{"id":"CVE-2021-42192","aliases":["EUVD-2021-29174","GHSA-g934-4c2x-9pcq"],"status":"published","title":"Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted...","description":"Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.098,"percentile":0.95605,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-863"],"published":"2022-05-04T00:00:00Z","modified":"2026-10-20T10:54:04Z","exploits":[{"source":"nuclei","id":"CVE-2021-42192","title":"KONGA 0.14.9 - Privilege Escalation","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42192.yaml"}],"products":[{"vendor":"konga_project","product":"konga"}],"references":[{"url":"https://docs.google.com/document/d/1-YU9zWiDVUps3Mb6zos3996yvZ48vW_vfOvaJLLHc4I/edit?usp=sharing","tags":["x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/pantsel/konga/","tags":["x_transferred","Product","Third Party Advisory","advisory"]},{"url":"https://www.exploit-db.com/exploits/50521","tags":["x_transferred","Exploit","Third Party Advisory","VDB Entry","evidence"]},{"url":"https://github.com/whokilleddb/Konga-Privilege-Escalation-Exploit","tags":["x_transferred","Exploit","Third Party Advisory","evidence"]},{"url":"https://github.com/pantsel/konga/commit/d61535277aced18b5be0313ab2d124f60f649978","tags":["x_transferred","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-42192"},{"url":"https://github.com/advisories/GHSA-g934-4c2x-9pcq"}],"sources":{"cve":[{"id":"CVE-2021-42192","description":"Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.","status":"published","published":"2022-05-04T00:00:00Z","modified":"2024-08-04T03:30:37.488Z","updated_at":"2026-11-02T14:32:58.739039Z"}],"euvd":[{"id":"EUVD-2021-29174","description":"Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.","status":"published","published":"2022-05-04T00:00:00Z","modified":"2024-08-04T03:30:37Z","updated_at":"2026-11-03T03:24:16.217613Z"}],"ghsa":[{"id":"GHSA-g934-4c2x-9pcq","title":"Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted...","description":"Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.","status":"published","published":"2022-05-05T00:00:26Z","modified":"2023-11-08T00:30:20Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:54:53.779138Z"}],"nvd":[{"id":"CVE-2021-42192","description":"Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.","status":"published","published":"2022-05-04T11:15:07.95Z","modified":"2026-06-17T04:09:27Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":9,"vector":"AV:N/AC:L/Au:S/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:07:06.029737Z"}],"osv":[{"id":"CVE-2021-42192","description":"Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.","status":"published","published":"2022-05-04T11:15:07.95Z","modified":"2026-10-20T10:54:04.299922769Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:21.557945Z"}]}}