CVE-2021-35970

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Talk 4 in Coral before 4.12.1 allows remote attackers to discover e-mail addresses and other sensitive information via GraphQL because permission checks use an incorrect data type.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-697

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://docs.coralproject.net/coral/api/graphql/#UserExploit, Vendor Advisory
https://github.com/coralproject/talk/compare/v4.12.0...v4.12.1Patch, Third Party Advisory
https://github.com/coralproject/talk/issues/3600Exploit, Third Party Advisory
https://github.com/coralproject/talk/pull/3599Patch, Third Party Advisory
https://docs.coralproject.net/coral/api/graphql/#UserExploit, Vendor Advisory
https://github.com/coralproject/talk/compare/v4.12.0...v4.12.1Patch, Third Party Advisory
https://github.com/coralproject/talk/issues/3600Exploit, Third Party Advisory
https://github.com/coralproject/talk/pull/3599Patch, Third Party Advisory

Timeline

Published: Jun 30, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-359719.8Veeam Backup and Replication 10 before 10.0.1.4854 P20210609 and 11 before 11.0.0.837 P20210507 mishandles deserialization during Microsoft CVE-2021-359739.8NETGEAR WAC104 devices before 1.0.4.15 are affected by an authentication bypass vulnerability in /usr/sbin/mini_httpd, allowing an unauthent CVE-2021-359755.3Absolute path traversal vulnerability in the Systematica SMTP Adapter component (up to v2.0.1.101) in Systematica Radius (up to v.3.9.256.77 CVE-2021-359766.1The feature to preview a website in Plesk Obsidian 18.0.0 through 18.0.32 on Linux is vulnerable to reflected XSS via the /plesk-site-previe CVE-2021-359779.8An issue was discovered in Digi RealPort for Windows through 4.8.488.0. A buffer overflow exists in the handling of ADDP discovery response CVE-2021-359789.8An issue was discovered in Digi TransPort DR64, SR44 VC74, and WR. The ZING protocol allows arbitrary remote command execution with SUPER pr CVE-2021-359798.1An issue was discovered in Digi RealPort through 4.8.488.0. The 'encrypted' mode is vulnerable to man-in-the-middle attacks and does not per CVE-2021-35985.5There's a flaw in OpenEXR's ImfDeepScanLineInputFile functionality in versions prior to 3.0.5. An attacker who is able to submit a crafted f CVE-2021-359807.8Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by a Pat CVE-2021-359817.8Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Us CVE-2021-359827.3Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an Un CVE-2021-359837.8Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Us