CVE-2019-16097
Missing Authorization in Harbor
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.
- Record
CVE-2019-16097- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
CVE List No score
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.
- Record
CVE-2019-16097- Updated
- 2026-11-02
EUVDEUVD-2022-0946 No score
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.
- Record
EUVD-2022-0946- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-9wvh-ff5f-xjpj
Missing Authorization in Harbor
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API. This is fixed in 1.9.0-rc1.
- Record
GHSA-9wvh-ff5f-xjpj- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSV
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.
- Record
CVE-2019-16097- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-9wvh-ff5f-xjpj
Missing Authorization in Harbor
core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API. This is fixed in 1.9.0-rc1.
- Record
GHSA-9wvh-ff5f-xjpj- CVSS 3.1
- 6.5 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
OSVGO-2022-0818 No score
Missing Authorization in Harbor in github.com/goharbor/harbor
Missing Authorization in Harbor in github.com/goharbor/harbor
- Record
GO-2022-0818- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/goharbor/harborGo |
1.7.0 to 1.8.9 | 1.9.0-rc1 |
github.com/goharbor/harborGo |
1.7.0 up to 1.9.0-rc1 | 1.9.0-rc1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Nuclei | Harbor <=1.82.0 - Privilege Escalation | |
| PoC in GitHub | dacade/cve-2019-16097 | 2019-09-25 |
| PoC in GitHub | evilAdan0s/CVE-2019-16097 | 2019-09-19 |
| PoC in GitHub | ianxtianxt/CVE-2019-16097 | 2019-09-22 |
| PoC in GitHub | luckybool1020/CVE-2019-16097 | 2019-11-14 |
| PoC in GitHub | rockmelodies/CVE-2019-16097-batch | 2019-09-20 |
| PoC in GitHub | theLSA/harbor-give-me-admin | 2019-10-02 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-16097 is a medium vulnerability (CVSS 6.5) in Linuxfoundation Harbor, published September 8, 2019. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 22.4%, the 97th percentile. Fixed in github.com/goharbor/harbor 1.9.0-rc1.
References
github.com/goharbor/harbor/commit/b6db8a8a106259ec9a2c48be8a380cb3b37cf517
unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097
vmware.com/security/advisories/VMSA-2019-0015.html
nvd.nist.gov/vuln/detail/CVE-2019-16097