Improper Authentication in PrivateUploader
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-287.
Summary
PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctly verify whether the user was an administrator (High Level) or moderator (Low Level) causing the request to continue processing. The response would be a 403 with ADMIN_ONLY, however, next() would call leading to any updates/changes in the route to process. This issue has been addressed in version 3.2.49. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| PrivateUploader | PrivateUploader | before 3.2.49 | 3.2.49 | Patch available | CNA |
- PrivateUploader VendorPrivateUploader Affected before 3.2.49 Fixed in 3.2.49 Patch available CNA
Remediation
- Fix · CNA PrivateUploader (PrivateUploader) Fixed in 3.2.49
Timeline
- 2026-10-02 Threatist record created from CVE-2023-40020
References
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences