CVE-2021-36758

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be used to perform privilege escalation. Malicious users authorized to create Secrets Automation access tokens can create tokens that have access beyond what the user is authorized to access, but limited to the existing authorizations of the Secret Automation the token is created in.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-20CWE-863

Affected software

No affected versions have been published.

Timeline

Published
Jul 16, 2021
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2021

CVE-2021-367606.1In accountrecoveryendpoint/recoverpassword.do in WSO2 Identity Server 5.7.0, it is possible to perform a DOM-Based XSS attack affecting the CVE-2021-367615.3The GeoAnalytics feature in Qlik Sense April 2020 patch 4 allows SSRF.CVE-2021-367627.5An issue was discovered in HCC Embedded InterNiche NicheStack through 4.3. The tfshnd():tftpsrv.c TFTP packet processing function doesn't enCVE-2021-367637.5In CODESYS V3 web server before 3.5.17.10, files or directories are accessible to External Parties.CVE-2021-367647.5In CODESYS Gateway V3 before 3.5.17.10, there is a NULL Pointer Dereference. Crafted communication requests may cause a Null pointer dereferCVE-2021-367657.5In CODESYS EtherNetIP before 4.1.0.0, specific EtherNet/IP requests may cause a null pointer dereference in the downloaded vulnerable EtherNCVE-2021-367667.2Concrete5 through 8.5.5 deserializes Untrusted Data. The vulnerable code is located within the controllers/single_page/dashboard/system/enviCVE-2021-367679.8In Digi RealPort through 4.10.490, authentication relies on a challenge-response mechanism that gives access to the server password, making CVE-2021-367695.3A reordering issue exists in Telegram before 7.8.1 for Android, Telegram before 7.8.3 for iOS, and Telegram Desktop before 2.8.8. An attackeCVE-2021-36776.5A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authentCVE-2021-367707.8Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in tCVE-2021-367716.1Zoho ManageEngine ADManager Plus before 7110 allows reflected XSS.