CVE-2024-42490

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

authentik is an open-source Identity Provider. Several API endpoints can be accessed by users without correct authentication/authorization. The main API endpoints affected by this are /api/v3/crypto/certificatekeypairs/<uuid>/view_certificate/, /api/v3/crypto/certificatekeypairs/<uuid>/view_private_key/, and /api/v3/.../used_by/. Note that all of the affected API endpoints require the knowledge of the ID of an object, which especially for certificates is not accessible to an unprivileged user. Additionally the IDs for most objects are UUIDv4, meaning they are not easily guessable/enumerable. authentik 2024.4.4, 2024.6.4 and 2024.8.0 fix this issue.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N

Weakness enumeration

CWE-285

Affected software

No affected versions have been published.

Timeline

Published: Aug 22, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-424915.7Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.24.3, 20.9.3, and 21.4.3 of Asterisk and versions 18.9-cert12 CVE-2024-424926.7Uncontrolled search path element in some BIOS and System Firmware Update Package for Intel(R) Server M50FCP family before version R01.02.000 CVE-2024-424935.3Dorsett Controls InfoScan is vulnerable due to a leak of possible sensitive information through the response headers and the rendered Java CVE-2024-424947.5Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x contains a a feature that could enable sub accounts or attackers to view an CVE-2024-424957.5Credentials to access device configuration were transmitted using an unencrypted protocol. These credentials would allow read-only access to CVE-2024-424962.4Smart-tab Android app installed April 2023 or earlier contains an issue with plaintext storage of a password. If this vulnerability is explo CVE-2024-424974.9Mattermost versions 9.9.x <= 9.9.1, 9.5.x <= 9.5.7, 9.10.x <= 9.10.0, 9.8.x <= 9.8.2 fail to properly enforce permissions which allows a use CVE-2024-424995.3Improper limitation of a pathname to a restricted directory ('Path Traversal') issue exists in FitNesse releases prior to 20241026. If this CVE-2024-42508.8A vulnerability was found in Tenda i21 1.0.0.14(4656). It has been declared as critical. Affected by this vulnerability is the function form CVE-2024-425009.3HPE has identified a denial of service vulnerability in HPE HP-UX System's Network File System (NFSv4) services.CVE-2024-425017.2An authenticated Path Traversal vulnerabilities exists in the ArubaOS. Successful exploitation of this vulnerability allows an attacker to i CVE-2024-425027.2Authenticated command injection vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability re