GHSA-5626-pw9c-hmjr

    Dashboard / Vulnerabilities / GHSA-5626-pw9c-hmjr

    GHSA-5626-pw9c-hmjr

    Published: 31 Jan 2024Last Modified: 10 Sept 2026

    Summary: OctoPrint Unverified Password Change via Access Control Settings

    Details: ### Impact OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. ### Patches The vulnerability will be patched in version 1.10.0. ### Workarounds OctoPrint administrators are strongly advised to thoroughly vet who has admin access to their installation. ### Credits This vulnerability was discovered and responsibly disclosed to OctoPrint by Timothy "TK" Ruppert.

    References: https://github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr, https://nvd.nist.gov/vuln/detail/CVE-2024-23637, https://github.com/OctoPrint/OctoPrint/commit/1729d167b4ae4a5835bbc7211b92c6828b1c4125, https://github.com/OctoPrint/OctoPrint, https://github.com/OctoPrint/OctoPrint/releases/tag/1.10.0rc1, https://github.com/pypa/advisory-database/tree/main/vulns/octoprint/PYSEC-2024-29.yaml

    Affected packages

    Package

    Name: octoprint

    Purl: pkg:pypi/octoprint

    Affected ranges

    Type: ECOSYSTEM

    Events:

    Introduced- 0
    Fixed -1.10.0rc1

    Affected versions

    1.3.11
    1.3.12
    1.3.12rc1
    1.3.12rc3

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-5626-pw9c-hmjr | CVE-DB