CVE-2023-40020

HighCVSS 8.3/10Last modified Jun 17, 2026

Description

PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctly verify whether the user was an administrator (High Level) or moderator (Low Level) causing the request to continue processing. The response would be a 403 with ADMIN_ONLY, however, next() would call leading to any updates/changes in the route to process. This issue has been addressed in version 3.2.49. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:H

Weakness enumeration

CWE-287

Affected software

Vendor	Product	Versions
PrivateUploader	PrivateUploader	< 3.2.49

References

Timeline

Published: Aug 14, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-400215.3Oppia is an online learning platform. When comparing a received CSRF token against the expected token, Oppia uses the string equality operat CVE-2023-400227.8Rizin is a UNIX-like reverse engineering framework and command-line toolset. Versions 0.6.0 and prior are vulnerable to integer overflow in CVE-2023-400237.5yaklang is a programming language designed for cybersecurity. The Yak Engine has been found to contain a local file inclusion (LFI) vulnerab CVE-2023-400246.1ScanCode.io is a server to script and automate software composition analysis pipelines. In the `/license/` endpoint, the detailed view key i CVE-2023-400257.1Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. All versions of Argo CD starting from version 2.6.0 have a bug whe CVE-2023-400264.3Argo CD is a declarative continuous deployment framework for Kubernetes. In Argo CD versions prior to 2.3 (starting at least in v0.1.0, but CVE-2023-400275.3Keystone is an open source headless CMS for Node.js — built with GraphQL and React. When `ui.isAccessAllowed` is set as `undefined`, the `ad CVE-2023-400286.5Ghost is an open source content management system. Versions prior to 5.59.1 are subject to a vulnerability which allows authenticated users CVE-2023-400299.6Argo CD is a declarative continuous deployment for Kubernetes. Argo CD Cluster secrets might be managed declaratively using Argo CD / kubect CVE-2023-40036.8One Identity Password Manager version 5.9.7.1 - An unauthenticated attacker with physical access to a workstation may upgrade privileges to CVE-2023-400306.1Cargo downloads a Rust project’s dependencies and compiles the project. Starting in Rust 1.60.0 and prior to 1.72, Cargo did not escape Carg CVE-2023-400317.8Notepad++ is a free and open-source source code editor. Versions 8.5.6 and prior are vulnerable to heap buffer write overflow in `Utf8_16_Re