Skip to content

Publify `guest` role users can self-register even when the admin does not allow it

Moderate severity GitHub Reviewed Published Nov 3, 2021 to the GitHub Advisory Database • Updated May 4, 2023

Package

bundler publify_core (RubyGems)

Affected versions

>= 9.0.0.pre1, < 9.2.5

Patched versions

9.2.5

Description

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. guest role users can self-register even when the admin does not allow it. This happens due to front-end restriction only.

References

Published by the National Vulnerability Database Nov 2, 2021
Reviewed Nov 3, 2021
Published to the GitHub Advisory Database Nov 3, 2021
Last updated May 4, 2023

Severity

Moderate
6.5
/ 10

CVSS base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses

CVE ID

CVE-2021-25973

GHSA ID

GHSA-x24j-87x9-jvv5

Source code

Credits

Checking history
See something to contribute? Suggest improvements for this vulnerability.