{"id":"CVE-2023-33265","aliases":["CLSA-2026-1769990937","EUVD-2023-2023","GHSA-c5vj-wp4v-mmvx"],"status":"published","title":"Hazelcast Executor Services don't check client permissions properly","description":"In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.","severity":{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00688,"percentile":0.52987,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-862"],"published":"2023-07-18T00:00:00Z","modified":"2026-11-02T19:45:12Z","fixes":[{"ecosystem":"Maven","package":"com.hazelcast:hazelcast","fixed_in":["5.2.4","5.1.7","5.0.5"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"com.hazelcast:hazelcast-enterprise","fixed_in":["5.2.4","5.1.7","5.0.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"last_affected":"5.2.3"},{"fixed":"5.2.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"last_affected":"5.1.6"},{"fixed":"5.1.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.0.4"},{"fixed":"5.0.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"last_affected":"5.2.3"},{"fixed":"5.2.4"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"last_affected":"5.1.6"},{"fixed":"5.1.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"5.0.4"},{"fixed":"5.0.5"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.8"},{"fixed":"4.2.8-tuxcare.1"}]}],"versions":["4.2.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.hazelcast:hazelcast-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.8"},{"fixed":"4.2.8-tuxcare.1"}]}],"versions":["4.2.8"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.4"}]}],"versions":["5.2.0","5.2.1","5.2.2","5.2.3"]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.7"}]}],"versions":["5.1","5.1.1","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6"]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5"}]}],"versions":["1.5","1.5.1","1.5.2","1.5.3","1.6","1.6-RC1","1.7","1.7-RC1","1.7-RC2","1.7-RC3","1.7-RC4","1.7.1","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.9","1.9.1","1.9.1-RC2","1.9.2","1.9.2.1","1.9.2.2","1.9.2.3","1.9.3","1.9.3-RC","1.9.3.1","1.9.3.2","1.9.3.3","1.9.3.4","1.9.4","1.9.4-RC","1.9.4-RC1","1.9.4.1","1.9.4.2","1.9.4.3","1.9.4.4","1.9.4.5","1.9.4.6","1.9.4.8","2.0","2.0-RC1","2.0-RC2","2.0.1","2.0.2","2.0.3","2.0.4","2.1","2.1.1","2.1.2","2.1.3","2.2","2.3","2.3.1","2.4","2.4.1","2.5","2.5.1","2.6","2.6.1","2.6.10","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","3.0","3.0-RC1","3.0-RC2","3.0.1","3.0.2","3.0.3","3.1","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.10","3.10-BETA-1","3.10-BETA-2","3.10.1","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.7","3.11","3.11-BETA-1","3.11.1","3.11.2","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.12","3.12-BETA-1","3.12-BETA-2","3.12.1","3.12.10","3.12.11","3.12.12","3.12.13","3.12.2","3.12.3","3.12.4","3.12.5","3.12.6","3.12.7","3.12.8","3.12.9","3.2","3.2-RC1","3.2-RC2","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.3","3.3-EA","3.3-EA2","3.3-RC1","3.3-RC2","3.3-RC3","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.4","3.4-EA","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.5","3.5-EA","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.6","3.6-EA","3.6-EA2","3.6-EA3","3.6-RC1","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.6.8","3.7","3.7-EA","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.7.6","3.7.7","3.7.8","3.8","3.8-EA","3.8-RC1","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.8.7","3.8.8","3.8.9","3.9","3.9-EA","3.9.1","3.9.2","3.9.3","3.9.4","4.0","4.0-BETA-1","4.0-BETA-2","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.1","4.1-BETA-1","4.1.1","4.1.10","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9","4.2","4.2-BETA-1","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8","5.0","5.0-BETA-1","5.0-BETA-2","5.0.1","5.0.2","5.0.3","5.0.4"]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.4"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1.0"},{"fixed":"5.1.7"}]}]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast-enterprise","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.5"}]}]}],"products":[{"vendor":"hazelcast","product":"hazelcast"},{"vendor":"hazelcast","product":"imdg"}],"references":[{"url":"https://github.com/hazelcast/hazelcast","tags":["x_transferred","Product","package"]},{"url":"https://support.hazelcast.com/s/article/Security-Advisory-for-CVE-2023-33265","tags":["x_transferred","Vendor Advisory","web"]},{"url":"https://github.com/hazelcast/hazelcast/security/advisories/GHSA-c5vj-wp4v-mmvx","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-33265","tags":["advisory"]},{"url":"https://github.com/hazelcast/hazelcast/releases/tag/v5.0.5","tags":["web"]},{"url":"https://github.com/hazelcast/hazelcast/releases/tag/v5.1.7","tags":["web"]},{"url":"https://github.com/hazelcast/hazelcast/releases/tag/v5.2.4","tags":["web"]},{"url":"https://github.com/advisories/GHSA-c5vj-wp4v-mmvx"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/33xxx/CVE-2023-33265.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2023-33265","description":"In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.","status":"published","published":"2023-07-18T00:00:00Z","modified":"2024-10-28T18:31:09.582Z","updated_at":"2026-11-02T14:35:34.55015Z"}],"euvd":[{"id":"EUVD-2023-2023","description":"In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.","status":"published","published":"2023-07-18T00:00:00Z","modified":"2024-10-28T18:31:09Z","updated_at":"2026-11-03T00:05:16.135425Z"}],"ghsa":[{"id":"GHSA-c5vj-wp4v-mmvx","title":"Hazelcast Executor Services don't check client permissions properly","description":"### Impact\nIn Hazelcast Platform, 5.0 through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, and Hazelcast IMDG (all versions up to 4.2.z), Executor Services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.\n\n### Patches\nFix versions: 5.3.0, 5.2.4, 5.1.7, 5.0.5\n\n### Workarounds\nUsers are only affected when they already use executor services (i.e., an instance exists as a distributed data structure).\n\n","status":"published","published":"2023-07-19T22:08:40Z","modified":"2023-11-07T05:02:48Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:37:15.055009Z"}],"nvd":[{"id":"CVE-2023-33265","description":"In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.","status":"published","published":"2023-07-18T16:15:11.693Z","modified":"2026-06-17T06:01:26.363Z","cvss":[{"version":"3.1","score":8.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T14:08:17.044696Z"}],"osv":[{"id":"GHSA-c5vj-wp4v-mmvx","title":"Hazelcast Executor Services don't check client permissions properly","description":"### Impact\nIn Hazelcast Platform, 5.0 through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, and Hazelcast IMDG (all versions up to 4.2.z), Executor Services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.\n\n### Patches\nFix versions: 5.3.0, 5.2.4, 5.1.7, 5.0.5\n\n### Workarounds\nUsers are only affected when they already use executor services (i.e., an instance exists as a distributed data structure).\n\n","status":"published","published":"2023-07-19T22:08:40Z","modified":"2024-02-16T08:10:07.875157Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H","level":"high"}],"cwes":["CWE-862"],"updated_at":"2026-11-02T15:46:44.571161Z"},{"id":"CLSA-2026-1769990937","title":"TuxCare security update for com.hazelcast (3 CVEs)","description":"TuxCare rebuilt 2 com.hazelcast packages to address 3 CVEs. Fixed in 4.2.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:12.706351658Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CVE-2023-33265","description":"In Hazelcast through 5.0.4, 5.1 through 5.1.6, and 5.2 through 5.2.3, executor services don't check client permissions properly, allowing authenticated users to execute tasks on members without the required permissions granted.","status":"published","published":"2023-07-18T00:00:00Z","modified":"2026-10-28T02:30:52.435614122Z","updated_at":"2026-11-02T15:44:32.116263Z"}]}}