Medium
Improper authorization check in the server component
Type: advisorySources: OSV
An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confidentiality and availability for the affected customer/tenant.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2023-1832
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 4 Nov 2026, 08:35 UTC · Revision 1
Source evidence
Improper authorization check in the server component
core-osv · Original sourcePublished 4 Oct 2023, 13:05 UTC
An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confidentiality and availability for the affected customer/tenant.
osv:CVE-2023-1832
Complete source record
{
"id": "23abc04e014e6e66eca2bd45c0f1205a77eb261ca14901d250a967bf94bf00ca",
"url": "https://osv.dev/vulnerability/CVE-2023-1832",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "Improper authorization check in the server component",
"summary": "An improper access control flaw was found in Candlepin. An attacker can create data scoped under another customer/tenant, which can result in loss of confidentiality and availability for the affected customer/tenant.",
"evidence": "osv:CVE-2023-1832",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2023-1832",
"aliases": [
"CVE-2023-1832"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/candlepin/candlepin",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"fixed": "114947cfdffc27fa426c6ac5a681471029b46c3f"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:candlepinproject:candlepin:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "0"
},
{
"fixed": "4.3.7-3"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"candlepin-4.3.7-2",
"candlepin-4.3.7-1",
"candlepin-4.2.15-1",
"candlepin-4.3.6-1",
"candlepin-4.3.5-1",
"candlepin-4.3.4-1",
"candlepin-4.3.3-1",
"candlepin-4.3.2-1",
"candlepin-4.3.1-1",
"candlepin-4.3.0-1",
"candlepin-4.2.14-1",
"candlepin-4.2.13-1",
"candlepin-4.2.12-1",
"candlepin-4.2.11-1",
"candlepin-4.2.10-1",
"candlepin-4.2.9-1",
"candlepin-4.2.8-1",
"candlepin-4.2.7-1",
"candlepin-4.2.6-1",
"candlepin-4.2.5-1",
"candlepin-4.2.4-1",
"candlepin-4.2.3-1",
"candlepin-4.2.2-1",
"candlepin-4.2.1-1",
"candlepin-4.2.0-1",
"candlepin-4.1.11-1",
"candlepin-4.1.10-1",
"candlepin-4.1.9-1",
"candlepin-4.1.8-1",
"candlepin-4.1.7-1",
"candlepin-4.1.6-1",
"candlepin-4.1.5-1",
"candlepin-4.1.4-1",
"candlepin-4.1.3-1",
"candlepin-4.1.2-1",
"candlepin-4.0.1-1",
"candlepin-3.2.13-1",
"candlepin-4.0.0-1",
"candlepin-3.2.12-1",
"candlepin-3.2.11-1",
"candlepin-3.2.10-1",
"candlepin-3.2.9-1",
"candlepin-3.2.8-1",
"candlepin-3.2.7-1",
"candlepin-3.2.6-1",
"candlepin-3.2.5-1",
"candlepin-3.2.4-1",
"candlepin-3.2.3-1",
"candlepin-3.2.2-1",
"candlepin-3.2.1-1",
"candlepin-3.2.0-1",
"candlepin-3.1.21-1",
"candlepin-3.1.19-1",
"candlepin-3.1.20-1",
"candlepin-3.1.18-1",
"candlepin-3.1.17-1",
"candlepin-3.1.16-1",
"candlepin-3.1.15-1",
"candlepin-3.1.13-1",
"candlepin-3.1.14-1",
"candlepin-3.1.12-1",
"candlepin-3.1.6-1",
"candlepin-3.1.11-1",
"candlepin-3.1.10-1",
"candlepin-3.1.9-1",
"candlepin-3.1.8-1",
"candlepin-3.1.7-1",
"candlepin-3.1.5-1",
"candlepin-3.1.4-1",
"candlepin-3.1.3-1",
"candlepin-3.1.2-1",
"candlepin-3.1.1-1",
"candlepin-3.1.0-1",
"candlepin-3.0.0-1",
"candlepin-2.12.0-1",
"candlepin-2.11.2-1",
"candlepin-2.11.1-1",
"candlepin-2.11.0-1",
"candlepin-2.9.17-1",
"candlepin-2.10.0-1",
"candlepin-2.9.15-1",
"candlepin-2.9.16-1",
"candlepin-2.9.14-1",
"candlepin-2.9.13-1",
"candlepin-2.9.12-1",
"candlepin-2.9.11-1",
"candlepin-2.9.10-1",
"candlepin-2.9.9-1",
"candlepin-2.9.8-1",
"candlepin-2.9.7-1",
"candlepin-2.9.6-1",
"candlepin-2.9.5-1",
"candlepin-2.9.4-1",
"candlepin-2.9.3-1",
"candlepin-2.9.2-1",
"candlepin-2.9.1-1",
"candlepin-2.9.0-1",
"candlepin-2.8.1-1",
"candlepin-2.7.2-1",
"candlepin-2.8.0-1",
"candlepin-2.7.1-1",
"candlepin-2.6.6-1",
"candlepin-2.7.0-1",
"candlepin-2.6.5-1",
"candlepin-2.6.4-1",
"candlepin-2.6.3-1",
"candlepin-2.6.2-1",
"candlepin-2.6.1-1",
"candlepin-2.5.7-1",
"candlepin-2.6.0-1",
"candlepin-2.5.6-1",
"candlepin-2.5.5-1",
"candlepin-2.5.4-1",
"candlepin-2.5.3-1",
"candlepin-2.5.2-1",
"candlepin-2.5.1-1",
"candlepin-2.5.0-1",
"candlepin-2.3.5-1",
"candlepin-2.3.4-1",
"candlepin-2.3.3-1",
"candlepin-2.3.2-1",
"candlepin-2.3.1-1",
"candlepin-2.3.0-1",
"candlepin-2.1.1-1",
"candlepin-2.0.30-1",
"candlepin-2.1.0-1",
"candlepin-2.0.29-1",
"candlepin-2.0.28-1",
"candlepin-2.0.27-1",
"candlepin-2.0.26-1",
"candlepin-2.0.25-1",
"candlepin-2.0.24-1",
"candlepin-2.0.23-1",
"candlepin-2.0.22-1",
"candlepin-2.0.21-1",
"candlepin-2.0.20-1",
"candlepin-2.0.19-1",
"candlepin-2.0.18-1",
"candlepin-2.0.17-1",
"candlepin-2.0.16-1",
"candlepin-2.0.15-1",
"candlepin-2.0.14-1",
"candlepin-2.0.12-1",
"candlepin-2.0.13-1",
"candlepin-2.0.11-1",
"candlepin-2.0.10-1",
"candlepin-2.0.9-1",
"gutterball-2.0.5-1",
"candlepin-common-2.0.3-1",
"candlepin-2.0.8-1",
"gutterball-2.0.4-1",
"candlepin-common-2.0.2-1",
"candlepin-2.0.7-1",
"candlepin-2.0.6-1",
"candlepin-2.0.5-1",
"candlepin-2.0.4-1",
"candlepin-2.0.3-1",
"gutterball-2.0.3-1",
"gutterball-2.0.2-1",
"gutterball-2.0.1-1",
"candlepin-common-2.0.1-1",
"candlepin-2.0.2-1",
"candlepin-2.0.1-1",
"gutterball-2.0.0-1",
"candlepin-2.0.0-1",
"candlepin-common-2.0.0-1",
"gutterball-1.0.16-1",
"candlepin-0.9.50-1",
"candlepin-common-1.0.23-1",
"candlepin-0.9.49-1",
"gutterball-1.0.14-1",
"gutterball-1.0.15-1",
"candlepin-0.9.48-1",
"gutterball-1.0.13-1",
"candlepin-0.9.47-1",
"candlepin-0.9.46-1",
"candlepin-0.9.45-1",
"candlepin-0.9.43-1",
"candlepin-0.9.44-1",
"candlepin-common-1.0.22-1",
"gutterball-1.0.12-1",
"gutterball-1.0.11-1",
"candlepin-0.9.42-1",
"candlepin-common-1.0.21-1",
"gutterball-1.0.10-1",
"candlepin-0.9.41-1",
"candlepin-0.9.40-1",
"candlepin-common-1.0.20-1",
"candlepin-0.9.39-1",
"gutterball-1.0.9-1",
"gutterball-1.0.8-1",
"candlepin-common-1.0.19-1",
"candlepin-0.9.38-1",
"candlepin-common-1.0.18-1",
"gutterball-1.0.7-1",
"candlepin-0.9.37-1",
"candlepin-common-1.0.17-1",
"gutterball-1.0.6-1",
"gutterball-1.0.4-1",
"gutterball-1.0.5-1",
"gutterball-1.0.3-1",
"candlepin-common-1.0.16-1",
"gutterball-1.0.2-1",
"candlepin-common-1.0.15-1",
"candlepin-0.9.36-1",
"gutterball-1.0.1-1",
"candlepin-common-1.0.14-1",
"candlepin-0.9.35-1",
"candlepin-common-1.0.13-1",
"candlepin-common-1.0.12-1",
"candlepin-common-1.0.11-1",
"candlepin-common-1.0.10-1",
"candlepin-0.9.34-1",
"candlepin-0.9.33-1",
"candlepin-common-1.0.9-1",
"candlepin-0.9.23-1",
"candlepin-0.9.26-1",
"candlepin-0.9.32-1",
"candlepin-common-1.0.8-1",
"candlepin-0.9.31-1",
"candlepin-0.9.30-1",
"candlepin-0.9.29-1",
"candlepin-common-1.0.7-1",
"candlepin-common-1.0.6-1",
"candlepin-0.9.28-1",
"candlepin-common-1.0.5-1",
"candlepin-common-1.0.4-1",
"candlepin-common-1.0.3-1",
"candlepin-0.9.27-1",
"candlepin-common-1.0.2-1",
"candlepin-0.9.25-1",
"candlepin-0.9.24-1",
"candlepin-common-1.0.1-1",
"candlepin-0.9.22-1",
"candlepin-0.9.21-1",
"candlepin-0.9.20-1",
"candlepin-0.9.6-1",
"candlepin-0.9.19-1",
"candlepin-0.9.18-1",
"candlepin-0.9.17-1",
"candlepin-0.9.15-1",
"candlepin-0.9.16-1",
"candlepin-0.9.14-1",
"candlepin-0.9.13-1",
"candlepin-0.9.12-1",
"candlepin-0.9.11-1",
"candlepin-0.9.10-1",
"candlepin-0.9.9-1",
"candlepin-0.9.8-1",
"candlepin-0.9.7-1",
"candlepin-0.9.5-1",
"candlepin-0.9.4-1",
"candlepin-0.9.2-1",
"candlepin-0.8.34-1",
"candlepin-0.8.26-1",
"candlepin-0.9.1-1",
"candlepin-0.8.33-1",
"candlepin-0.8.32-1",
"candlepin-0.8.31-1",
"candlepin-0.8.29-1",
"candlepin-0.8.30-1",
"candlepin-0.8.28-1",
"candlepin-0.8.27-1",
"candlepin-0.8.25-1",
"candlepin-0.8.24-1",
"candlepin-0.8.23-1",
"candlepin-0.8.21-1",
"candlepin-0.8.22-1",
"candlepin-0.8.20-1",
"candlepin-0.8.5-1",
"candlepin-0.8.15-1",
"candlepin-0.8.19-1",
"candlepin-0.8.18-1",
"candlepin-0.8.17-1",
"candlepin-0.8.16-1",
"candlepin-0.8.14-1",
"candlepin-0.8.13-1",
"candlepin-0.8.12-1",
"candlepin-0.8.11-1",
"candlepin-0.8.10-1",
"candlepin-0.8.9-1",
"candlepin-0.8.8-1",
"candlepin-0.8.7-1",
"candlepin-0.8.6-1",
"candlepin-0.7.29-1",
"candlepin-0.8.4-1",
"candlepin-0.8.3-1",
"candlepin-0.8.2-1",
"candlepin-0.8.1-1",
"candlepin-0.8.0-1",
"candlepin-0.7.28-1",
"candlepin-0.7.27-1",
"candlepin-0.7.26-1",
"candlepin-0.7.25-1",
"candlepin-0.7.24-1",
"candlepin-0.7.23-1",
"candlepin-0.7.22-1",
"candlepin-0.7.21-1",
"candlepin-0.7.19-1",
"candlepin-0.7.13-1",
"candlepin-0.7.18-1",
"candlepin-0.7.17-1",
"candlepin-0.7.16-1",
"candlepin-0.7.15-1",
"candlepin-0.7.14-1",
"candlepin-0.7.3-1",
"candlepin-0.7.8-1",
"candlepin-0.7.12-1",
"candlepin-0.7.11-1",
"candlepin-0.7.10-1",
"candlepin-0.7.9-1",
"candlepin-0.7.7-1",
"candlepin-0.7.6-1",
"candlepin-0.7.5-1",
"candlepin-0.7.4-1",
"candlepin-0.6.5-1",
"candlepin-0.7.2-1",
"candlepin-0.7.1-1",
"candlepin-0.6.4-1",
"candlepin-0.6.3-1",
"candlepin-0.6.2-1",
"candlepin-0.6.1-1",
"candlepin-0.5.23-1",
"candlepin-0.5.22-1",
"candlepin-0.5.21-1",
"candlepin-0.5.20-1",
"candlepin-0.5.19-1",
"candlepin-0.5.18-1",
"candlepin-0.5.17-1",
"candlepin-0.5.16-1",
"candlepin-0.5.15-1",
"candlepin-0.5.5-1",
"candlepin-0.5.8-1",
"candlepin-0.5.7-1",
"candlepin-0.5.6-1",
"candlepin-0.5.4-1",
"candlepin-0.5.3-1",
"candlepin-0.5.2-1",
"candlepin-0.5.1-1",
"candlepin-0.4.23-1",
"candlepin-0.4.22-1",
"candlepin-0.4.21-1",
"candlepin-0.4.20-1",
"candlepin-0.4.19-1",
"candlepin-0.4.11-1",
"candlepin-0.4.10-1",
"candlepin-0.4.9-1",
"candlepin-0.4.8-1",
"candlepin-0.4.7-1",
"candlepin-0.4.5-1",
"candlepin-0.4.4-1",
"candlepin-0.4.3-1",
"candlepin-0.4.2-1",
"candlepin-0.4.1-1",
"candlepin-0.3.7-1",
"candlepin-0.3.6-1",
"candlepin-0.3.5-1",
"candlepin-0.3.4-1",
"candlepin-0.3.3-1",
"candlepin-0.3.2-1",
"candlepin-0.3.1-1",
"candlepin-0.2.11-1",
"candlepin-0.2.10-1",
"candlepin-0.2.9-1",
"candlepin-0.2.8-1",
"candlepin-0.2.7-1",
"candlepin-0.2.6-1",
"candlepin-0.2.5-1",
"candlepin-0.2.4-1",
"candlepin-0.2.3-1",
"candlepin-0.2.2-1",
"candlepin-0.2.1-1",
"candlepin-0.1.28-1",
"python-rhsm-0.94.13-1",
"candlepin-0.1.27-1",
"python-rhsm-0.94.12-1",
"python-rhsm-0.94.11-1",
"python-rhsm-0.94.10-1",
"candlepin-0.1.25-1",
"python-rhsm-0.94.9-1",
"python-rhsm-0.94.8-1",
"candlepin-0.1.24-1",
"python-rhsm-0.94.7-1",
"python-rhsm-0.94.6-1",
"python-rhsm-0.94.5-1",
"python-rhsm-0.94.4-1",
"python-rhsm-0.94.3-1",
"python-rhsm-0.94.2-1",
"python-rhsm-0.94.1-1",
"candlepin-0.1.20-1",
"candlepin-0.1.19-1",
"candlepin-0.1.18-1",
"candlepin-0.1.17-1",
"candlepin-0.1.16-1",
"candlepin-0.1.15-1",
"candlepin-0.1.14-1",
"candlepin-0.1.13-1",
"candlepin-0.1.11-1",
"candlepin-0.1.10-1",
"candlepin-0.1.9-1",
"candlepin-0.1.8-1",
"candlepin-0.1.7-1",
"candlepin-0.1.4-1",
"candlepin-0.1.3-1",
"candlepin-0.1.2-1",
"candlepin-0.1.1-1",
"candlepin-0.0.41-1",
"candlepin-0.0.40-1",
"candlepin-0.0.39-1",
"candlepin-0.0.38-1",
"candlepin-0.0.37-1",
"candlepin-0.0.36-1",
"candlepin-0.0.35-1",
"candlepin-0.0.34-1",
"candlepin-0.0.33-1",
"candlepin-0.0.29-1",
"candlepin-0.0.28-1",
"candlepin-0.0.27-1",
"candlepin-0.0.26-1",
"candlepin-0.0.25-1",
"candlepin-0.0.24-1",
"candlepin-0.0.23-1",
"candlepin-0.0.21-1",
"candlepin-0.0.18-1",
"candlepin-0.0.14-1",
"candlepin-0.0.13-1",
"candlepin-0.0.12-1",
"candlepin-0.0.11-1",
"candlepin-0.0.10-1",
"candlepin-0.0.6-1",
"candlepin-0.0.5-1",
"candlepin-0.0.2-1",
"candlepin-0.0.1-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2023-1832.json"
}
}
],
"modified": "2026-10-28T02:30:33.999077436Z",
"provider": "osv",
"references": [
"https://access.redhat.com/downloads/content/package-browser/",
"https://access.redhat.com/security/cve/CVE-2023-1832",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1832.json",
"https://nvd.nist.gov/vuln/detail/CVE-2023-1832",
"https://bugzilla.redhat.com/show_bug.cgi?id=2184364"
],
"provider_metadata": {
"cwe_ids": [
"CWE-284"
],
"cna_assigner": "redhat",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/1xxx/CVE-2023-1832.json"
}
},
"related_cves": [
{
"value": "CVE-2023-1832",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 501178,
"published_at": "2023-10-04T13:05:37.522+00:00"
}