Read the docs
TI-2023-15610 Aliases CVE-2023-32316

Users can add themselves to any organization in CloudExplorer Lite

Priority MEDIUM 64CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

CloudExplorer Lite is an open source cloud management tool. In affected versions users can add themselves to any organization in CloudExplorer Lite. This is due to a missing permission check on the user profile. It is recommended to upgrade the version to v1.1.0. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00382 32nd percentileScored 2026-11-07
Fix Fixed CloudExplorer-Lite (CloudExplorer-Dev): 1.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
1Panel-devCloudExplorer-Litebefore 1.1.01.1.0Patch availableCNA
  • CloudExplorer-Lite Vendor1Panel-dev Affected before 1.1.0 Fixed in 1.1.0 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:fit2cloud:cloudexplorer:*:*:*:*:lite:*:*:*before 1.1.0Vulnerable1Panel-dev
  • cpe:2.3:a:fit2cloud:cloudexplorer:*:*:*:*:lite:*:*:* Versions before 1.1.0 Vulnerable ·1Panel-dev

Remediation

  • Fix · CNA CloudExplorer-Lite (CloudExplorer-Dev) Fixed in 1.1.0

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-32316

References

Advisory 1

  • TI-2023-15605 The CloudExplorer Lite missing permissions check CVSS 3.1HIGH 7.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences