PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling…
Priority MEDIUM 43Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system.
Why it matters now
EPSS 0.02653 85th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2021-31590
- 2026-10-03 Alias added: GHSA-w9w2-pj3m-5v3r
References
Patch 5
- https://github.com/pwndoc/pwndoc/pull/128
- https://github.com/pwndoc/pwndoc/pull/74
- https://github.com/pwndoc/pwndoc/blob/59519735b0d831d8fd96d7c3387f66d28407e583/CHANGELOG.md#040-2021-08-23
- https://github.com/pwndoc/pwndoc/commit/15f3dc0e212eda465e05fda0feb002d1bce2939d
- https://github.com/pwndoc/pwndoc/commit/ff1b868cec55f5b6c7a91e15a2b0b1f4324121ab
More Pwndoc vulnerabilities
- TI-2022-22589 An issue in the /api/audits component of Pwndoc v0.5.3 allows attackers to escalate… CVSS 3.1HIGH 8.8
- TI-2025-16853 Cross-Site Request Forgery (CSRF) allows creating admin account with POST request CVSS 3.1HIGH 8.1
- TI-2024-36911 PenDoc vulnerable to Arbitrary File Read on updating and downloading templates using Path Traversal CVSS 3.1HIGH 8.5
- TI-2025-20248 PwnDoc Arbitrary File Write to RCE using Path Traversal in template update from backup templates.json CVSS 3.1MEDIUM 6.5
- TI-2025-20245 PwnDoc Arbitrary File Write to RCE using Path Traversal in backup restore as admin CVSS 3.1MEDIUM 6.5
- TI-2022-21648 PwnDoc through 0.5.3 might allow remote attackers to identify disabled user account names… CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-31590 · CVE Program
- CVE-2021-31590 · NVD
- FIRST EPSS
- GHSA-w9w2-pj3m-5v3r · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences