CVE-2025-21611

CVE-2025-21611 affects tgstation-server (BYOND server management). Before version 6.12.3, the authorization check for API methods used OR between the user-enabled status and the role, instead of AND. This error allowed enabled users to access most authorized actions regardless of their permission...

CVE-2023-33198

tgstation-server (DMAPI chat channel cache) can be poisoned on TGS detach/reattach, causing chat messages to be sent to configured IRC/Discord channels until channels are updated or DreamDaemon is restarted. Affected: tgstation-server and DMAPI cache handling. Remediation: upgrade to tgstation-se...

CVE-2024-41799

Summary: CVE-2024-41799 affects tgstation-server (BYOND server management). Prior to version 6.8.0, low-permission users with the “Set .dme Path” privilege could cause malicious .dme files on the host to be compiled and executed, potentially leading to remote code execution via BYOND’s shell() pr...

CVE-2018-17107

CVE-2018-17107 concerns Tgstation tgstation-server versions 3.2.4.0 through 3.2.1.0, with a fix in 3.2.5.0. The issue arises from active logins being cached, which can allow a subsequent login to succeed with any username or password. The connected documents confirm the vulnerability is a histori...

CVE-2023-32687

CVE-2023-32687 affects tgstation-server versions 4.7.0 through 5.12.1, where users with the public list chat bots permission can read chat bot connection strings without the required permission. The issue is patched in version 5.12.1. Remediation: update to 5.12.1; as a workaround, remove the lis...

CVE-2023-34243

CVE-2023-34243 affects TGstation-server (TGS): in affected versions, an attacker can discover Windows usernames by brute-forcing the login endpoint with an invalid password, observing distinct responses when a valid logon is found. Impact is information disclosure of usernames; no further exploit...

CVE-2020-16136

In tgstation-server 4.4.0 and 4.4.1, an authenticated user with permission to download logs can access any file on the server machine (accessible by the server process owner) via directory traversal ../ sequences in /Administration/Logs/. The vulnerability enables directory traversal but does not...