Homepage
About Snyk

Improper Authorization Affecting github.com/authelia/authelia/v4/internal/handlers package, versions >=4.37.0 <4.38.0

0.0
low

Snyk CVSS

    Attack Complexity High
    Privileges Required High
    User Interaction Required

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk ID SNYK-GOLANG-GITHUBCOMAUTHELIAAUTHELIAV4INTERNALHANDLERS-6672886
  • published 24 Apr 2024
  • disclosed 22 Apr 2024
  • credit ezrizhu
Report a new vulnerability Found a mistake?

Introduced: 22 Apr 2024

New CVE NOT AVAILABLE CWE-281 Open this link in a new tab

How to fix?

Upgrade github.com/authelia/authelia/v4/internal/handlers to version 4.38.0 or higher.

Overview

Affected versions of this package are vulnerable to Improper Authorization. Under very specific conditions, changes to a user's groups may not have the expected results when the file authentication backend is used with the watch option set to true, the refresh_interval is configured to a non-disabled value, and the user's groups are adjusted by an administrator. This can lead to situations where administrators may find that access control changes are not taken into account for longer than expected periods.

Note

  1. This vulnerability can't have an impact on unauthenticated users.

  2. This vulnerability can't have an impact on configurations utilizing the LDAP backend.

  3. This vulnerability can't be directly or indirectly caused by a user's or third party's actions.

Workaround

Ensure you restart between user database changes.

References