CVE-2023-50437

Couchbase Server versions prior to 7.2.4 are vulnerable to an incorrect privilege assignment (CWE-266). The root cause is that the otpCookie is displayed with full admin access on the /pools/default/serverGroups and engageCluster2 endpoints. This vulnerability could allow unauthorized administrat...