CVE-2018-1000211
Doorkeeper subject to Incorrect Permission Assignment
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.
- Record
CVE-2018-1000211- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
CVE List No score
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.
- Record
CVE-2018-1000211- Updated
- 2026-11-02
EUVDEUVD-2018-0373 No score
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.
- Record
EUVD-2018-0373- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-694m-jhr9-pf77
Doorkeeper subject to Incorrect Permission Assignment
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.
- Record
GHSA-694m-jhr9-pf77- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
OSV
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.
- Record
CVE-2018-1000211- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-1000211
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.
- Record
DEBIAN-CVE-2018-1000211- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-694m-jhr9-pf77
Doorkeeper subject to Incorrect Permission Assignment
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.
- Record
GHSA-694m-jhr9-pf77- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-732
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-1000211
Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.
- Record
UBUNTU-CVE-2018-1000211- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
doorkeeperRubyGems |
4.2.0 up to 4.4.0 | 4.4.0 |
ruby-doorkeeperDebian:12 |
before 4.4.2-1 | 4.4.2-1 |
ruby-doorkeeperDebian:13 |
before 4.4.2-1 | 4.4.2-1 |
ruby-doorkeeperDebian:14 |
before 4.4.2-1 | 4.4.2-1 |
doorkeeperRubyGems |
4.2.0 up to 4.4.0, plus listed versions 4.2.54.2.64.3.04.3.14.3.2 |
4.4.0 |
ruby-doorkeeperUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 4.2.0-34.3.1-14.3.1-1ubuntu0.1~esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-1000211 is a high vulnerability (CVSS 7.5) in Doorkeeper Project Doorkeeper, published July 13, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.55%, the 75th percentile. Fixed in doorkeeper 4.4.0.
References
github.com/doorkeeper-gem/doorkeeper/pull/1119
nvd.nist.gov/vuln/detail/CVE-2018-1000211
security-tracker.debian.org/tracker/CVE-2018-1000211
ubuntu.com/security/CVE-2018-1000211
cve.org/CVERecord?id=CVE-2018-1000211