GHSA-5v95-v8c8-3rh6

    Dashboard / Vulnerabilities / GHSA-5v95-v8c8-3rh6

    GHSA-5v95-v8c8-3rh6

    Published: 21 May 2021Last Modified: 8 Jul 2026

    Summary: Privilege escalation in rbac

    Details: ### Impact Using a carefully crafted request or malicious proxy, a user with `UserWrite` permissions could create another user with higher privileges than their own due to insufficient checks on the allowed set of permissions. The event would be captured in the Event Log. ### Patches The issue has been fixed in 0.24.0 and 0.23.1. ### Workarounds For users who are unable to upgrade, we recommend auditing users who have `UserWrite` permissions and regularly reviewing the Event Log for malicious activity. ### Kudos Thank you to Michael Mazzolini (Ethical Hacker at WHO) for finding and disclosing this vulnerability.

    References: https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-5v95-v8c8-3rh6, https://nvd.nist.gov/vuln/detail/CVE-2021-22538, https://github.com/google/exposure-notifications-verification-server/commit/eb8cf40b12dbe79304f1133c06fb73419383cd95, https://github.com/google/exposure-notifications-verification-server/releases/tag/v0.23.1, https://github.com/google/exposure-notifications-verification-server/releases/tag/v0.24.0

    Affected packages

    Package

    Name: github.com/google/exposure-notifications-verification-server

    Purl: pkg:golang/github.com/google/exposure-notifications-verification-server

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -0.23.1

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    GHSA-5v95-v8c8-3rh6 | CVE-DB