Privilege escalation in RBAC system
Priority LOW 39CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub.
Summary
A privilege escalation vulnerability impacting the Google Exposure Notification Verification Server (versions prior to 0.23.1), allows an attacker who (1) has UserWrite permissions and (2) is using a carefully crafted request or malicious proxy, to create another user with higher privileges than their own. This occurs due to insufficient checks on the allowed set of permissions. The new user creation event would be captured in the Event Log.
Why it matters now
EPSS 0.00718 54th percentileScored 2026-11-07
Fix Fixed github.com/google/exposure-notifications-verification-server (Go): 0.23.1
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Exposure Notifications Verification Server | stable – 0.23.0 | — | No fix listed | CNA | |
| — | github.com/google/exposure-notifications-verification-server (Go) | before 0.23.1 | 0.23.1 | Patch available | GHSA-5v95-v8c8-3rh6 |
- Exposure Notifications Verification Server VendorGoogle Affected stable – 0.23.0 Fixed in — No fix listed CNA
- github.com/google/exposure-notifications-verification-server (Go) Vendor— Affected before 0.23.1 Fixed in 0.23.1 Patch available GHSA-5v95-v8c8-3rh6
Remediation
- Fix · GHSA-5v95-v8c8-3rh6 github.com/google/exposure-notifications-verification-server (Go) Fixed in 0.23.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-22538
- 2026-10-03 Alias added: GHSA-5v95-v8c8-3rh6
References
Advisory 4
- https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-5v95-v8c8-3rh6
- https://github.com/google/exposure-notifications-verification-server/releases/tag/v0.23.1
- https://github.com/google/exposure-notifications-verification-server/releases/tag/v0.24.0
- https://nvd.nist.gov/vuln/detail/CVE-2021-22538
Sources
- CVE-2021-22538 · CVE Program
- CVE-2021-22538 · NVD
- FIRST EPSS
- GHSA-5v95-v8c8-3rh6 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences