Issues notification metadata lacks authorization
Priority LOW 20CWE-288Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-288.
Summary
A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the RID of the issue, severity, internal UUID of the author, and the user-defined title of the issue.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00393 33rd percentileScored 2026-11-07
Fix Fixed com.palantir.issues:issues (Palantir): 2.497.0
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
- Fix · CNA com.palantir.issues:issues (Palantir) Fixed in 2.497.0
Timeline
- 2026-10-02 Threatist record created from CVE-2023-30946
- 2026-10-03 Alias added: GHSA-63fq-r3mp-fpcf
References
More Palantir Foundry Issues vulnerabilities
- TI-2023-08990 Denial of Service in Foundry Issues CVSS 3.1HIGH 7.7
- TI-2022-10768 The Foundry Issues service was found to be logging in a manner that captured session tokens. CVSS 3.1MEDIUM 5.5
Sources
- CVE-2023-30946 · CVE Program
- CVE-2023-30946 · NVD
- FIRST EPSS
- GHSA-63fq-r3mp-fpcf · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences