CVE-2019-16097: Missing Authorization in Harbor
Summary
CVE-2019-16097: Missing Authorization in Harbor. Affects github.com/goharbor/harbor versions >= 1.7.0, < 1.9.0-rc1. Fixed in 1.9.0-rc1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Harbor is an open-source container image registry that provides secure storage and distribution of container images. It is written in Go and is widely used in containerized environments. The vulnerability in Harbor version 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API. This means that unauthorized users can gain administrative privileges, potentially leading to unauthorized access, data breaches, and other security issues.
Vulnerability Detail
The vulnerability arises from a flaw in the core/api/user.go file of Harbor. It allows non-admin users to exploit the POST /api/users API to create admin accounts. This means that any user with non-admin privileges can elevate their privileges and gain administrative access to the Harbor system. The vulnerability has a CVSS score of 6.5, indicating a moderate severity level. The CWE ID associated with this vulnerability is CWE-862.
How To Fix
Latest published version: v2.15.4+incompatible as of 23 Oct 2026
go get github.com/goharbor/harbor@v2.15.4+incompatibleUpgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
1.9.0-rc1
This is the first release that contains the fix.
go get github.com/goharbor/harbor@v1.9.0-rc1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version to mitigate the risk.
Conclusion
The vulnerability in Harbor allows non-admin users to create admin accounts, leading to unauthorized access and potential security issues. To mitigate this vulnerability, it is recommended to upgrade to Harbor version 1.9.0-rc1 or later. Upgrading will patch the vulnerability and ensure the system's security. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/goharbor/harbor →
FAQ
The vulnerability allows non-admin users to create admin accounts, potentially granting them unauthorized access and administrative privileges. This can lead to unauthorized actions, data breaches, and other security issues.
Harbor versions 1.7.0 through 1.8.2 are affected by this vulnerability. Users of these versions should upgrade to the fixed version to secure their systems.
No, there is no known workaround for this vulnerability. Upgrading to the fixed version is the recommended solution.
The CVSS score of this vulnerability is 6.5, indicating a moderate severity level.
There are no known exploits for this vulnerability at the time of this report. However, it is crucial to upgrade to the fixed version to prevent potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/goharbor/harbor.
