The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the origin of the connection.
CVSS 3.0HIGH 7.5·Network·No auth·No interaction·EPSS 0.01102·Published 2019-04-22·Fixed in 0.21.2CWE-284