CVE-2018-16476
Improper Access Control in activejob
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.
- Record
CVE-2018-16476- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-284, CWE-502
- Updated
- 2026-11-02
CVE List No score
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.
- Record
CVE-2018-16476- Weakness
- CWE-284
- Updated
- 2026-11-02
EUVDEUVD-2018-0818 No score
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.
- Record
EUVD-2018-0818- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q2qw-rmrh-vv42
Improper Access Control in activejob
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have.
- Record
GHSA-q2qw-rmrh-vv42- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-284, CWE-502
- Updated
- 2026-11-02
OSV
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.
- Record
CVE-2018-16476- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2018-16476
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.
- Record
DEBIAN-CVE-2018-16476- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
Show 7 moreShow less
OSVGHSA-q2qw-rmrh-vv42
Improper Access Control in activejob
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have.
- Record
GHSA-q2qw-rmrh-vv42- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-284, CWE-502
- Updated
- 2026-11-02
OSVRHSA-2019:0600
Red Hat Security Advisory: CloudForms 4.6.9 security, bug fix and enhancement update
- Record
RHSA-2019:0600- CVSS 3.0
- 4.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2018-16476
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.
- Record
UBUNTU-CVE-2018-16476- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11322-1 No score
ruby2.7-rubygem-activejob-5.2-5.2.6-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-activejob-5.2-5.2.6-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11322-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11347-1 No score
ruby2.7-rubygem-rails-5.2-5.2.6-1.2 on GA media
These are all security issues fixed in the ruby2.7-rubygem-rails-5.2-5.2.6-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11347-1- Updated
- 2026-11-02
OSVSUSE-SU-2018:3996-1 No score
Security update for rubygem-activejob-5_1
This update for rubygem-activejob-5_1 fixes the following issues:
Security issue fixed:
- CVE-2018-16476: Fixed broken access control vulnerability (bsc#1117632).
- Record
SUSE-SU-2018:3996-1- Updated
- 2026-11-02
OSVSUSE-SU-2019:0152-1 No score
Security update for rubygem-activejob-4_2
This update for rubygem-activejob-4_2 fixes the following issues:
Security issue fixed:
- CVE-2018-16476: Fixed broken access control vulnerability (bsc#1117632).
- Record
SUSE-SU-2019:0152-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activejobRubyGems |
4.2.0 up to 4.2.11 | 4.2.11 |
activejobRubyGems |
5.0.0 to 5.0.7.0 | 5.0.7.1 |
activejobRubyGems |
5.1.0 to 5.1.6.0 | 5.1.6.1 |
activejobRubyGems |
5.2.0 to 5.2.1.0 | 5.2.1.1 |
railsDebian:12 |
before 2:5.2.2+dfsg-1 | 2:5.2.2+dfsg-1 |
railsDebian:13 |
before 2:5.2.2+dfsg-1 | 2:5.2.2+dfsg-1 |
railsDebian:14 |
before 2:5.2.2+dfsg-1 | 2:5.2.2+dfsg-1 |
activejobRubyGems |
4.2.0 up to 4.2.11, plus listed versions 4.2.14.2.1.rc14.2.1.rc24.2.1.rc34.2.1.rc4 Show 22 moreShow less4.2.104.2.10.rc14.2.24.2.34.2.3.rc14.2.44.2.4.rc14.2.54.2.5.14.2.5.24.2.5.rc14.2.5.rc24.2.64.2.6.rc14.2.74.2.7.14.2.7.rc14.2.84.2.8.rc14.2.94.2.9.rc14.2.9.rc2 |
4.2.11 |
activejobRubyGems |
5.0.0 up to 5.0.7.1, plus listed versions 5.0.0.15.0.15.0.1.rc15.0.1.rc25.0.2 Show 10 moreShow less5.0.2.rc15.0.35.0.45.0.4.rc15.0.55.0.5.rc15.0.5.rc25.0.65.0.6.rc15.0.7 |
5.0.7.1 |
activejobRubyGems |
5.1.0 up to 5.1.6.1, plus listed versions 5.1.15.1.25.1.2.rc15.1.35.1.3.rc1 Show 7 moreShow less5.1.3.rc25.1.3.rc35.1.45.1.4.rc15.1.55.1.5.rc15.1.6 |
5.1.6.1 |
Show 18 moreShow less
| Package | Affected | Fixed |
|---|---|---|
activejobRubyGems |
5.2.0 up to 5.2.1.1, plus listed versions 5.2.15.2.1.rc1 |
5.2.1.1 |
cfmeRed Hat:cloudforms_managementengine:5.9::el7 |
before 0:5.9.9.1-1.el7cf | 0:5.9.9.1-1.el7cf |
cfme-amazon-smartstateRed Hat:cloudforms_managementengine:5.9::el7 |
before 0:5.9.9.1-1.el7cf | 0:5.9.9.1-1.el7cf |
cfme-applianceRed Hat:cloudforms_managementengine:5.9::el7 |
before 0:5.9.9.1-1.el7cf | 0:5.9.9.1-1.el7cf |
cfme-appliance-commonRed Hat:cloudforms_managementengine:5.9::el7 |
before 0:5.9.9.1-1.el7cf | 0:5.9.9.1-1.el7cf |
cfme-appliance-debuginfoRed Hat:cloudforms_managementengine:5.9::el7 |
before 0:5.9.9.1-1.el7cf | 0:5.9.9.1-1.el7cf |
cfme-appliance-toolsRed Hat:cloudforms_managementengine:5.9::el7 |
before 0:5.9.9.1-1.el7cf | 0:5.9.9.1-1.el7cf |
cfme-debuginfoRed Hat:cloudforms_managementengine:5.9::el7 |
before 0:5.9.9.1-1.el7cf | 0:5.9.9.1-1.el7cf |
cfme-gemsetRed Hat:cloudforms_managementengine:5.9::el7 |
before 0:5.9.9.1-1.el7cf | 0:5.9.9.1-1.el7cf |
cfme-gemset-debuginfoRed Hat:cloudforms_managementengine:5.9::el7 |
before 0:5.9.9.1-1.el7cf | 0:5.9.9.1-1.el7cf |
rubygem-activejob-5_1SUSE:Linux Enterprise High Availability Extension 15 |
before 5.1.4-3.3.1 | 5.1.4-3.3.1 |
rubygem-activejob-4_2SUSE:OpenStack Cloud 7 |
before 4.2.9-3.6.1 | 4.2.9-3.6.1 |
rubygem-activejob-4_2SUSE:OpenStack Cloud Crowbar 8 |
before 4.2.9-3.6.1 | 4.2.9-3.6.1 |
rubygem-activejob-4_2SUSE:Enterprise Storage 4 |
before 4.2.9-3.6.1 | 4.2.9-3.6.1 |
railsUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:4.1.10-12:4.2.5-12:4.2.5.1-12:4.2.5.2-22:4.2.6-12:4.2.6-1ubuntu0.1~esm12:4.2.6-1ubuntu0.1~esm2 |
None known |
railsUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2:4.2.9-22:4.2.9-42:4.2.10-0ubuntu42:4.2.10-0ubuntu4+esm12:4.2.10-0ubuntu4+esm2 |
None known |
railsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2:5.2.2.1+dfsg-1ubuntu12:5.2.3+dfsg-32:5.2.3+dfsg-3ubuntu0.1~esm1 |
None known |
railsUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2:6.0.3.7+dfsg-22:6.1.4.1+dfsg-8ubuntu22:6.1.4.1+dfsg-8ubuntu2+esm1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2018-16476 is a high vulnerability (CVSS 7.5) in Rails Https://github.com/rails/rails, published November 30, 2018. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.86%, the 86th percentile. Fixed in activejob 4.2.11.
References
groups.google.com/d/msg/rubyonrails-security/FL4dSdzr2zw/zjKVhF4qBAAJ
weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released
access.redhat.com/errata/RHSA-2019:0600
nvd.nist.gov/vuln/detail/CVE-2018-16476
github.com/rubysec/ruby-advisory-db/blob/master/gems/activejob/CVE-2018-16476.yml
Show 24 moreShow less
security-tracker.debian.org/tracker/CVE-2018-16476
bugzilla.redhat.com/show_bug.cgi?id=1659223
security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0600.json
cve.org/CVERecord?id=CVE-2018-16476
suse.com/support/update/announcement/2018/suse-su-20183996-1
bugzilla.suse.com/1117632
ubuntu.com/security/CVE-2018-16476
openwall.com/lists/oss-security/2018/11/27/4