← Back to browse · API

CVE-2023-32749

Severity
HIGH
CVSS
8.8
EPSS
0.14197
Risk score
40.17
CISA KEV
No
PoC
No
Published
2023-06-08
Modified
2025-01-06
First seen
2026-08-07
Aliases
EUVD-2023-36974, GHSA-RM22-VH4P-35M7
Products
n/a:n/a n/a
Sources
euvd EUVD-2023-36974

Description

Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. By assigning all roles to a newly created user, access to all cells and non-personal workspaces is granted.

References