GHSA-8wgc-jjvv-cv6v
Improper Authorization in loopback
GHSA-8wgc-jjvv-cv6v is a vulnerability with no CVSS score yet in loopback, published September 2, 2020. No source lists public exploit code. Fixed in loopback 2.40.0.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.40.0loopback +4 more
Description
Vulnerable versions of loopback may allow attackers to create Authentication Tokens on behalf of other users due to Improper Authorization. If the AccessToken model is publicly exposed, an attacker can create Authorization Tokens for any user as long as they know the target's userId. This will allow the attacker to access the user's data and their privileges.
Recommendation
For loopback 2.x, upgrade to version 2.40.0 or later For loopback 3.x, upgrade to version 3.22.0 or later
Affected packages
What each source reports
GitHub AdvisoriesNo score
Improper Authorization in loopback
Vulnerable versions of loopback may allow attackers to create Authentication Tokens on behalf of other users due to Improper Authorization. If the AccessToken model is publicly exposed, an attacker can create Authorization Tokens for any user as long as they know the target's userId. This will allow the attacker to access the user's data and their privileges.
Recommendation
For loopback 2.x, upgrade to version 2.40.0 or later For loopback 3.x, upgrade to version 3.22.0 or later
- Record
GHSA-8wgc-jjvv-cv6v- Weakness
- CWE-285
- Updated
- 2026-11-02
OSVCLSA-2026-1788862742No score
TuxCare security update for loopback (1 CVE)
TuxCare rebuilt loopback to address 1 CVE. Fixed in 1.10.0-tuxcare.3.
- Record
CLSA-2026-1788862742- Updated
- 2026-11-02
OSVNo score
Improper Authorization in loopback
Vulnerable versions of loopback may allow attackers to create Authentication Tokens on behalf of other users due to Improper Authorization. If the AccessToken model is publicly exposed, an attacker can create Authorization Tokens for any user as long as they know the target's userId. This will allow the attacker to access the user's data and their privileges.
Recommendation
For loopback 2.x, upgrade to version 2.40.0 or later For loopback 3.x, upgrade to version 3.22.0 or later
- Record
GHSA-8wgc-jjvv-cv6v- Weakness
- CWE-285
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.