Critical
Incorrect Authorization with specially crafted requests
Type: advisorySources: OSV
Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-33189
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 7 Nov 2026, 05:01 UTC · Revision 1
Source evidence
Incorrect Authorization with specially crafted requests
core-osv · Original sourcePublished 30 May 2023, 05:39 UTC
Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.
osv:CVE-2023-33189
Complete source record
{
"id": "1ab75639eabc2523c0ed9ec8b745465e4e4a705c57dc1791e5f5578208110bcc",
"url": "https://osv.dev/vulnerability/CVE-2023-33189",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Incorrect Authorization with specially crafted requests",
"summary": "Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.",
"evidence": "osv:CVE-2023-33189",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2023-33189",
"aliases": [
"CVE-2023-33189",
"GHSA-pvrc-wvj2-f59p",
"GO-2023-1800"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/pomerium/pomerium",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "0d34e3d00c16d0e951e6e18f1992531cc10c96c6"
},
{
"introduced": "33794ff3165e00808136d5b184b1d1ca949a871c"
},
{
"fixed": "d7a4d32505f40f25c0d8ae3de5e2e3527da21bb6"
},
{
"introduced": "3eaa60948c649588d0de37c4fabe3b2263865a7f"
},
{
"fixed": "84901e4e78427c8ca822fa753072d4bf0d43bd52"
},
{
"introduced": "0cc9da26cf5213848410c94e145d1c6991fa2da4"
},
{
"fixed": "6efd1d6bc9e5e406b92bb62e5e5fbf18aad6b7d2"
},
{
"introduced": "89a105c8e6478196cb9dd40371749c339d274f10"
},
{
"fixed": "d315e683357a9b587ba9ef399a8813bcc52fdebb"
},
{
"fixed": "f2c44f411e6382289d8923d07419f9513a5d333d"
},
{
"fixed": "2bc2be793fa417a00073f40777962db9da610b08"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:pomerium:pomerium:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "0.17.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:pomerium:pomerium:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.19.0"
},
{
"fixed": "0.19.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:pomerium:pomerium:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.21.0"
},
{
"fixed": "0.21.4"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:pomerium:pomerium:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.22.0"
},
{
"fixed": "0.22.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:pomerium:pomerium:0.18.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.18.0"
},
{
"last_affected": "0.18.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:pomerium:pomerium:0.20.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0.20.0"
},
{
"last_affected": "0.20.0"
}
],
"source": "CPE_STRING"
},
{
"range": [
{
"fixed": "d315e683357a9b587ba9ef399a8813bcc52fdebb"
}
],
"source": "REFERENCES_COMMIT"
},
{
"range": [
{
"fixed": "0d34e3d00c16d0e951e6e18f1992531cc10c96c6"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.17.4"
},
{
"range": [
{
"fixed": "f2c44f411e6382289d8923d07419f9513a5d333d"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.18.1"
},
{
"range": [
{
"fixed": "d7a4d32505f40f25c0d8ae3de5e2e3527da21bb6"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.19.2"
},
{
"range": [
{
"fixed": "2bc2be793fa417a00073f40777962db9da610b08"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.20.1"
},
{
"range": [
{
"fixed": "84901e4e78427c8ca822fa753072d4bf0d43bd52"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.21.4"
},
{
"range": [
{
"fixed": "6efd1d6bc9e5e406b92bb62e5e5fbf18aad6b7d2"
}
],
"source": "REFERENCES_TAG",
"original_tag": "v0.22.2"
}
]
}
}
],
"versions": [
"0.18.0",
"0.20.0",
"v0.22.1",
"v0.22.0",
"v0.21.3",
"v0.21.2",
"v0.21.1",
"v0.21.0",
"v0.20.0",
"v0.19.1",
"v0.19.0",
"v0.18.0",
"v0.17.3",
"v0.17.2",
"v0.17.1",
"v0.17.0",
"v0.16.0",
"v0.15.6",
"v0.15.0",
"v0.14.0",
"v0.14.0-rc2",
"v0.12.0",
"v0.11.0",
"v0.11.0-rc2",
"v0.11.0-rc1",
"v0.10.0",
"v0.10.0-rc3",
"v0.10.0-rc2",
"v0.10.0-rc1",
"v0.9.0",
"v0.8.0",
"v0.7.2",
"v0.7.1",
"v0.7.0",
"v0.6.0",
"v0.5.0",
"v0.4.0",
"v0.3.0",
"v0.2.0",
"v0.1.0",
"v0.0.5",
"v0.0.4",
"v0.0.3",
"v0.0.2",
"v0.0.1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-33189.json"
}
}
],
"modified": "2026-10-28T02:30:49.966502394Z",
"provider": "osv",
"references": [
"https://github.com/pomerium/pomerium/releases/tag/v0.17.4",
"https://github.com/pomerium/pomerium/releases/tag/v0.18.1",
"https://github.com/pomerium/pomerium/releases/tag/v0.19.2",
"https://github.com/pomerium/pomerium/releases/tag/v0.20.1",
"https://github.com/pomerium/pomerium/releases/tag/v0.21.4",
"https://github.com/pomerium/pomerium/releases/tag/v0.22.2",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33189.json",
"https://github.com/pomerium/pomerium/security/advisories/GHSA-pvrc-wvj2-f59p",
"https://nvd.nist.gov/vuln/detail/CVE-2023-33189",
"https://github.com/pomerium/pomerium/commit/d315e683357a9b587ba9ef399a8813bcc52fdebb"
],
"provider_metadata": {
"cwe_ids": [
"CWE-285"
],
"cna_assigner": "GitHub_M",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33189.json"
}
},
"related_cves": [
{
"value": "CVE-2023-33189",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 518315,
"published_at": "2023-05-30T05:39:45.132+00:00"
}