Sealos billing system permission control defect

published 2023-06-30 3 y ago modified 2026-06-17 4 mo ago also GHSA-vpxf-q44g-w34w , EUVD-2023-1893

cvss: 7.3; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.5%; EPSS 0.5% chance of exploitation in 30 days, percentile 46%
public exploits: 0; none known

Sealos is a Cloud Operating System designed for managing cloud-native applications. In version 4.2.0 and prior, there is a permission flaw in the Sealos billing system, which allows users to control the recharge resource account `sealos[.] io/v1/Payment`, resulting in the ability to recharge any amount of 1 renminbi (RMB). The charging interface may expose resource information. The namespace of this custom resource would be user's control and may have permission to correct it. It is not clear whether a fix exists.

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-11-06)

Exploit prediction

0.55% chance of exploitation in the next 30 days, higher than 46% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
NVD	3.1	8.1	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
GitHub	3.1	7.3	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Affected packages

ecosystem	package	affected	fixed in
go	github.com/labring/sealos	<=4.2.0	no fix listed

Affected products

labring sealos
sealos sealos

Classification

Weakness

CWE-862 Missing Authorization
CWE-287 Improper Authentication

References

github.com /labring/sealos/security/advisories/GHSA-vpxf-q44g-w34w
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2023-36815
advisory
github.com /labring/sealos
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary