CVE-2022-29773: Access control issue in AlekSIS-Core
Summary
CVE-2022-29773: Access control issue in AlekSIS-Core. Affects aleksis-core versions < 2.9. Fixed in 2.9. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AlekSIS-Core is a Python package available on PyPI that provides core functionality for the AlekSIS project. It includes utilities for authentication, access control, and other common tasks. AlekSIS-Core is widely used in various applications and systems.
Vulnerability Detail
The vulnerability identified as CVE-2022-29773 is an access control issue in AlekSIS-Core v2.8.1 and below. The specific file affected is aleksis/core/util/auth_helpers.py. The vulnerability allows attackers to access arbitrary scopes if no allowed scopes are specifically set. This means that an attacker could potentially gain unauthorized access to sensitive resources or perform actions beyond their intended privileges. The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
How To Fix
Latest published version: 4.1.0.dev2 as of 22 Oct 2026
pip install --upgrade "aleksis-core==4.1.0.dev2"Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
2.9
This is the first release that contains the fix.
pip install --upgrade "aleksis-core==2.9"Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to upgrade to the fixed version of AlekSIS-Core to mitigate the risk.
Conclusion
In conclusion, CVE-2022-29773 is an access control issue in AlekSIS-Core v2.8.1 and below that allows attackers to access arbitrary scopes if no allowed scopes are specifically set. The vulnerability can lead to unauthorized access to sensitive resources or actions beyond intended privileges. It is crucial to upgrade to AlekSIS-Core v2.9 or later to fix this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for aleksis-core →
FAQ
AlekSIS-Core is a Python package that provides core functionality for the AlekSIS project. It includes utilities for authentication, access control, and other common tasks.
The vulnerability allows attackers to access arbitrary scopes if no allowed scopes are specifically set. This can lead to unauthorized access to sensitive resources or actions beyond intended privileges.
The severity of this vulnerability is rated as MODERATE with a CVSS score of 6.5.
To fix this vulnerability, it is recommended to upgrade to AlekSIS-Core v2.9 or later, which includes the necessary fix for the access control issue.
There is no known workaround for this vulnerability. It is crucial to upgrade to the fixed version of AlekSIS-Core to mitigate the risk.
