TI-2021-19748 Aliases CVE-2021-43996 GHSA-vhrp-8qx4-vr6c

The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix…

MEDIUM 46CWE-284Published 2021-11-17 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

The Ignition component before 1.16.15, and 2.0.x before 2.0.6, for Laravel has a "fix variable names" feature that can lead to incorrect access control.

Why it matters now

EPSS 0.01725 77th percentileScored 2026-11-07

Fix Fixed facade/ignition (Packagist): 1.16.15, 2.0.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA
—	facade/ignition (Packagist)	before 1.16.15	1.16.15	Patch available	GHSA-vhrp-8qx4-vr6c
—	facade/ignition (Packagist)	2.0.0 to before 2.0.6	2.0.6	Patch available	GHSA-vhrp-8qx4-vr6c

— Vendor— Affected all versions Fixed in — No fix listed CNA
facade/ignition (Packagist) Vendor— Affected before 1.16.15 Fixed in 1.16.15 Patch available GHSA-vhrp-8qx4-vr6c
facade/ignition (Packagist) Vendor— Affected 2.0.0 to before 2.0.6 Fixed in 2.0.6 Patch available GHSA-vhrp-8qx4-vr6c

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:facade:ignition::::::laravel::*	before 1.6.15; 2.0.0 to before 2.0.6	Vulnerable	Facade

cpe:2.3:a:facade:ignition:*:*:*:*:*:laravel:*:* Versions before 1.6.15; 2.0.0 to before 2.0.6 Vulnerable ·Facade

Remediation

Fix · GHSA-vhrp-8qx4-vr6c facade/ignition (Packagist) Fixed in 1.16.15 Advisory →
Fix · GHSA-vhrp-8qx4-vr6c facade/ignition (Packagist) Fixed in 2.0.6 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-43996
2026-10-03 Alias added: GHSA-vhrp-8qx4-vr6c

References

Patch 3

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-43996

Other 1

https://github.com/facade/ignition

TI-2021-02221 Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated… KEVCVSS 3.1CRITICAL 9.8
TI-2020-10887 The Ignition component before 2.0.5 for Laravel mishandles globals, _get, _post, _cookie… CVSS 3.1CRITICAL 9.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences