Nora
Monthly
Missing authorization in NORA Registry (nora-registry) 0.9.4 and earlier lets any valid read-scoped bearer token enumerate token metadata - ID, owner, role, description, expiry and last-use - for every user through the globally scoped token-management list endpoint, while a write-scoped bearer token or write-capable OIDC workload identity can additionally revoke arbitrary admin and service tokens by ID, disrupting the registry and forcing credential recovery. The flaw is CWE-862: auth_middleware() authenticates /ui/tokens and /api/ui/tokens but only checks role.can_write() instead of role.can_admin(), so the handlers operate across all accounts. No CISA KEV entry or confirmed active exploitation was reported; the vendor advisory includes reproduction steps (a PoC reference) rather than verified working exploit code, and exploitation requires auth to be enabled, the token endpoints to be network-reachable, and the attacker to already hold a valid registry credential.
Missing authorization in NORA Registry (nora-registry) 0.9.4 and earlier lets any valid read-scoped bearer token enumerate token metadata - ID, owner, role, description, expiry and last-use - for every user through the globally scoped token-management list endpoint, while a write-scoped bearer token or write-capable OIDC workload identity can additionally revoke arbitrary admin and service tokens by ID, disrupting the registry and forcing credential recovery. The flaw is CWE-862: auth_middleware() authenticates /ui/tokens and /api/ui/tokens but only checks role.can_write() instead of role.can_admin(), so the handlers operate across all accounts. No CISA KEV entry or confirmed active exploitation was reported; the vendor advisory includes reproduction steps (a PoC reference) rather than verified working exploit code, and exploitation requires auth to be enabled, the token endpoints to be network-reachable, and the attacker to already hold a valid registry credential.