{"id":"CVE-2021-31590","aliases":["EUVD-2021-18484","GHSA-w9w2-pj3m-5v3r"],"status":"published","title":"PwnDoc through 2021-04-22 has incorrect JSON Webtoken handling, leading to incorrect access...","description":"PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the \"user\" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-12","score":0.02653,"percentile":0.85864,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2021-07-19T19:45:41Z","modified":"2026-10-20T10:54:40Z","products":[{"vendor":"pwndoc_project","product":"pwndoc"}],"references":[{"url":"https://github.com/pwndoc/pwndoc/security/advisories","tags":["x_refsource_MISC","x_transferred","Broken Link","advisory"]},{"url":"https://github.com/pwndoc/pwndoc/pull/128","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/pwndoc/pwndoc/pull/74","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://www.dgc.org/responsible_disclosure_pwndoc_jwt","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/pwndoc/pwndoc/blob/59519735b0d831d8fd96d7c3387f66d28407e583/CHANGELOG.md#040-2021-08-23","tags":["x_refsource_MISC","x_transferred","Patch","Release Notes","Third Party Advisory","fix"]},{"url":"https://github.com/pwndoc/pwndoc/commit/15f3dc0e212eda465e05fda0feb002d1bce2939d","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://github.com/pwndoc/pwndoc/commit/ff1b868cec55f5b6c7a91e15a2b0b1f4324121ab","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31590"},{"url":"https://github.com/advisories/GHSA-w9w2-pj3m-5v3r"}],"sources":{"cve":[{"id":"CVE-2021-31590","description":"PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the \"user\" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system.","status":"published","published":"2021-07-19T19:45:41Z","modified":"2024-08-03T23:03:33.533Z","updated_at":"2026-11-02T14:33:05.665371Z"}],"euvd":[{"id":"EUVD-2021-18484","description":"PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the \"user\" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system.","status":"published","published":"2021-07-19T19:45:41Z","modified":"2024-08-03T23:03:33Z","updated_at":"2026-11-03T03:24:38.423371Z"}],"ghsa":[{"id":"GHSA-w9w2-pj3m-5v3r","title":"PwnDoc through 2021-04-22 has incorrect JSON Webtoken handling, leading to incorrect access...","description":"PwnDoc through 2021-04-22 has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the \"user\" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system.","status":"published","published":"2022-05-24T19:08:25Z","modified":"2023-01-27T05:03:06Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:42:10.172069Z"}],"nvd":[{"id":"CVE-2021-31590","description":"PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the \"user\" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system.","status":"published","published":"2021-07-19T20:15:08.66Z","modified":"2026-06-17T03:52:02.867Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"updated_at":"2026-11-02T14:06:55.747384Z"}],"osv":[{"id":"CVE-2021-31590","description":"PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the \"user\" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system.","status":"published","published":"2021-07-19T20:15:08.66Z","modified":"2026-10-20T10:54:40.815016083Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:19.483607Z"}]}}