Missing authorization in gin-vue-admin
Priority HIGH 70CWE-862Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.
Summary
Gin-vue-admin is a backstage management system based on vue and gin. In versions prior to 2.4.7 low privilege users are able to modify higher privilege users. Authentication is missing on the `setUserInfo` function. Users are advised to update as soon as possible. There are no known workarounds.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01097 65th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed gin-vue-admin (flipped-aurora): 2.4.7
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| flipped-aurora | gin-vue-admin | before 2.4.7 | 2.4.7 | Patch available | CNA |
- gin-vue-admin Vendorflipped-aurora Affected before 2.4.7 Fixed in 2.4.7 Patch available CNA
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:* | up to 2.4.6 | Vulnerable | flipped-aurora |
- cpe:2.3:a:gin-vue-admin_project:gin-vue-admin:*:*:*:*:*:*:*:* Versions up to 2.4.6 Vulnerable ·flipped-aurora
Remediation
- Fix · CNA gin-vue-admin (flipped-aurora) Fixed in 2.4.7
Timeline
- 2026-10-02 Threatist record created from CVE-2022-21660
References
More flipped-aurora Gin-vue-admin vulnerabilities
- TI-2022-18720 Gin-vue-admin arbitrary file upload vulnerability caused by path traversal CVSS 3.1CRITICAL 9.8
- TI-2022-18681 Gin-vue-admin vulnerable to Unrestricted Upload of File with Dangerous Type CVSS 3.1CRITICAL 9.8
- TI-2022-13903 Gin-vue-admin - Unrestricted File Upload CVSS 3.1CRITICAL 9.0
- TI-2022-13902 Gin-vue-admin - Unrestricted File Upload CVSS 3.1CRITICAL 9.0
- TI-2022-08656 SQL Injection in github.com/flipped-aurora/gin-vue-admin CVSS 3.1HIGH 8.8
- TI-2025-40846 Gin-vue-admin has an arbitrary file deletion vulnerability CVSS 4.0HIGH 8.7
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences