GHSA-76x2-h8h3-cwjg

Source

https://github.com/advisories/GHSA-76x2-h8h3-cwjg

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-76x2-h8h3-cwjg/GHSA-76x2-h8h3-cwjg.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-76x2-h8h3-cwjg

Aliases

CVE-2022-29773
PYSEC-2026-767

Published

2022-06-04T00:00:25Z

Modified

2026-07-07T11:56:43Z

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator

Summary

Access control issue in AlekSIS-Core

Details

An access control issue in aleksis/core/util/auth_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set.

Database specific

{
    "cwe_ids":  [
        "CWE-863"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2022-06-06T21:20:39Z",
    "nvd_published_at":  "2022-06-03T21:15:00Z",
    "severity":  "MODERATE"
}

References

Affected packages

PyPI / aleksis-core

Package

Name: aleksis-core; View open source insights on deps.dev
Purl: pkg:pypi/aleksis-core

Affected ranges

Type: ECOSYSTEM
Events: Introduced

0 Unknown introduced version / All previous versions are affected

Fixed

2.9

Affected versions

2.*

2.0a3.dev0

2.0a3

2.0a4

2.0b0

2.0b1

2.0b2

2.0rc1

2.0rc2

2.0rc3

2.0rc4

2.0rc5

2.0rc6

2.0rc7

2.0

2.1.dev0

2.1

2.1.1

2.2

2.2.1

2.3

2.3.1

2.3.2

2.4

2.5

2.6

2.7

2.7.1

2.7.2

2.7.3

2.7.4

2.7.5

2.7.6

2.8

2.8.1.dev0

2.8.1

2.8.2.dev0

2.8.2.dev1

Database specific

source

"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/06/GHSA-76x2-h8h3-cwjg/GHSA-76x2-h8h3-cwjg.json"