CVE-2021-29452

    Dashboard / Vulnerabilities / CVE-2021-29452

    CVE-2021-29452

    Published: 16 Apr 2021Last Modified: 9 Jul 2026

    Summary:

    Details: a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change. Patched in v0.18.2.

    References: https://www.npmjs.com/package/%40curveball/a12n-server, https://github.com/curveball/a12n-server/security/advisories/GHSA-8hw9-22v6-9jr9

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 6f76fd9dda3c5482c6a5dfd4460a61e0a0e4c107
    Fixed -1870e4f95fde90eea4626b69f41a4b363351731d

    Affected versions

    v0.18.1
    v0.18.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-29452 | CVE-DB