{"id":"CVE-2021-31927","aliases":["EUVD-2021-18800","GHSA-3r8c-rqqr-c7h4"],"status":"published","title":"An Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience...","description":"An Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience Platform \u003c2021.1.0.1 allows any authenticated attacker to modify any existing user, including users assigned to different environments and clients. It was fixed in v2021.1.0.2.","severity":{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.00506,"percentile":0.43658,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639","CWE-829"],"published":"2021-06-10T14:58:16Z","modified":"2026-06-17T03:52:30Z","products":[{"vendor":"annexcloud","product":"loyalty_experience_platform"}],"references":[{"url":"https://github.com/Accenture/AARO-Bugs/blob/master/AARO-CVE-List.md","tags":["x_refsource_MISC","x_transferred","Third Party Advisory"]},{"url":"https://www.annexcloud.com/","tags":["x_refsource_MISC","x_transferred","Product"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-31927"},{"url":"https://github.com/advisories/GHSA-3r8c-rqqr-c7h4"}],"sources":{"cve":[{"id":"CVE-2021-31927","description":"An Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience Platform \u003c2021.1.0.1 allows any authenticated attacker to modify any existing user, including users assigned to different environments and clients. It was fixed in v2021.1.0.2.","status":"published","published":"2021-06-10T14:58:16Z","modified":"2024-08-03T23:10:31.404Z","updated_at":"2026-11-02T14:33:05.665371Z"}],"euvd":[{"id":"EUVD-2021-18800","description":"An Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience Platform \u003c2021.1.0.1 allows any authenticated attacker to modify any existing user, including users assigned to different environments and clients. It was fixed in v2021.1.0.2.","status":"published","published":"2021-06-10T14:58:16Z","modified":"2024-08-03T23:10:31Z","updated_at":"2026-11-03T03:24:37.97373Z"}],"ghsa":[{"id":"GHSA-3r8c-rqqr-c7h4","title":"An Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience...","description":"An Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience Platform \u003c2021.1.0.1 allows any authenticated attacker to modify any existing user, including users assigned to different environments and clients. It was fixed in v2021.1.0.2.","status":"published","published":"2022-05-24T19:04:52Z","modified":"2023-01-29T05:07:57Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-639","CWE-829"],"updated_at":"2026-11-02T14:46:11.594724Z"}],"nvd":[{"id":"CVE-2021-31927","description":"An Insecure Direct Object Reference (IDOR) vulnerability in Annex Cloud Loyalty Experience Platform \u003c2021.1.0.1 allows any authenticated attacker to modify any existing user, including users assigned to different environments and clients. It was fixed in v2021.1.0.2.","status":"published","published":"2021-06-10T15:15:09.483Z","modified":"2026-06-17T03:52:30.5Z","cvss":[{"version":"3.1","score":4.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4,"vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-639"],"updated_at":"2026-11-02T14:06:54.439974Z"}]}}