CVE-2021-22538: Privilege Escalation in rbac
Summary
CVE-2021-22538: Privilege escalation in rbac. Affects github.com/google/exposure-notifications-verification-server versions < 0.23.1. Fixed in 0.23.1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/google/exposure-notifications-verification-server, which is written in Go. This package is responsible for managing user permissions and access control in a verification server. It allows users to create and manage other users with different levels of privileges. However, a vulnerability has been discovered in the package that allows a user with UserWrite permissions to create another user with higher privileges than their own. This vulnerability arises due to insufficient checks on the allowed set of permissions. The event of privilege escalation is logged in the Event Log.
Vulnerability Detail
The vulnerability (CVE-2021-22538) allows an attacker with UserWrite permissions to create a user with higher privileges than their own. By crafting a malicious request or using a malicious proxy, the attacker can exploit this vulnerability. The impact of this vulnerability is significant as it allows unauthorized users to gain elevated privileges within the system. The vulnerability has a CVSS score of 8.8, indicating a high severity level. The Common Weakness Enumeration (CWE) ID associated with this vulnerability is CWE-276.
How To Fix
Latest published version: v1.17.0 as of 23 Oct 2026
go get github.com/google/exposure-notifications-verification-server@v1.17.0Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
0.23.1
This is the first release that contains the fix.
go get github.com/google/exposure-notifications-verification-server@v0.23.1Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If immediate upgrade is not possible, a workaround is to manually audit users with UserWrite permissions and closely monitor the Event Log for any unauthorized user creation or suspicious activity. This can help identify and mitigate potential privilege escalation attempts.
Conclusion
In conclusion, the github.com/google/exposure-notifications-verification-server package is vulnerable to privilege escalation, allowing unauthorized users to gain elevated privileges within the system. It is crucial to upgrade to the fixed versions (0.24.0 or 0.23.1) to mitigate this vulnerability. Alternatively, users can implement the provided workaround and regularly monitor the Event Log for any suspicious activity. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for github.com/google/exposure-notifications-verification-server →
FAQ
The impact of this vulnerability is that unauthorized users can gain elevated privileges within the system, potentially leading to unauthorized access and control over sensitive data or functionality.
To fix this vulnerability, it is recommended to upgrade to version 0.24.0 or 0.23.1 of the github.com/google/exposure-notifications-verification-server package. These versions include the necessary checks to prevent privilege escalation.
If immediate upgrade is not possible, a workaround is to manually audit users with UserWrite permissions and closely monitor the Event Log for any unauthorized user creation or suspicious activity.
The CVSS score of this vulnerability is 8.8, indicating a high severity level.
Yes, the CWE ID associated with this vulnerability is CWE-276.
References
Related vulnerabilities
Recent vulnerabilities recorded for github.com/google/exposure-notifications-verification-server.
