CVE-2024-42490CWE-285

authentik has Insufficient Authorization for several API endpoints

High · published August 22, 2024

CVSS v3.1
7.5
EPSS
0%
Percentile
40.2
In the wild
Unconfirmed
What it is

authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs/<uuid>/view_certificate/, /api/v3/crypto/certificatekeypairs/<uuid>/view_private_key/, and /api/v3/.../used_by/. Note that all of the affected API endpoints require the knowledge of the ID of an object, which especially for certificates is not accessible to an unprivileged user. Additionally the IDs for most objects are UUIDv4, meaning they are not easily guessable/enumerable. authentik 2024.4.4, 2024.6.4 and 2024.8.0 fix this issue.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00477 · 40.2th percentile
Weakness
CWE-285 · Improper Authorization
Published
2024-08-22T15:34Z
EPSS history
Timeline
  • 22 AUG 15:34Z
    authentik has Insufficient Authorization for several API endpoints
    cvelistv5