CVE-2021-31590

PwnDoc all versions until 0.4.0 2021-08-23 has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a...

CVE-2021-31590

PwnDoc (up to 0.4.0 as of 2021-08-23) contains a JWT handling flaw that enables improper access control. A valid JSON Web Token used for authentication/authorization can preserve admin privileges when a user is downgraded to “user,” and even after account deletion the attacker can access the admi...