CVE-2024-23637
OctoPrint Unverified Password Change via Access Control Settings
CVE-2024-23637 is a medium vulnerability (CVSS 4.2) in Octoprint, published January 31, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.52%, the 44th percentile. Fixed in octoprint 1.10.0rc1.
- Severity
- 4.2 MediumCVSS 3.1, CVE List
- Exploit chance
- 0.52%EPSS, 44th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1.10.0rc1octoprint +1 more
Description
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
octoprintPyPI | through 1.9.3 | 1.10.0rc1 |
octoprintPyPI | before 1.10.0rc1, plus listed versions 1.3.111.3.121.3.12rc11.3.12rc31.4.0 Show 45 moreShow less1.4.0rc11.4.0rc21.4.0rc31.4.0rc41.4.0rc51.4.0rc61.4.11.4.1rc11.4.1rc21.4.1rc31.4.1rc41.4.21.5.01.5.0rc11.5.0rc21.5.0rc31.5.11.5.21.5.31.6.01.6.0rc11.6.0rc21.6.0rc31.6.11.7.01.7.0rc11.7.0rc21.7.0rc31.7.11.7.21.7.31.8.01.8.0rc11.8.0rc21.8.0rc31.8.0rc41.8.0rc51.8.11.8.21.8.31.8.41.8.51.8.61.8.71.9.0 | 1.10.0rc1 |
What each source reports
CVE List Score used
OctoPrint Unverified Password Change via Access Control Settings
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.
- Record
CVE-2024-23637- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-287, CWE-620
- Updated
- 2026-11-02
EUVDEUVD-2024-0120
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.
- Record
EUVD-2024-0120- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-5626-pw9c-hmjr
OctoPrint Unverified Password Change via Access Control Settings
Impact
OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password.
An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance.
Patches
The vulnerability will be patched in version 1.10.0.
Workarounds
OctoPrint administrators are strongly advised to thoroughly vet who has admin access to their installation.
Credits
This vulnerability was discovered and responsibly disclosed to OctoPrint by Timothy "TK" Ruppert.
- Record
GHSA-5626-pw9c-hmjr- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-287, CWE-620
- Updated
- 2026-11-02
NVD
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.
- Record
CVE-2024-23637- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-287, CWE-620
- Updated
- 2026-11-02
OSV
OctoPrint Unverified Password Change via Access Control Settings
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.
- Record
CVE-2024-23637- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-287, CWE-620
- Updated
- 2026-11-02
OSVGHSA-5626-pw9c-hmjr
OctoPrint Unverified Password Change via Access Control Settings
Impact
OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password.
An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance.
Patches
The vulnerability will be patched in version 1.10.0.
Workarounds
OctoPrint administrators are strongly advised to thoroughly vet who has admin access to their installation.
Credits
This vulnerability was discovered and responsibly disclosed to OctoPrint by Timothy "TK" Ruppert.
- Record
GHSA-5626-pw9c-hmjr- CVSS 3.1
- 4.2 Medium
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L - Weakness
- CWE-287, CWE-620
- Updated
- 2026-11-02
OSVPYSEC-2024-29
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.
- Record
PYSEC-2024-29- CVSS 3.1
- 4.9 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/OctoPrint/OctoPrint/security/advisories/GHSA-5626-pw9c-hmjr
nvd.nist.gov/vuln/detail/CVE-2024-23637
Left out here: 9 versions. The JSON record has them.