Skip to content
Fencer Vulns
high 8.8

CVE-2023-32749 in the critical feed json

Pydio Cells allows users by default to create so-called external users in order to share files with them.

published 2023-06-08 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-36974

cvss
8.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
14.1%
EPSS 14.1% chance of exploitation in 30 days, percentile 96%
public exploits
1
Exploit-DB

Summary

Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. By assigning all roles to a newly created user, access to all cells and non-personal workspaces is granted.

Patch / fix

  • pydio cells 3.0.12, 4.1.3

Timeline

  1. First public exploit (EDB-51496)
  2. Published

CISA SSVC

Exploitation
Proof of concept is public
Automatable
no
Technical impact
total
Assessed
22 mo ago

Exploit prediction

14.09% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-51496 Pydio Cells 4.1.2 - Unauthorised Role Assignments webapps, 2023-05-31
  • seclists.org http://seclists.org/fulldisclosure/2023/May/18 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/172645/Pydio-Cells-4.1.2-Privilege-Escalation.html referenced PoC, tagged "exploit" by a source, unverified
  • redteam-pentesting.de https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-003/-pydio-cells-unauthorised-role-assignments referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.