CVE-2023-32078: Netmaker IDOR Allows User to Update Other User's Password in github.com/gravitl/netmaker
Summary
CVE-2023-32078: Netmaker IDOR Allows User to Update Other User's Password in github.com/gravitl/netmaker. Affects github.com/gravitl/netmaker across 2 version ranges.
< 0.17.1
>= 0.18.0, < 0.18.6
Fixed in 0.17.1 or 0.18.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is github.com/gravitl/netmaker, an open-source project written in Go. Netmaker is a network management and configuration tool that allows users to create and manage virtual networks. It provides features such as VPN connectivity, network routing, and secure communication between nodes. The vulnerability in question is an Insecure Direct Object Reference (IDOR) issue that allows an authenticated user to update the password of another user, potentially leading to unauthorized access and compromise of sensitive information.
Vulnerability Detail
The IDOR vulnerability in Netmaker arises from a lack of proper authorization checks when updating user passwords. An authenticated user can exploit this flaw by manipulating the request parameters to change the password of any other user in the system. This can result in unauthorized access to sensitive resources and potential compromise of user accounts. The vulnerability affects versions 0.0.0 to 0.17.1 and 0.18.0 to 0.18.6 of the package.
How To Fix
Latest published version: v1.7.0 as of 23 Oct 2026
go get github.com/gravitl/netmaker@v1.7.0Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 0.17.10.17.1go get github.com/gravitl/netmaker@v0.17.1 -
>= 0.18.0, < 0.18.60.18.6go get github.com/gravitl/netmaker@v0.18.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patch as soon as possible.
Conclusion
The Netmaker package is vulnerable to an IDOR issue that allows an authenticated user to update the password of another user. This can lead to unauthorized access and compromise of sensitive information. Users are advised to update their installations to the latest patched version to mitigate this vulnerability.
See every vulnerability recorded for github.com/gravitl/netmaker →
FAQ
An Insecure Direct Object Reference (IDOR) vulnerability occurs when an application fails to properly validate user access to resources. It allows an attacker to manipulate parameters to access or modify data belonging to other users.
An authenticated user can exploit this vulnerability by manipulating the request parameters to change the password of another user. This can lead to unauthorized access and compromise of sensitive information.
Versions 0.0.0 to 0.17.1 and 0.18.0 to 0.18.6 of Netmaker are affected by this vulnerability.
Yes, the developers of Netmaker have released patches in versions 0.17.1 and 0.18.6 to fix this vulnerability.
No, there is no known workaround for this vulnerability. It is recommended to apply the official patch.
Related vulnerabilities
Recent vulnerabilities recorded for github.com/gravitl/netmaker.
