CVE-2010-5142
Chef Improper Access Control vulnerability
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.
Exploit likelihood
What each source reports
NVD Score used
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.
- Record
CVE-2010-5142- CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.
- Record
CVE-2010-5142- Updated
- 2026-11-02
EUVDEUVD-2022-3702 No score
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.
- Record
EUVD-2022-3702- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-f68m-q26r-64f6 No score
Chef Improper Access Control vulnerability
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.
- Record
GHSA-f68m-q26r-64f6- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-f68m-q26r-64f6 No score
Chef Improper Access Control vulnerability
chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.
- Record
GHSA-f68m-q26r-64f6- Weakness
- CWE-284
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
chefRubyGems |
before 0.9.0 | 0.9.0 |
chefRubyGems |
before 0.9.0, plus listed versions 0.7.100.7.120.7.140.7.160.8.10 Show 18 moreShow less0.8.140.8.160.8.20.8.40.8.60.8.80.9.0.a100.9.0.a30.9.0.a40.9.0.a60.9.0.a80.9.0.a900.9.0.a910.9.0.a920.9.0.b010.9.0.b020.9.0.rc010.9.0.rc02 |
0.9.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2010-5142 is a medium vulnerability (CVSS 6.5) in Opscode Chef, published August 8, 2012. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.57%, the 75th percentile. Fixed in chef 0.9.0.