{"id":"CVE-2022-36110","aliases":["EUVD-2022-6822","GHSA-ggf6-638m-vqmg","GO-2022-0986"],"status":"published","title":"Netmaker vulnerable to Insufficient Granularity of Access Control","description":"Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00897,"percentile":0.59823,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1220","CWE-285"],"published":"2022-09-09T19:15:12Z","modified":"2026-10-28T02:31:14Z","fixes":[{"ecosystem":"Go","package":"github.com/gravitl/netmaker","fixed_in":["0.15.1"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"github.com/gravitl/netmaker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.15.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gravitl/netmaker","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.15.1"}]}]},{"source":"osv","ecosystem":"Go","package":"github.com/gravitl/netmaker","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.15.1"}]}]}],"products":[{"vendor":"gravitl","product":"netmaker"},{"vendor":"netmaker","product":"netmaker"}],"references":[{"url":"https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web"]},{"url":"https://github.com/gravitl/netmaker/releases/tag/v0.15.1","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-36110","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-ggf6-638m-vqmg"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/36xxx/CVE-2022-36110.json","tags":["advisory"]},{"url":"https://github.com/gravitl/netmaker","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2022-36110","title":"Netmaker vulnerable to Insufficient Granularity of Access Control","description":"Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1.","status":"published","published":"2022-09-09T19:15:12Z","modified":"2025-04-23T17:12:19.594Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-1220","CWE-285"],"updated_at":"2026-11-02T14:34:35.615708Z"}],"euvd":[{"id":"EUVD-2022-6822","description":"Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1.","status":"published","published":"2022-09-09T19:15:12Z","modified":"2025-04-23T17:12:19Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T20:52:10.906327Z"}],"ghsa":[{"id":"GHSA-ggf6-638m-vqmg","title":"Netmaker vulnerable to Insufficient Granularity of Access Control","description":"### Impact\nImproper Authorization functions leads to non-privileged users running privileged API calls. If you have added users to your Netmaker platform who whould not have admin privileges, they could use their auth token to run admin-level functions via the API.\n\nIn addition, differing response codes based on function calls allowed non-users to potentially brute force the determination of names of networks on the system.\n\n### Patches\nThis problem has been patched in v0.15.1. To apply:\n\n1. docker-compose down\n2. docker pull gravitl/netmaker:v0.15.1\n3. docker-compose up -d\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nEmail us at [info@netmaker.io](mailto:info@netmaker.io)\nThis vulnerability was brought to our attention by @tweidinger","status":"published","published":"2022-09-15T03:34:21Z","modified":"2023-06-27T23:07:44Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-285","CWE-1220"],"updated_at":"2026-11-02T14:36:55.184601Z"}],"nvd":[{"id":"CVE-2022-36110","description":"Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1.","status":"published","published":"2022-09-09T20:15:11.263Z","modified":"2026-06-17T04:52:56.557Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-285","CWE-1220"],"updated_at":"2026-11-02T14:07:27.631109Z"}],"osv":[{"id":"CVE-2022-36110","title":"Netmaker vulnerable to Insufficient Granularity of Access Control","description":"Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1.","status":"published","published":"2022-09-09T19:15:12Z","modified":"2026-10-28T02:31:14.333141942Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1220","CWE-285"],"updated_at":"2026-11-02T15:44:26.195407Z"},{"id":"GHSA-ggf6-638m-vqmg","title":"Netmaker vulnerable to Insufficient Granularity of Access Control","description":"### Impact\nImproper Authorization functions leads to non-privileged users running privileged API calls. If you have added users to your Netmaker platform who whould not have admin privileges, they could use their auth token to run admin-level functions via the API.\n\nIn addition, differing response codes based on function calls allowed non-users to potentially brute force the determination of names of networks on the system.\n\n### Patches\nThis problem has been patched in v0.15.1. To apply:\n\n1. docker-compose down\n2. docker pull gravitl/netmaker:v0.15.1\n3. docker-compose up -d\n\n### For more information\nIf you have any questions or comments about this advisory:\n\nEmail us at [info@netmaker.io](mailto:info@netmaker.io)\nThis vulnerability was brought to our attention by @tweidinger","status":"published","published":"2022-09-15T03:34:21Z","modified":"2024-08-21T16:28:50.880299Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-1220","CWE-285"],"updated_at":"2026-11-02T15:46:47.822182Z"},{"id":"GO-2022-0986","title":"Netmaker vulnerable to Insufficient Granularity of Access Control in github.com/gravitl/netmaker","description":"Netmaker vulnerable to Insufficient Granularity of Access Control in github.com/gravitl/netmaker","status":"published","published":"2024-08-21T16:03:24Z","modified":"2026-03-03T04:52:33.711237Z","updated_at":"2026-11-02T15:47:00.918515Z"}]}}