CVE-2021-31590

PwnDoc through 2021-04-22 has incorrect JSON Webtoken handling, leading to incorrect access...

8.8 High

PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: Low
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

2.65%Up 1.8 points since Jul 20, 2021

What each source reports

NVD Score used 8.8

Record: CVE-2021-31590
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 9.0 HighAV:N/AC:L/Au:S/C:C/I:C/A:C
Updated: 2026-11-02

CVE List No score

Record: CVE-2021-31590
Updated: 2026-11-02

EUVDEUVD-2021-18484 No score

Record: EUVD-2021-18484
Updated: 2026-11-03

GitHub AdvisoriesGHSA-w9w2-pj3m-5v3r 8.8

PwnDoc through 2021-04-22 has incorrect JSON Webtoken handling, leading to incorrect access...

PwnDoc through 2021-04-22 has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system.

Record: GHSA-w9w2-pj3m-5v3r
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-863
Updated: 2026-11-02

OSV 8.8

Record: CVE-2021-31590
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Affected products

pwndoc project pwndoc

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-31590 is a high vulnerability (CVSS 8.8) in Pwndoc Project Pwndoc, published July 19, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.65%, the 85th percentile. No source names a fixed version.