Opencve
Monthly
Organization-scoped API tokens in OpenCVE before 3.1.0 can list and retrieve every organization belonging to the token creator because the organizations API endpoint ignores the token's organization scope. This is a low-severity confidentiality-only broken-access-control flaw (CWE-863); exploitation requires a valid organization-scoped token (authenticated, PR:L) whose creator belongs to multiple organizations, and it yields no extra data in single-organization deployments. No public exploit identified at time of analysis; vendor-released patch: 3.1.0.
Organization-scoped API tokens in OpenCVE before 3.1.0 can list and retrieve every organization belonging to the token creator because the organizations API endpoint ignores the token's organization scope. This is a low-severity confidentiality-only broken-access-control flaw (CWE-863); exploitation requires a valid organization-scoped token (authenticated, PR:L) whose creator belongs to multiple organizations, and it yields no extra data in single-organization deployments. No public exploit identified at time of analysis; vendor-released patch: 3.1.0.