TI-2024-05850 Aliases CVE-2024-6303 GHSA-rjmw-frq7-qf5g

Missing Authorization in Conduit

MEDIUM 43CWE-862Published 2024-06-25 · Updated 2024-08-29

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-862.

Summary

Missing authorization in Client-Server API in Conduit <=0.7.0, allowing for any alias to be removed and added to another room, which can be used for privilege escalation by moving the #admins alias to a room which they control, allowing them to run commands resetting passwords, siging json with the server's key, deactivating users, and more

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00433 37th percentileScored 2026-11-07

Fix Fixed Conduit (The Conduit Contributors): 0.8.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
The Conduit Contributors	Conduit	before 0.8.0	0.8.0	Patch available	CNA

Conduit VendorThe Conduit Contributors Affected before 0.8.0 Fixed in 0.8.0 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:conduit:conduit::::::::	before 0.8.0	Vulnerable	The Conduit Contributors

cpe:2.3:a:conduit:conduit:*:*:*:*:*:*:*:* Versions before 0.8.0 Vulnerable ·The Conduit Contributors

Remediation

Fix · CNA Conduit (The Conduit Contributors) Fixed in 0.8.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

Release · 2024-06-25
The Conduit Contributors Conduit 0.8.0
4 records Highest priority Priority MEDIUM 1 MEDIUM, 3 LOW
Other records, highest priority first
- TI-2024-05848 Origin Validation Error in ConduitPriority LOW 38
- TI-2024-05847 Incomplete Cleanup in ConduitPriority LOW 24
- TI-2024-05846 Use of a Key Past its Expiration Date in ConduitPriority LOW 21
Show all 4 records →

Timeline

2026-10-02 Threatist record created from CVE-2024-6303
2026-10-03 Alias added: GHSA-rjmw-frq7-qf5g

References

Other 2

TI-2024-05848 Origin Validation Error in Conduit CVSS 3.1HIGH 7.5
TI-2024-05849 Improper Handling of Insufficient Permissions or Privileges in Conduit CVSS 3.1HIGH 8.1
TI-2024-05847 Incomplete Cleanup in Conduit CVSS 3.1MEDIUM 5.3
TI-2024-05846 Use of a Key Past its Expiration Date in Conduit CVSS 3.1MEDIUM 4.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences