Read the docs
TI-2023-15382 Aliases CVE-2023-32078GHSA-256m-j5qw-38f4

Netmaker IDOR Vulnerability Allows User to Update Other User's Password

Priority MEDIUM 40CWE-639Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
None · High · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-639.

Summary

Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0.18.6 in the user update function. By specifying another user's username, it was possible to update the other user's password. The issue is patched in 0.17.1 and fixed in 0.18.6. If Users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone using version 0.17.1 can pull the latest docker image of the backend and restart the server.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00692 53rd percentileScored 2026-11-07
Fix Fixed netmaker (gravitl): 0.17.1, 0.18.6github.com/gravitl/netmaker (Go): 0.17.1, 0.18.6

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
gravitlnetmakerbefore 0.17.1; 0.18.0 to before 0.18.60.17.1, 0.18.6Patch availableCNA
—github.com/gravitl/netmaker (Go)before 0.17.10.17.1Patch availableGHSA-256m-j5qw-38f4
—github.com/gravitl/netmaker (Go)0.18.0 to before 0.18.60.18.6Patch availableGHSA-256m-j5qw-38f4
  • netmaker Vendorgravitl Affected before 0.17.1; 0.18.0 to before 0.18.6 Fixed in 0.17.1, 0.18.6 Patch available CNA
  • github.com/gravitl/netmaker (Go) Vendor— Affected before 0.17.1 Fixed in 0.17.1 Patch available GHSA-256m-j5qw-38f4
  • github.com/gravitl/netmaker (Go) Vendor— Affected 0.18.0 to before 0.18.6 Fixed in 0.18.6 Patch available GHSA-256m-j5qw-38f4

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:netmaker:netmaker:*:*:*:*:*:*:*:*before 0.17.1; 0.18.0 – 0.18.5VulnerableNetmaker
  • cpe:2.3:a:netmaker:netmaker:*:*:*:*:*:*:*:* Versions before 0.17.1; 0.18.0 – 0.18.5 Vulnerable ·Netmaker

Remediation

  • Fix · CNA netmaker (gravitl) Fixed in 0.17.1, 0.18.6
  • Fix · GHSA-256m-j5qw-38f4 github.com/gravitl/netmaker (Go) Fixed in 0.17.1 Advisory →
  • Fix · GHSA-256m-j5qw-38f4 github.com/gravitl/netmaker (Go) Fixed in 0.18.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32078
  2. 2026-10-03 Alias added: GHSA-256m-j5qw-38f4

References

Patch 2

Advisory 2

Other 1

  • TI-2026-56044 Netmaker through 1.6.0 Improper Certificate Validation in SMTP Client CVSS 4.0HIGH 8.3
  • TI-2022-00579 Use of Hard-coded Cryptographic Key in gravitl/netmaker CVSS 3.1CRITICAL 9.8
  • TI-2023-15381 Netmaker has Hardcoded DNS Secret Key CVSS 3.1HIGH 7.5
  • TI-2026-23357 Netmaker: Denial of Service via Server Shutdown Endpoint CVSS 4.0HIGH 8.7
  • TI-2026-23313 Netmaker: Service User with Network Access Can Access config files with WireGuard Private Keys CVSS 4.0HIGH 8.7
  • TI-2022-07702 Use of Hard-coded Cryptographic Key in Netmaker CVSS 3.1HIGH 8.8
See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences