Any logged in user could edit any other logged in user.
Priority LOW 37CWE-269Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Privilege escalation, Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-269 and CWE-863.
Summary
a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change. Patched in v0.18.2.
Why it matters now
EPSS 0.00781 56th percentileScored 2026-11-07
Fix Fixed @curveball/a12n-server (npm): 0.18.2
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| curveball | a12n-server | >= 0.18 < 0.18.2 | — | No fix listed | CNA |
| — | @curveball/a12n-server (npm) | 0.18.0 to before 0.18.2 | 0.18.2 | Patch available | GHSA-8hw9-22v6-9jr9 |
- a12n-server Vendorcurveball Affected >= 0.18 < 0.18.2 Fixed in — No fix listed CNA
- @curveball/a12n-server (npm) Vendor— Affected 0.18.0 to before 0.18.2 Fixed in 0.18.2 Patch available GHSA-8hw9-22v6-9jr9
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:curveballjs:a12n-server:*:*:*:*:*:node.js:*:* | 0.18.0 to before 0.18.2 | Vulnerable | Curveballjs |
- cpe:2.3:a:curveballjs:a12n-server:*:*:*:*:*:node.js:*:* Versions 0.18.0 to before 0.18.2 Vulnerable ·Curveballjs
Remediation
- Fix · GHSA-8hw9-22v6-9jr9 @curveball/a12n-server (npm) Fixed in 0.18.2 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2021-29452
- 2026-10-03 Alias added: GHSA-8hw9-22v6-9jr9
References
Sources
- CVE-2021-29452 · CVE Program
- CVE-2021-29452 · NVD
- FIRST EPSS
- GHSA-8hw9-22v6-9jr9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences