CVE-2021-33031 json
In LabCup before <v2_next_18022, it is possible to use the save API to perform unauthorized actions for users without access to user manage…
published 2021-06-10 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-19751
- cvss
- 3.1
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.7%
- EPSS 0.7% chance of exploitation in 30 days, percentile 52%
- public exploits
- 0
- none known
Summary
In LabCup before <v2_next_18022, it is possible to use the save API to perform unauthorized actions for users without access to user management in order to, after successful exploitation, gain access to a victim's account. A user without the user-management privilege can change another user's email address if the attacker knows details of the victim such as the exact roles and group roles, ID, and remote authentication ID settings. These must be sent in a modified save API request. It was fixed in 6.3.0.03.
Patch / fix
- labcup labcup v2_next_18022
Exploit prediction
0.68% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 3.1 | CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Classification
- Weakness
-
- CWE-862 Missing Authorization
References
-
labcup.net
/privacy-data-security/
vendor-advisory
-
github.com
/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md
third-party-advisory
Sources
- CVE List CVE-2021-33031
- NVD CVE-2021-33031
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.