CVE-2024-37905

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-37905
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-37905.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-37905
Aliases
Published
2024-06-28T17:09:24.090Z
Modified
2026-04-17T04:56:51.990184258Z
Severity
  • 8.8 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
Improper Access Control and Incorrect Authorization in github.com/goauthentik/authentik
Details

authentik is an open-source Identity Provider that emphasizes flexibility and versatility. Authentik API-Access-Token mechanism can be exploited to gain admin user privileges. A successful exploit of the issue will result in a user gaining full admin access to the Authentik application, including resetting user passwords and more. This issue has been patched in version(s) 2024.2.4, 2024.4.2 and 2024.6.0.

Database specific 
{
    "cwe_ids": [
        "CWE-284",
        "CWE-863"
    ],
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/37xxx/CVE-2024-37905.json"
}
References

Affected packages

Git / github.com/goauthentik/authentik

Affected ranges

Type
GIT
Repo
https://github.com/goauthentik/authentik
Events
Introduced
afa4234036c5385c80bfcaabef000df0968e73f2
Fixed
1c03cfa906f662b4daffe461ca16c2b3c4b1d79d

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-37905.json"