CVE-2022-34621

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Mealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference (IDOR) vulnerability which allows attackers to modify user passwords and other attributes via modification of the user_id parameter.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-639

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://cwe.mitre.org/data/definitions/639.htmlThird Party Advisory
https://docs.mealie.io/changelog/v0.5.6/Release Notes, Third Party Advisory
https://gainsec.com/2022/08/19/cve-2022-34615-cve-2022-34621-cve-2022-34623-cve-2022-34624/Third Party Advisory
https://hub.docker.com/r/hkotel/mealieProduct, Third Party Advisory
https://portswigger.net/web-security/access-control/idorThird Party Advisory
https://cwe.mitre.org/data/definitions/639.htmlThird Party Advisory
https://docs.mealie.io/changelog/v0.5.6/Release Notes, Third Party Advisory
https://gainsec.com/2022/08/19/cve-2022-34615-cve-2022-34621-cve-2022-34623-cve-2022-34624/Third Party Advisory
https://hub.docker.com/r/hkotel/mealieProduct, Third Party Advisory
https://portswigger.net/web-security/access-control/idorThird Party Advisory

Timeline

Published: Aug 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-346245.9Mealie1.0.0beta3 does not terminate download tokens after a user logs out, allowing attackers to perform a man-in-the-middle attack via a cr CVE-2022-346257.2Mealie1.0.0beta3 was discovered to contain a Server-Side Template Injection vulnerability, which allows attackers to execute arbitrary code CVE-2022-34639.8The Contact Form Plugin WordPress plugin before 4.3.13 does not validate and escape fields when exporting form entries as CSV, leading to a CVE-2022-346329.1Rocket-Chip commit 4f8114374d8824dfdec03f576a8cd68bebce4e56 was discovered to contain insufficient cryptography via the component /rocket/Ro CVE-2022-346335.5CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted sfence.vma instructions rather create an exce CVE-2022-346345.5CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a executes crafted or incorrectly formatted det instructions rather create an exception.CVE-2022-346359.8The mstatus.sd field in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a does not update when the mstatus.fs field is set to Dirty.CVE-2022-346365.5CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a and RISCV-Boom commit ad64c5419151e5e886daee7084d8399713b46b4b implements the incorrect CVE-2022-346375.5CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a implements an incorrect exception type when an illegal virtual address is loaded.CVE-2022-346395.5CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a treats non-standard fence instructions as illegal which can affect the function of the CVE-2022-34646.1A vulnerability classified as problematic has been found in puppyCMS up to 5.1. This affects an unknown part of the file /admin/settings.php CVE-2022-346405.5The *tval of ecall/ebreak in CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a was discovered to be incorrect.