VulertSecurity VulertSecurity

CVE-2024-39323: aimeos/ai-admin-graphql - Improper Access Control Vulnerability Allows Editor to Modify Admin Account

aimeos/ai-admin-graphql Updated 02 Oct 2025

Summary

02/07/2024
CVE-2024-39323
Yes i
High
8.2

CVE-2024-39323: aimeos/ai-admin-graphql improper access control vulnerability allows an editor to modify admin account. Affects aimeos/ai-admin-graphql across 3 version ranges.

>= 2022.04.1, < 2022.10.10 >= 2023.04.1, < 2023.10.6 >= 2024.04.1, < 2024.04.6

Fixed in 2022.10.10, 2023.10.6 or 2024.04.6, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats
SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml
Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile
Javascript package-lock.json · yarn.lock · pnpm-lock.yaml
PHP composer.lock
Python poetry.lock · requirements.txt · Pipfile.lock
Go go.mod
Rust Cargo.lock
Ruby Gemfile.lock
Dart pubspec.lock
C/C++ conan.lock
Elixir mix.lock
Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

A free account is created for continuous monitoring. By scanning, you agree to our Terms & Conditions.

Sponsored Devnack Your last release was probably never penetration tested Manual testing by engineers who build software, not an auditor's checklist. Trusted by teams at Swift and Google Talk to Devnack

Background

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. It provides functionality for managing admin accounts in the back end of the application.

Vulnerability Detail

Starting in version 2022.04.01 and prior to versions 2022.10.10, 2023.10.6, and 2024.04.6, an improper access control vulnerability exists in aimeos/ai-admin-graphql. This vulnerability allows an editor to modify and take over an admin account in the back end. It poses a high risk as it can lead to unauthorized access and potential misuse of administrative privileges.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

  • >= 2022.04.1, < 2022.10.10 2022.10.10 
    composer require aimeos/ai-admin-graphql:2022.10.10
  • >= 2023.04.1, < 2023.10.6 2023.10.6 
    composer require aimeos/ai-admin-graphql:2023.10.6
  • >= 2024.04.1, < 2024.04.6 2024.04.6 
    composer require aimeos/ai-admin-graphql:2024.04.6

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the fixed versions of aimeos/ai-admin-graphql.

Conclusion

The improper access control vulnerability in aimeos/ai-admin-graphql allows an editor to modify and take over an admin account, potentially leading to unauthorized access and misuse of administrative privileges. It is crucial to upgrade to the fixed versions (2022.10.10, 2023.10.6, or 2024.04.6) to mitigate this vulnerability.

See every vulnerability recorded for aimeos/ai-admin-graphql →

Share this vulnerability

FAQ

What is aimeos/ai-admin-graphql?

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface used for managing admin accounts in the back end of the application.

This vulnerability allows an editor to modify and take over an admin account, potentially leading to unauthorized access and misuse of administrative privileges.

Versions prior to 2022.10.10, 2023.10.6, and 2024.04.6 are affected by this vulnerability.

To fix this vulnerability, upgrade to the latest versions of aimeos/ai-admin-graphql (2022.10.10, 2023.10.6, or 2024.04.6) where the issue has been resolved.

No, there is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the fixed versions of aimeos/ai-admin-graphql.

References

View More

Related vulnerabilities

Recent vulnerabilities recorded for aimeos/ai-admin-graphql.

View all aimeos/ai-admin-graphql vulnerabilities →
Sponsored Devnack Your last release was probably never penetration tested Manual testing by engineers who build software, not an auditor's checklist. Trusted by teams at Swift and Google Talk to Devnack

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

  • >= 2022.04.1, < 2022.10.10 2022.10.10 
    composer require aimeos/ai-admin-graphql:2022.10.10
  • >= 2023.04.1, < 2023.10.6 2023.10.6 
    composer require aimeos/ai-admin-graphql:2023.10.6
  • >= 2024.04.1, < 2024.04.6 2024.04.6 
    composer require aimeos/ai-admin-graphql:2024.04.6

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Subscribe to Vulert on Telegram
Daily digest of new CVEs, critical and high severity, affected packages and fixes — plus a weekly roundup.
Join the channel →
Help improve this record
Report an issue or send feedback