{"id":"CVE-2021-22565","aliases":["EUVD-2021-2409","GHSA-wx8q-rgfr-cf6v","GO-2022-0270"],"status":"published","title":"Insufficient Granularity of Access Control in GAEN Notification Server","description":"An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.0044,"percentile":0.3865,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-284"],"published":"2021-11-10T18:20:11Z","modified":"2026-10-20T10:54:30Z","fixes":[{"ecosystem":"Go","package":"github.com/google/exposure-notifications-verification-server","fixed_in":["1.1.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/google/exposure-notifications-verification-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/google/exposure-notifications-verification-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/google/exposure-notifications-verification-server","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.1.2"}]}]}],"products":[{"vendor":"google","product":"exposure_notification_verification_server"},{"vendor":"google llc","product":"google exposure-notifications-verification-server"}],"references":[{"url":"https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-wx8q-rgfr-cf6v","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/google/exposure-notifications-verification-server/releases/tag/v1.1.2","tags":["x_refsource_MISC","x_transferred","Patch","Release Notes","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22565","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-wx8q-rgfr-cf6v"},{"url":"https://github.com/google/exposure-notifications-verification-server","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-22565","title":"Insufficient Granularity of Access Control in GAEN Notification Server","description":"An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.","status":"published","published":"2021-12-09T12:55:10.778Z","modified":"2024-09-16T17:53:56.557Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:32:57.701381Z"}],"euvd":[{"id":"EUVD-2021-2409","description":"An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.","status":"published","published":"2021-12-09T12:55:10Z","modified":"2024-09-16T17:53:56Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-03T00:55:37.743963Z"}],"ghsa":[{"id":"GHSA-wx8q-rgfr-cf6v","title":"Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server","description":"### Impact\nUsers or API keys with permission to expire verification codes could have expired codes that belonged to another realm if they guessed the UUID.\n\n### Patches\nv1.1.2+\n\n### Workarounds\nThere are no workarounds, and there are no indications this has been exploited in the wild. Verification codes can only be expired by providing their 64-bit UUID, and verification codes are already valid for a very short period of time (thus the UUID rotates frequently).\n\n### For more information\nContact exposure-notifications-feedback@google.com","status":"published","published":"2021-11-10T18:20:11Z","modified":"2023-01-29T05:06:34Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:36:26.667347Z"}],"nvd":[{"id":"CVE-2021-22565","description":"An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.","status":"published","published":"2021-12-09T13:15:08.767Z","modified":"2026-06-17T03:37:26.193Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:07:02.189991Z"}],"osv":[{"id":"CVE-2021-22565","description":"An attacker could prematurely expire a verification code, making it unusable by the patient, making the patient unable to upload their TEKs to generate exposure notifications. We recommend upgrading the Exposure Notification server to V1.1.2 or greater.","status":"published","published":"2021-12-09T13:15:08.767Z","modified":"2026-10-20T10:54:30.97568359Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"GHSA-wx8q-rgfr-cf6v","title":"Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server","description":"### Impact\nUsers or API keys with permission to expire verification codes could have expired codes that belonged to another realm if they guessed the UUID.\n\n### Patches\nv1.1.2+\n\n### Workarounds\nThere are no workarounds, and there are no indications this has been exploited in the wild. Verification codes can only be expired by providing their 64-bit UUID, and verification codes are already valid for a very short period of time (thus the UUID rotates frequently).\n\n### For more information\nContact exposure-notifications-feedback@google.com","status":"published","published":"2021-11-10T18:20:11Z","modified":"2026-07-08T06:27:48.613685541Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","level":"medium"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:59.131095Z"},{"id":"GO-2022-0270","title":"Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server","description":"Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server","status":"published","published":"2024-08-21T14:30:26Z","modified":"2026-03-03T04:52:05.161237Z","updated_at":"2026-11-02T15:47:00.604718Z"}]}}