Skip to content
Fencer Vulns
critical 9.3

CVE-2021-21276 json

Privilege escalation in Polr

published 2021-02-01 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-8649

cvss
9.3
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
7.2%
EPSS 7.2% chance of exploitation in 30 days, percentile 94%
public exploits
1
Exploit-DB

Summary

Polr is an open source URL shortener. in Polr before version 2.3.0, a vulnerability in the setup process allows attackers to gain admin access to site instances, even if they do not possess an existing account. This vulnerability exists regardless of users' settings. If an attacker crafts a request with specific cookie headers to the /setup/finish endpoint, they may be able to obtain admin privileges on the instance. This is caused by a loose comparison (==) in SetupController that is susceptible to attack. The project has been patched to ensure that a strict comparison (===) is used to verify the setup key, and that /setup/finish verifies that no users table exists before performing any migrations or provisioning any new accounts. This is fixed in version 2.3.0. Users can patch this vulnerability without upgrading by adding abort(404) to the very first line of finishSetup in SetupController.php.

Patch / fix

  • polrproject polr 2.3.0

Timeline

  1. Published
  2. First public exploit (EDB-51277)

Exploit prediction

7.25% chance of exploitation in the next 30 days, higher than 94% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-51277 POLR URL 2.3.0 - Shortener Admin Takeover webapps, 2023-04-06

CVSS scores

assigned by version score vector
CNA 3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
NVD 3.1 9.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N
NVD 2.0 6.4 AV:N/AC:L/Au:N/C:P/I:P/A:N

Affected products

  • cydrobolt polr

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.