GHSA-cmm8-gw4m-26cw

Suggest an improvement
Source
https://github.com/advisories/GHSA-cmm8-gw4m-26cw
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-cmm8-gw4m-26cw/GHSA-cmm8-gw4m-26cw.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cmm8-gw4m-26cw
Aliases
Withdrawn
2025-08-04T20:26:16Z
Published
2025-07-25T15:30:53Z
Modified
2026-09-10T03:50:26Z
Severity
  • 2.9 (Low) CVSS_V3 - CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
Withdrawn Advisory: JHipster allows privilege escalation via a modified authorities parameter
Details

Withdrawn Advisory

This advisory has been withdrawn because the original report was found to be invalid. This link is maintained to preserve external references. For more information, see https://groups.google.com/g/jhipster-dev/c/ATSlWkEjw2w.

Original Description

JHipster before v.8.9.0 allows privilege escalation via a modified authorities parameter. Upon registering in the JHipster portal and logging in as a standard user, the authorities parameter in the response from the api/account endpoint contains the value ROLE_USER. By manipulating the authorities parameter and changing its value to ROLE_ADMIN, the privilege is successfully escalated to an Admin level. This allowed the access to all admin-related functionalities in the application.

Database specific 
{
    "cwe_ids":  [
        "CWE-284",
        "CWE-451"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2025-07-25T17:19:20Z",
    "nvd_published_at":  "2025-07-25T13:15:29Z",
    "severity":  "LOW"
}
References

Affected packages

npm / generator-jhipster

Package

Name
generator-jhipster
View open source insights on deps.dev
Purl
pkg:npm/generator-jhipster

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
8.9.0

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/07/GHSA-cmm8-gw4m-26cw/GHSA-cmm8-gw4m-26cw.json"