CVE-2023-5521

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Incorrect Authorization in GitHub repository tiann/kernelsu prior to v0.6.9.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-863

Affected software

Vendor	Product	Versions
tiann	tiann/kernelsu	>= unspecified, < v0.6.9
tiann	kernelsu	< 0.6.9

References

https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bdaPatch
https://huntr.dev/bounties/d438eff7-4e24-45e0-bc75-d3a5b3ab2ea1Exploit, Patch, Third Party Advisory
https://github.com/tiann/kernelsu/commit/a22959beae1aad96b1f72710a5daadf529c41bdaPatch
https://huntr.dev/bounties/d438eff7-4e24-45e0-bc75-d3a5b3ab2ea1Exploit, Patch, Third Party Advisory

Timeline

Published: Oct 11, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-55224.3Mattermost Mobile fails to limit the maximum number of Markdown elements in a post allowing an attacker to send a post with hundreds of emoj CVE-2023-55237.8Execution of downloaded content flaw in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS CVE-2023-55247.3Insufficient blacklisting in M-Files Web Companion before release version 23.10 and LTS Service Release Versions before 23.8 LTS SR1 allows CVE-2023-55254.3The Limit Login Attempts Reloaded WordPress plugin before 2.25.26 is missing authorization on the `toggle_auto_update` AJAX action, allowing CVE-2023-55278.0The Business Directory Plugin plugin for WordPress is vulnerable to CSV Injection in versions up to, and including, 6.4.3 via the class-csv-CVE-2023-55288.8A security issue was discovered in Kubernetes where a user that can create pods and persistent volumes on Windows nodes may be able to escal CVE-2023-55294.8The Advanced Page Visit Counter WordPress plugin before 8.0.6 does not sanitise and escape some of its settings, which could allow high pri CVE-2023-55304.8The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege CVE-2023-55314.3The Thumbnail Slider With Lightbox plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. T CVE-2023-55324.3The ImageMapper plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.6. This is due to mis CVE-2023-55339.8The AI ChatBot plugin for WordPress is vulnerable to unauthorized use of AJAX actions due to missing capability checks on the corresponding CVE-2023-55345.4The AI ChatBot plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.8.9 and 4.9.2. This is d