NORA missing cross-user token-management authorization

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. auth_middleware() protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with role.can_write(), not role.can_admin(). tokens_page() and tokens_list() call store.list_all_tokens(), exposing IDs and metadata across all users, while tokens_revoke() calls store.revoke_token using the supplied token ID without an ownership or admin check. A read bearer token can enumerate other users' token existence, owner, role, description, expiry and last-use metadata. A write bearer token or write-capable OIDC identity can additionally revoke arbitrary admin and service tokens, disrupting the registry and forcing credential recovery. Read-only identities cannot POST a revocation. This issue is fixed in version 0.9.5.

Etkilenen sürümler1 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…o/nora/security/advisories/GHSA-78cx-cfhm-rgmx Diğer
• github.com/getnora-io/nora/pull/747 Diğer
• github.com/…ommit/dc9e943b208095ec1e8cc2cf7b5108fdb55cab9c Diğer
• github.com/getnora-io/nora/releases/tag/v0.9.5 Diğer

Kayıt geçmişi

1. 28 Eki 2026 16:05Yayımlandı

İlgili açıklar

• 6,5 CVE-2026-50541Xibo: IDOR (Broken Object-Level Authorization) on GET /dataset/export/csv/{id} Allows Arbitrary Dataset Export
• 7,1 CVE-2026-52729Xibo: IDOR (Broken Object-Level Authorization) on PUT/DELETE /action/{id} Allows Arbitrary Layout Action Modification and Deletion
• 8,5 CVE-2026-59185identrail: Cross-tenant GitHub installation binding without ownership verification
• 7,5 CVE-2026-116393WordPress Optima Express + MarketBoost IDX Plugin plugin <= 8.7.8 - Broken Access Control vulnerability
• 6,5 CVE-2026-116404WordPress Redux Framework plugin <= 4.5.16 - Broken Access Control vulnerability
• 5,4 CVE-2026-116855WordPress My auctions allegro plugin <= 4.0.3 - Broken Access Control vulnerability