CVE-2026-44884

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-44884

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44884.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-44884

Aliases

Published

2026-05-28T20:58:36.516Z

Modified

2026-07-08T08:13:29.624016151Z

Severity

6.0 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Portainer: Missing authorization on custom template file endpoint exposes template content

Details

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8 and 2.39.1, a missing authorization vulnerability in the Custom Template file endpoint (GET /api/custom_templates/{id}/file) allows any authenticated user to read the file content of any custom template by enumerating sequential integer IDs, bypassing Resource Control access restrictions. Template files may contain environment-specific values such as connection strings, API tokens, or registry credentials that administrators would not expect standard users to read. This vulnerability is fixed in 2.33.8 and 2.39.1.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/44xxx/CVE-2026-44884.json",
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-862"
    ]
}

References

Affected packages

Git / github.com/portainer/portainer

Affected ranges

Type

GIT

Repo

https://github.com/portainer/portainer

Events

Introduced

0d8802c6d1365588c75793ba891a92268db852d1

Fixed

245f90550729f0269bc7e362f9d282e34788fb7c

Introduced

0f99e298f325d5eee2ecc798598ba45e2350eab0

Fixed

2c1f3c27d5b817ba405f44efe225972e789c2ec1

Database specific

{
    "cpe": "cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*",
    "extracted_events": [
        {
            "introduced": "2.33.0"
        },
        {
            "fixed": "2.33.8"
        },
        {
            "introduced": "2.39.0"
        },
        {
            "fixed": "2.39.1"
        }
    ],
    "source": "CPE_RANGE"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-44884.json"