Sakai: Kernel users created with type roleview can login as a normal user
Priority MEDIUM 44CWE-285Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-285.
Summary
Sakai is a Collaboration and Learning Environment. Starting in version 23.0 and prior to version 23.2, kernel users created with type roleview can log in as a normal user. This can result in illegal access being granted to the system. Version 23.3 fixes this vulnerability.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0057 47th percentileScored 2026-11-07
Fix Fixed sakai (sakaiproject): 23.3org.sakaiproject.kernel:sakai-kernel-impl (Maven): 23.3
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| sakaiproject | sakai | 23.0 to before 23.3 | 23.3 | Patch available | CNA |
| — | org.sakaiproject.kernel:sakai-kernel-impl (Maven) | 23.0 to before 23.3 | 23.3 | Patch available | GHSA-cx95-q6gx-w4qp |
- sakai Vendorsakaiproject Affected 23.0 to before 23.3 Fixed in 23.3 Patch available CNA
- org.sakaiproject.kernel:sakai-kernel-impl (Maven) Vendor— Affected 23.0 to before 23.3 Fixed in 23.3 Patch available GHSA-cx95-q6gx-w4qp
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:sakailms:sakai:*:*:*:*:*:*:*:* | 23.0 to before 23.2 | Vulnerable | sakaiproject |
- cpe:2.3:a:sakailms:sakai:*:*:*:*:*:*:*:* Versions 23.0 to before 23.2 Vulnerable ·sakaiproject
Remediation
- Fix · CNA sakai (sakaiproject) Fixed in 23.3
- Fix · GHSA-cx95-q6gx-w4qp org.sakaiproject.kernel:sakai-kernel-impl (Maven) Fixed in 23.3 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2024-47876
- 2026-10-03 Alias added: GHSA-cx95-q6gx-w4qp
References
Advisory 2
More sakaiproject Sakai vulnerabilities
- TI-2019-12135 Sakai through 12.6 allows XSS via a chat user name. CVSS 3.1MEDIUM 6.1
- TI-2025-38900 Sakai kernel-impl: predictable PRNG used to generate server‑side encryption key in EncryptionUtilityServiceImpl CVSS 3.1MEDIUM 5.9
- TI-2026-25799 SAK-52311: Sakai site-manage group titles can contain XSS content CVSS 4.0LOW 1.3
Sources
- CVE-2024-47876 · CVE Program
- CVE-2024-47876 · NVD
- FIRST EPSS
- GHSA-cx95-q6gx-w4qp · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences