CVE-2025-59036

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2025-59036
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59036.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2025-59036
Aliases
Published
2025-09-09T22:06:47Z
Modified
2026-08-12T03:51:32Z
Severity
  • 5.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L CVSS Calculator
Summary
Infrahub allows authentication with deleted and expired API tokens
Details

Infrahub offers a central hub to manage data, templates, and playbooks. Prior to versiond 1.3.9 and 1.4.5, a bug in the authentication logic will cause API tokens that were deleted and/or expired to be considered valid. This means that any API token that is associated with an active user account can authenticate successfully. This issue is fixed in versions 1.3.9 and 1.4.5. As a workaround, users can delete or deactivate the account associated with a deleted API token to prevent that token from authenticating.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-298"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/59xxx/CVE-2025-59036.json"
}
References

Affected packages

Git / github.com/opsmill/infrahub

Affected ranges

Type
GIT
Repo
https://github.com/opsmill/infrahub
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
215185f217e2f754f7c0a0aa4b77e11079a063a1
Introduced
b6be7a4c426b75453bd56bcc005ee7aa7302e689
Fixed
50928dc3c15eebe277f7ad297d0c821d82a2174a
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.3.9"
        },
        {
            "introduced": "1.4.0"
        },
        {
            "fixed": "1.4.5"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

0.*
0.1.0-prototype
0.2.0
0.3.0
0.4.0
0.4.1
0.4.2
0.5.0
0.6.0
0.7.0
0.7.1
0.7.2
0.8.0
0.8.1
0.8.2
0.9.0
0.9.1
infrahub-v0.*
infrahub-v0.10.0
infrahub-v0.10.1
infrahub-v0.11.0
infrahub-v0.11.1
infrahub-v0.11.2
infrahub-v0.12.1
infrahub-v0.13.0
infrahub-v0.14.0
infrahub-v0.14.1
infrahub-v0.14.2
infrahub-v0.15.0
infrahub-v0.15.1
infrahub-v0.15.2
infrahub-v0.15.3
infrahub-v0.16.0
infrahub-v0.16.1
infrahub-v0.16.2
infrahub-v0.16.3
infrahub-v0.16.4
infrahub-v0.9.1
infrahub-v1.*
infrahub-v1.0.0
infrahub-v1.0.1
infrahub-v1.0.10
infrahub-v1.0.2
infrahub-v1.0.3
infrahub-v1.0.4
infrahub-v1.0.5
infrahub-v1.0.6
infrahub-v1.0.7
infrahub-v1.0.8
infrahub-v1.0.9
infrahub-v1.1.0
infrahub-v1.1.1
infrahub-v1.1.2
infrahub-v1.1.3
infrahub-v1.1.4
infrahub-v1.1.5
infrahub-v1.1.6
infrahub-v1.1.7
infrahub-v1.1.8
infrahub-v1.1.9
infrahub-v1.2.0
infrahub-v1.2.1
infrahub-v1.2.10
infrahub-v1.2.11
infrahub-v1.2.12
infrahub-v1.2.2
infrahub-v1.2.3
infrahub-v1.2.4
infrahub-v1.2.5
infrahub-v1.2.6
infrahub-v1.2.7
infrahub-v1.2.8
infrahub-v1.2.9
infrahub-v1.2.9rc0
infrahub-v1.3.0
infrahub-v1.3.1
infrahub-v1.3.2
infrahub-v1.3.3
infrahub-v1.3.4
infrahub-v1.3.5
infrahub-v1.3.6
infrahub-v1.3.7
infrahub-v1.3.8
infrahub-v1.4.0
infrahub-v1.4.1
infrahub-v1.4.2
infrahub-v1.4.3
infrahub-v1.4.4
python-sdk-v0.*
python-sdk-v0.10.0
python-sdk-v0.10.1
python-sdk-v0.11.1
python-sdk-v0.12.0
python-sdk-v0.12.1
python-sdk-v0.12.2
python-sdk-v0.12.3
python-sdk-v0.12.4
python-sdk-v0.13.0

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2025-59036.json"