TI-2020-13672 Aliases CVE-2020-19676 GHSA-qf76-pr7x-h7r4

Nacos 1.1.4 is affected by: Incorrect Access Control.

LOW 27CWE-200Published 2020-09-30 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: Low · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

Nacos 1.1.4 is affected by: Incorrect Access Control. An environment can be set up locally to get the service details interface. Then other Nacos service names can be accessed through the service list interface. Service details can then be accessed when not logged in. (detail:https://github.com/alibaba/nacos/issues/2284)

Why it matters now

EPSS 0.0142 72nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed com.alibaba.nacos:nacos-common (Maven): 1.2.0

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	com.alibaba.nacos:nacos-common (Maven)	before 1.2.0	1.2.0	Patch available	GHSA-qf76-pr7x-h7r4

— Vendor— Affected all versions Fixed in — No fix listed CNA
com.alibaba.nacos:nacos-common (Maven) Vendor— Affected before 1.2.0 Fixed in 1.2.0 Patch available GHSA-qf76-pr7x-h7r4

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:alibaba:nacos:1.1.4:::::::*	1.1.4	Vulnerable	Alibaba

cpe:2.3:a:alibaba:nacos:1.1.4:*:*:*:*:*:*:* Versions 1.1.4 Vulnerable ·Alibaba

Remediation

Fix · GHSA-qf76-pr7x-h7r4 com.alibaba.nacos:nacos-common (Maven) Fixed in 1.2.0 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2020-19676
2026-10-03 Alias added: GHSA-qf76-pr7x-h7r4

References

Exploit 1

https://github.com/alibaba/nacos/issues/2284

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2020-19676

Other 2

TI-2021-10154 Authentication bypass in Alibaba nacos CVSS 3.1CRITICAL 9.8
TI-2021-10155 Authentication bypass in Alibaba nacos CVSS 3.1HIGH 8.6
TI-2021-19162 An Access Control vulnerability exists in Nacos 2.0.3 in the access prompt page; enter… CVSS 3.1HIGH 8.8
TI-2021-20198 A Cross Site Scripting (XSS) vulnerability exists in Nacos 2.0.3 in auth/users via the… CVSS 3.1MEDIUM 6.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences