Unauthorized API Access

2024-08-2706:51:15

Veracode Vulnerability Database

sca.analysiscenter.veracode.com

api

vulnerability

authentication

authorization

sensitive information

uuid

software

CVSS3

7.5

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

AI Score

6.6

Confidence

Low

JSON

goauthentik.io is vulnerable to unauthorized API access. The vulnerability is due to a lack of proper authentication enforcement on specific API endpoints due to missing authorization checks. This allows unauthenticated users to access sensitive information such as private keys and certificates by simply knowing the UUID of the relevant object.