CVE-2024-1314
Kinto Attachment's attachments can be replaced on read-only records
Impact
The attachment file of an existing record can be replaced if the user has "read" permission on one of the parent (collection or bucket).
And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous request.
Note that if the parent has no explicit read permission, then the records attachments are safe.
Patches
- Patch released in kinto-attachment 6.4.0
- https://github.com/Kinto/kinto-attachment/commit/f4a31484f5925cbc02b59ebd37554538ab826ca1
Workarounds
None if the read permission has to remain granted.
Updating to 6.4.0 or applying the patch individually (if updating is not feasible) is strongly recommended.
References
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
What each source reports
GitHub Advisories Score usedGHSA-hvp4-vrv2-8wrq
Kinto Attachment's attachments can be replaced on read-only records
Impact
The attachment file of an existing record can be replaced if the user has "read" permission on one of the parent (collection or bucket).
And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous request.
Note that if the parent has no explicit read permission, then the records attachments are safe.
Patches
- Patch released in kinto-attachment 6.4.0
- https://github.com/Kinto/kinto-attachment/commit/f4a31484f5925cbc02b59ebd37554538ab826ca1
Workarounds
None if the read permission has to remain granted.
Updating to 6.4.0 or applying the patch individually (if updating is not feasible) is strongly recommended.
References
- Record
GHSA-hvp4-vrv2-8wrq- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-hvp4-vrv2-8wrq
Kinto Attachment's attachments can be replaced on read-only records
Impact
The attachment file of an existing record can be replaced if the user has "read" permission on one of the parent (collection or bucket).
And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous request.
Note that if the parent has no explicit read permission, then the records attachments are safe.
Patches
- Patch released in kinto-attachment 6.4.0
- https://github.com/Kinto/kinto-attachment/commit/f4a31484f5925cbc02b59ebd37554538ab826ca1
Workarounds
None if the read permission has to remain granted.
Updating to 6.4.0 or applying the patch individually (if updating is not feasible) is strongly recommended.
References
- Record
GHSA-hvp4-vrv2-8wrq- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
OSVPYSEC-2026-1494
Kinto Attachment's attachments can be replaced on read-only records
Impact
The attachment file of an existing record can be replaced if the user has "read" permission on one of the parent (collection or bucket).
And if the "read" permission is given to "system.Everyone" on one of the parent, then the attachment can be replaced on a record using an anonymous request.
Note that if the parent has no explicit read permission, then the records attachments are safe.
Patches
- Patch released in kinto-attachment 6.4.0
- https://github.com/Kinto/kinto-attachment/commit/f4a31484f5925cbc02b59ebd37554538ab826ca1
Workarounds
None if the read permission has to remain granted.
Updating to 6.4.0 or applying the patch individually (if updating is not feasible) is strongly recommended.
References
- Record
PYSEC-2026-1494- CVSS 3.1
- 8.6 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
kinto-attachmentPyPI | through 6.3.2 | 6.4.0 |
kinto-attachmentPyPI | before 6.4.0, plus listed versions 0.1.00.1.0.dev00.2.00.3.00.4.0 Show 29 moreShow less0.5.00.5.0.dev00.5.10.6.00.7.00.7.10.8.01.0.01.0.11.1.01.1.11.1.22.0.02.0.12.1.03.0.03.0.14.0.05.0.06.0.06.0.16.0.26.0.36.0.46.1.06.2.06.3.06.3.16.3.2 | 6.4.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-1314 is a high vulnerability (CVSS 8.6) in kinto-attachment, published February 8, 2024. No source lists public exploit code. Fixed in kinto-attachment 6.4.0.
References
github.com/Kinto/kinto-attachment/security/advisories/GHSA-hvp4-vrv2-8wrq
bugzilla.mozilla.org/show_bug.cgi?id=1879034
pypi.org/project/kinto-attachment
nvd.nist.gov/vuln/detail/CVE-2024-1314