Skip to content
Fencer Vulns
high 8.0

CVE-2023-22648 json

Rancher's Azure AD permission changes are not reflected on active sessions

published 2023-06-01 3 y ago modified 2026-10-24 15 d ago also GHSA-vf6j-6739-78m8 , EUVD-2023-26781

cvss
8.0
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.5%
EPSS 0.5% chance of exploitation in 30 days, percentile 39%
public exploits
0
none known

Summary

A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4.

Patch / fix

  • go github.com/rancher/rancher 2.6.13, 2.7.4
  • SUSE Rancher < 2.6.13, < 2.7.4

Exploit prediction

0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
GitHub 3.1 8.0 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go github.com/rancher/rancher
>=2.6.7, <2.6.13
>=2.7.0, <2.7.4
2.6.13
2.7.4

Affected products

  • SUSE Rancher

Classification

Weakness
  • CWE-271 Privilege Dropping / Lowering Errors
  • CWE-269 Improper Privilege Management
  • CWE-384 Session Fixation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.