xyz. If instead, the cluster name is c-abc567, for example, this is likely a result of a user exploiting this flaw.
For more information about cluster and project roles, please consult Rancher's documentation.
Patches
Patched versions include releases 2.5.16, 2.6.7 and later versions.
Workarounds
Limit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.
Important:
- It is highly advised to check the local and downstream clusters for potential unrecognized CRTBs (kubectl get clusterroletemplatebindings -A) and PRTBs (kubectl get projectroletemplatebindings -A) assignments.
- The ability to add other users to projects and clusters is a highly-privileged permission which may result in users being able to operate beyond their explicitly specified RBAC. It is recommended that this permission be granted selectively.
The following script can be used as a helper to detect possible deviations of CRTBs and PRTBs that do not match the expected value. Further investigation is required to determine if the flagged objects were maliciously modified or not. The script requires kubectl access to the local cluster and the jq command.
#!/usr/bin/env bash
echo "CRTBs that don't match cluster:"
kubectl get clusterroletemplatebindings -A -o=jsonpath="{range .items[?(@.clusterName!=@.metadata.namespace)]}{.metadata.name}{'\n'}{end}"
echo "PRTBs that don't match project:"
kubectl get projectroletemplatebindings -A -ojson | jq -r '.items[]|.metadata as $m|select(.projectName|endswith($m.namespace)|not)|.metadata.name'
For more information
If you have any questions or comments about this advisory:
- Reach out to SUSE Rancher Security team for security related inquiries.
- Open an issue in Rancher repository.
- Verify our support matrix and product support lifecycle.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.5.15"
},
"package": {
"ecosystem": "Go",
"name": "github.com/rancher/rancher"
},
"ranges": [
{
"events": [
{
"introduced": "2.5.0"
},
{
"fixed": "2.5.16"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 2.6.6"
},
"package": {
"ecosystem": "Go",
"name": "github.com/rancher/rancher"
},
"ranges": [
{
"events": [
{
"introduced": "2.6.0"
},
{
"fixed": "2.6.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2022-31247"
],
"database_specific": {
"cwe_ids": [
"CWE-285",
"CWE-863"
],
"github_reviewed": true,
"github_reviewed_at": "2026-03-03T14:50:12Z",
"nvd_published_at": "2022-09-07T09:15:00Z",
"severity": "CRITICAL"
},
"details": "### Impact\n\nAn issue was discovered in Rancher versions up to and including 2.5.15 and 2.6.6 where a flaw with authorization logic allows privilege escalation through cluster role template binding (CRTB) and project role template binding (PRTB). This issue does not affect the local cluster, it affects only downstream clusters.\n\nThe vulnerability can be exploited by any user who has permissions to create/edit cluster role template bindings or project role template bindings (such as `cluster-owner`, `manage cluster members`, `project-owner` and `manage project members`) to gain `owner` permission in another project in the same cluster or in another project on a different downstream cluster.\n\n - The user must have `kubectl` access in the local cluster to exploit this scenario.\n\n - This can only be abused to gain `cluster-owner` permission on a different downstream cluster if the user is already `cluster-owner` on at least one downstream cluster.\n\n - Example of a modified CRTB (note: the `clusterName` points to the cluster ID of the cluster that the privileges will be escalated and `namespace` points to the current cluster ID that the user has permissions):\n```\nkubectl edit clusterroletemplatebindings crtb-\u003ccrtb-ID\u003e -n c-\u003ccluster-ID\u003e\n---\napiVersion: management.cattle.io/v3\nclusterName: \u003cID-of-the-cluster-to-escalate\u003e\nkind: ClusterRoleTemplateBinding\nmetadata:\n annotations:\n \u003comitted\u003e \n finalizers:\n - \u003comitted\u003e \n generateName: crtb-\n labels:\n \u003comitted\u003e \n cattle.io/creator: norman\n name: crtb-\u003ccrtb-ID\u003e\n namespace: c-\u003ccurrent-cluster-ID\u003e\nroleTemplateName: cluster-owner\nuserName: u-\u003cuser-ID\u003e\nuserPrincipalName: local://u-\u003cuser-ID\u003e\n```\n\nAn artifact to flag the exploitation of this issue is that the `namespace` of the CRTB/PRTB will not match the cluster name (`clusterName`) of the CRTB/PRTB. For example, every CRTB in the `c-123xyz` namespace should have a cluster name of `c-123xyz`. If instead, the cluster name is `c-abc567`, for example, this is likely a result of a user exploiting this flaw.\n\nFor more information about cluster and project roles, please consult Rancher\u0027s [documentation](https://rancher.com/docs/rancher/v2.6/en/admin-settings/rbac/cluster-project-roles/).\n\n### Patches\n\nPatched versions include releases 2.5.16, 2.6.7 and later versions.\n\n### Workarounds\n\nLimit access in Rancher to trusted users. There is not a direct mitigation besides upgrading to the patched Rancher versions.\n\n**Important:**\n- It is highly advised to check the local and downstream clusters for potential unrecognized CRTBs (`kubectl get clusterroletemplatebindings -A`) and PRTBs (`kubectl get projectroletemplatebindings -A`) assignments.\n- The ability to add other users to projects and clusters is a highly-privileged permission which may result in users being able to operate beyond their explicitly specified RBAC. It is recommended that this permission be granted selectively.\n\nThe following script can be used as a helper to detect possible deviations of CRTBs and PRTBs that do not match the expected value. Further investigation is required to determine if the flagged objects were maliciously modified or not. The script requires `kubectl` access to the `local` cluster and the `jq` command.\n\n```shell\n#!/usr/bin/env bash\n\necho \"CRTBs that don\u0027t match cluster:\"\nkubectl get clusterroletemplatebindings -A -o=jsonpath=\"{range .items[?(@.clusterName!=@.metadata.namespace)]}{.metadata.name}{\u0027\\n\u0027}{end}\"\n\necho \"PRTBs that don\u0027t match project:\"\nkubectl get projectroletemplatebindings -A -ojson | jq -r \u0027.items[]|.metadata as $m|select(.projectName|endswith($m.namespace)|not)|.metadata.name\u0027\n```\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Reach out to [SUSE Rancher Security team](https://github.com/rancher/rancher/security/policy) for security related inquiries.\n* Open an issue in [Rancher](https://github.com/rancher/rancher/issues/new/choose) repository.\n* Verify our [support matrix](https://www.suse.com/suse-rancher/support-matrix/all-supported-versions/) and [product support lifecycle](https://www.suse.com/lifecycle/).",
"id": "GHSA-6x34-89p7-95wg",
"modified": "2026-03-03T14:50:12Z",
"published": "2026-03-03T14:50:12Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/rancher/rancher/security/advisories/GHSA-6x34-89p7-95wg"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-31247"
},
{
"type": "WEB",
"url": "https://bugzilla.suse.com/show_bug.cgi?id=1199730"
},
{
"type": "PACKAGE",
"url": "https://github.com/rancher/rancher"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"type": "CVSS_V3"
}
],
"summary": "Rancher has downstream cluster privilege escalation through cluster and project role template binding (CRTB/PRTB)"
}
Mitigation
- Divide the product into anonymous, normal, privileged, and administrative areas. Reduce the attack surface by carefully mapping roles with data and functionality. Use role-based access control (RBAC) [REF-229] to enforce the roles at the appropriate boundaries.
- Note that this approach may not protect against horizontal authorization, i.e., it will not protect a user from attacking others with the same role.
Mitigation
Ensure that access control checks are performed related to the business logic. These checks may be different than the access control checks that are applied to more generic resources such as files, connections, processes, memory, and database records. For example, a database may restrict access for medical records to a specific database user, but each record might only be intended to be accessible to the patient and the patient's doctor [REF-7].
Mitigation MIT-4.4
Strategy: Libraries or Frameworks
- Use a vetted library or framework that does not allow this weakness to occur or provides constructs that make this weakness easier to avoid.
- For example, consider using authorization frameworks such as the JAAS Authorization Framework [REF-233] and the OWASP ESAPI Access Control feature [REF-45].
Mitigation
- For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.
- One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.
Mitigation
Use the access control capabilities of your operating system and server environment and define your access control lists accordingly. Use a "default deny" policy when defining these ACLs.
No CAPEC attack patterns related to this CWE.