CVE-2023-32669

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums. This vulnerability can be exploited by changing the album identification (id).

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-639

Affected software

No affected versions have been published.

Timeline

Published: Oct 3, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-32678.8When adding a remote backup location, an authenticated user can pass arbitrary OS commands through the username field. The username is passe CVE-2023-326705.4Cross-Site Scripting vulnerability in BuddyBoss 2.2.9 version , which could allow a local attacker with basic privileges to execute a mal CVE-2023-326715.4A stored XSS vulnerability has been found on BuddyBoss Platform affecting version 2.2.9. This vulnerability allows an attacker to store a ma CVE-2023-326724.3An Incorrect authorisation check in SQLLab in Apache Superset versions up to and including 2.1.0. This vulnerability allows an authenticated CVE-2023-326739.8Certain versions of HP PC Hardware Diagnostics Windows, HP Image Assistant, and HP Thunderbolt Dock G2 Firmware are potentially vulnerable t CVE-2023-326749.8Certain versions of HP PC Hardware Diagnostics Windows are potentially vulnerable to buffer overflow.CVE-2023-326755.3Vyper is a pythonic Smart Contract Language for the ethereum virtual machine. In contracts with more than one regular nonpayable function, i CVE-2023-326767.2Autolab is a course management service that enables auto-graded programming assignments. A Tar slip vulnerability was found in the Install a CVE-2023-326773.1Zulip is an open-source team collaboration tool with unique topic-based threading. Zulip administrators can configure Zulip to limit who can CVE-2023-326786.5Zulip is an open-source team collaboration tool with topic-based threading that combines email and chat. Users who used to be subscribed to CVE-2023-326797.2Craft CMS is an open source content management system. In affected versions of Craft CMS an unrestricted file extension may lead to Remote C CVE-2023-32687.1An out of bounds (OOB) memory access flaw was found in the Linux kernel in relay_file_read_start_pos in kernel/relay.c in the relayfs. This