Improper access control in https://github.com/rails/rails
Priority LOW 38CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass, Code execution
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 1 fixed, 2 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-284 and CWE-502.
Summary
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.
Why it matters now
EPSS 0.02865 86th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial activejob (RubyGems): 4.2.11, 5.0.7.1, 5.1.6.1 +1Red Hat: 1 advisoryRed Hat: 1 fixed, 2 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | https://github.com/rails/rails | 4.2.0 up to and before 4.2.11; 4.2.0 up to and before 5.0.7.1; 4.2.0 up to and before 5.1.6.1; 4.2.0 up to and before 5.2.1.1 | — | No fix listed | CNA |
| — | activejob (RubyGems) | 4.2.0 to before 4.2.11 | 4.2.11 | Patch available | GHSA-q2qw-rmrh-vv42 |
| — | activejob (RubyGems) | 5.0.0 to before 5.0.7.1 | 5.0.7.1 | Patch available | GHSA-q2qw-rmrh-vv42 |
| — | activejob (RubyGems) | 5.1.0 to before 5.1.6.1 | 5.1.6.1 | Patch available | GHSA-q2qw-rmrh-vv42 |
| — | activejob (RubyGems) | 5.2.0 to before 5.2.1.1 | 5.2.1.1 | Patch available | GHSA-q2qw-rmrh-vv42 |
- https://github.com/rails/rails Vendor— Affected 4.2.0 up to and before 4.2.11; 4.2.0 up to and before 5.0.7.1; 4.2.0 up to and before 5.1.6.1; 4.2.0 up to and before 5.2.1.1 Fixed in — No fix listed CNA
- activejob (RubyGems) Vendor— Affected 4.2.0 to before 4.2.11 Fixed in 4.2.11 Patch available GHSA-q2qw-rmrh-vv42
- activejob (RubyGems) Vendor— Affected 5.0.0 to before 5.0.7.1 Fixed in 5.0.7.1 Patch available GHSA-q2qw-rmrh-vv42
- activejob (RubyGems) Vendor— Affected 5.1.0 to before 5.1.6.1 Fixed in 5.1.6.1 Patch available GHSA-q2qw-rmrh-vv42
- activejob (RubyGems) Vendor— Affected 5.2.0 to before 5.2.1.1 Fixed in 5.2.1.1 Patch available GHSA-q2qw-rmrh-vv42
Remediation
- Fix · GHSA-q2qw-rmrh-vv42 activejob (RubyGems) Fixed in 4.2.11 Advisory →
- Fix · GHSA-q2qw-rmrh-vv42 activejob (RubyGems) Fixed in 5.0.7.1 Advisory →
- Fix · GHSA-q2qw-rmrh-vv42 activejob (RubyGems) Fixed in 5.1.6.1 Advisory →
- Fix · GHSA-q2qw-rmrh-vv42 activejob (RubyGems) Fixed in 5.2.1.1 Advisory →
Red Hat 1 advisory
- RHSA-2019:0600 Released 2019-03-19 · Red Hat rating ModerateCloudForms 4.6.9 security, bug fix and enhancement update
- CloudForms Management Engine 5.9 cfme-5.9.9.1-1.el7cf, cfme-amazon-smartstate-5.9.9.1-1.el7cf, cfme-appliance-5.9.9.1-1.el7cf +3
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Satellite 6 | Affected | No fix planned: Will not fix |
| Red Hat Software Collections | Affected | No fix planned: Will not fix |
| CloudForms Management Engine 5.9 | Fixed | RHSA-2019:0600 |
Timeline
- 2026-10-02 Threatist record created from CVE-2018-16476
- 2026-10-03 Alias added: GHSA-q2qw-rmrh-vv42
References
Advisory 3
Other 5
- https://github.com/rails/rails/commit/970b0d754be7c71a760d9b807eea32297fd838e3
- https://github.com/rails/rails
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activejob/CVE-2018-16476.yml
- https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw
- https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released
Sources
- CVE-2018-16476 · CVE Program
- CVE-2018-16476 · NVD
- FIRST EPSS
- GHSA-q2qw-rmrh-vv42 · GitHub Advisory Database · CC BY 4.0
- CVE-2018-16476 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences