CVE-2024-32470CWE-863

Tolgee' API keys created by server admin users bypass the permission check

Medium · published April 18, 2024

CVSS v3.1
6.5
EPSS
1%
Percentile
45.6
In the wild
Unconfirmed
What it is

Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57.4.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00556 · 45.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2024-04-18T15:05Z
EPSS history
Timeline
  • 18 APR 15:05Z
    Tolgee' API keys created by server admin users bypass the permission check
    cvelistv5