Telegram CVE-2023-26818

MEDIUM

Incorrect Authorization (CWE-863)

2023-05-19 cve@mitre.org

Authentication Bypass Telegram

5.5

CVSS 3.1 · NVD

Share

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

1

CVE Published

May 19, 2023 - 12:15 nvd

MEDIUM 5.5

DescriptionNVD

Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag.

AnalysisAI

Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.

Technical ContextAI

This vulnerability is classified as Incorrect Authorization (CWE-863), which allows attackers to bypass authorization checks to access restricted resources. Telegram 9.3.1 and 9.4.0 allows attackers to access restricted files, microphone ,or video recording via the DYLD_INSERT_LIBRARIES flag. Affected products include: Telegram.

RemediationAI

No vendor patch is available at time of analysis. Monitor vendor advisories for updates. Review and test authorization logic, implement consistent access control checks, use centralized authorization framework.

More in Telegram

View all

CVE-2019-10044 HIGH This Week POC

Telegram Desktop before 1.5.12 on Windows, and the Telegram applications for Android, iOS, and Linux, is vulnerable to a

CVE-2018-20436 HIGH This Week POC

The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests

CVE-2021-47793 HIGH This Week POC

Telegram Desktop versions up to 2.9.2 is affected by allocation of resources without limits or throttling (CVSS 7.5).

CVE-2018-17231 HIGH This Week POC

Telegram Desktop (aka tdesktop) 1.3.14 might allow attackers to cause a denial of service (assertion failure and applica

CVE-2021-31321 HIGH This Week POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Stack Based Overflow in the

CVE-2021-31320 HIGH This Week POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the

CVE-2018-17780 MEDIUM This Month POC

Telegram Desktop (aka tdesktop) 1.3.14, and Telegram 3.3.0.0 WP8.1 on Windows, leaks end-user public and private IP addr

CVE-2022-43363 MEDIUM This Month POC

Telegram Web 15.3.1 allows XSS via a certain payload derived from a Target Corporation website. Rated medium severity (C

CVE-2021-40532 CRITICAL Act Now

Telegram Web K Alpha before 0.7.2 mishandles the characters in a document extension. Rated critical severity (CVSS 9.8),

CVE-2018-17613 CRITICAL Act Now

Telegram Desktop (aka tdesktop) 1.3.16 alpha, when "Use proxy" is enabled, sends credentials and application data in cle

CVE-2021-30496 MEDIUM This Month POC

The Telegram app 7.6.2 for iOS allows remote authenticated users to cause a denial of service (application crash) if the

CVE-2021-31323 MEDIUM This Month POC

Telegram Android <7.1.0 (2090), Telegram iOS <7.1, and Telegram macOS <7.1 are affected by a Heap Buffer Overflow in the

Same weakness CWE-863 – Incorrect Authorization

View all

CVE-2025-54253 CRITICAL POC

CVE-2025-24200 MEDIUM

CVE-2026-42016 HIGH POC

CVE-2023-21715 HIGH

CVE-2025-21480 HIGH

CVE-2025-21479 HIGH

CVE-2025-32462 HIGH POC

CVE-2017-4915 HIGH POC

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

CVE-2012-4681 CRITICAL POC

CVE-2013-2465 CRITICAL POC

CVE-2011-3544 CRITICAL POC

CVE-2022-40684 CRITICAL POC

CVE-2025-61882 CRITICAL POC

CVE-2024-0012 CRITICAL POC

CVE-2023-46805 HIGH POC

Share

CVE-2023-26818 vulnerability details – vuln.today

Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy