{"id":"CVE-2023-45859","aliases":["CLSA-2026-1769990937","EUVD-2024-0767","GHSA-xh6m-7cr7-xx66"],"status":"published","title":"Missing permission checks on Hazelcast client protocol","description":"In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.","severity":{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.00518,"percentile":0.44332,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-281","CWE-922"],"published":"2024-02-27T21:54:15Z","modified":"2026-11-02T19:45:12Z","fixes":[{"ecosystem":"Maven","package":"com.hazelcast:hazelcast","fixed_in":["5.2.5","5.3.5"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"last_affected":"4.2.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"last_affected":"5.0.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1"},{"last_affected":"5.1.7"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"last_affected":"5.2.4"},{"fixed":"5.2.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.5"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.10"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"com.hazelcast:hazelcast-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"last_affected":"4.2.8"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.8"},{"fixed":"4.2.8-tuxcare.1"}]}],"versions":["4.2.8"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"com.hazelcast:hazelcast-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.8"},{"fixed":"4.2.8-tuxcare.1"}]}],"versions":["4.2.8"],"bundled":3},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.10"}]}],"versions":["1.5","1.5.1","1.5.2","1.5.3","1.6","1.6-RC1","1.7","1.7-RC1","1.7-RC2","1.7-RC3","1.7-RC4","1.7.1","1.8","1.8.1","1.8.2","1.8.3","1.8.4","1.8.5","1.9","1.9.1","1.9.1-RC2","1.9.2","1.9.2.1","1.9.2.2","1.9.2.3","1.9.3","1.9.3-RC","1.9.3.1","1.9.3.2","1.9.3.3","1.9.3.4","1.9.4","1.9.4-RC","1.9.4-RC1","1.9.4.1","1.9.4.2","1.9.4.3","1.9.4.4","1.9.4.5","1.9.4.6","1.9.4.8","2.0","2.0-RC1","2.0-RC2","2.0.1","2.0.2","2.0.3","2.0.4","2.1","2.1.1","2.1.2","2.1.3","2.2","2.3","2.3.1","2.4","2.4.1","2.5","2.5.1","2.6","2.6.1","2.6.10","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","3.0","3.0-RC1","3.0-RC2","3.0.1","3.0.2","3.0.3","3.1","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.10","3.10-BETA-1","3.10-BETA-2","3.10.1","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.7","3.11","3.11-BETA-1","3.11.1","3.11.2","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.12","3.12-BETA-1","3.12-BETA-2","3.12.1","3.12.10","3.12.11","3.12.12","3.12.13","3.12.2","3.12.3","3.12.4","3.12.5","3.12.6","3.12.7","3.12.8","3.12.9","3.2","3.2-RC1","3.2-RC2","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.3","3.3-EA","3.3-EA2","3.3-RC1","3.3-RC2","3.3-RC3","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.4","3.4-EA","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.5","3.5-EA","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.6","3.6-EA","3.6-EA2","3.6-EA3","3.6-RC1","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.6.8","3.7","3.7-EA","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.7.6","3.7.7","3.7.8","3.8","3.8-EA","3.8-RC1","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.8.7","3.8.8","3.8.9","3.9","3.9-EA","3.9.1","3.9.2","3.9.3","3.9.4","4.0","4.0-BETA-1","4.0-BETA-2","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.1","4.1-BETA-1","4.1.1","4.1.10","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9"]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"last_affected":"4.2.8"}]}],"versions":["4.2","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8"]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0"},{"last_affected":"5.0.5"}]}],"versions":["5.0","5.0.1","5.0.2","5.0.3","5.0.4","5.0.5"]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.1"},{"last_affected":"5.1.7"}]}],"versions":["5.1","5.1.1","5.1.2","5.1.3","5.1.4","5.1.5","5.1.6","5.1.7"]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"5.2.5"}]}],"versions":["5.2.0","5.2.1","5.2.2","5.2.3","5.2.4"]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.3.0"},{"fixed":"5.3.5"}]}],"versions":["5.3.0","5.3.1","5.3.2","5.3.4"]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.1.10"}]}],"versions":["1.8.4","1.8.5","1.9","1.9.1","1.9.1-RC2","1.9.2","1.9.2.1","1.9.2.2","1.9.2.3","1.9.3","1.9.3-RC","1.9.3.1","1.9.3.2","1.9.3.3","1.9.3.4","1.9.4","1.9.4-RC","1.9.4-RC1","1.9.4.1","1.9.4.2","1.9.4.3","1.9.4.4","1.9.4.5","1.9.4.6","1.9.4.8","2.0","2.0-RC1","2.0-RC2","2.0.1","2.0.2","2.0.3","2.0.4","2.1","2.1.1","2.1.2","2.1.3","2.2","2.3","2.3.1","2.4","2.4.1","2.5","2.5.1","2.6","2.6.1","2.6.10","2.6.2","2.6.3","2.6.4","2.6.5","2.6.6","2.6.7","2.6.8","2.6.9","3.0","3.0-RC1","3.0-RC2","3.0.1","3.0.2","3.0.3","3.1","3.1.1","3.1.2","3.1.3","3.1.4","3.1.5","3.1.6","3.1.7","3.1.8","3.1.9","3.10","3.10-BETA-1","3.10-BETA-2","3.10.1","3.10.2","3.10.3","3.10.4","3.10.5","3.10.6","3.10.7","3.11","3.11-BETA-1","3.11.1","3.11.2","3.11.3","3.11.4","3.11.5","3.11.6","3.11.7","3.12","3.12-BETA-1","3.12-BETA-2","3.12.1","3.12.10","3.12.11","3.12.12","3.12.13","3.12.2","3.12.3","3.12.4","3.12.5","3.12.6","3.12.7","3.12.8","3.12.9","3.2","3.2-RC1","3.2-RC2","3.2.1","3.2.2","3.2.3","3.2.4","3.2.5","3.2.6","3.2.7","3.3","3.3-EA","3.3-EA2","3.3-RC1","3.3-RC2","3.3-RC3","3.3.1","3.3.2","3.3.3","3.3.4","3.3.5","3.4","3.4-EA","3.4.1","3.4.2","3.4.3","3.4.4","3.4.5","3.4.6","3.4.7","3.4.8","3.5","3.5-EA","3.5.1","3.5.2","3.5.3","3.5.4","3.5.5","3.6","3.6-EA","3.6-EA2","3.6-EA3","3.6-RC1","3.6.1","3.6.2","3.6.3","3.6.4","3.6.5","3.6.6","3.6.7","3.6.8","3.7","3.7-EA","3.7.1","3.7.2","3.7.3","3.7.4","3.7.5","3.7.6","3.7.7","3.7.8","3.8","3.8-EA","3.8-RC1","3.8.1","3.8.2","3.8.3","3.8.4","3.8.5","3.8.6","3.8.7","3.8.8","3.8.9","3.9","3.9-EA","3.9.1","3.9.2","3.9.3","3.9.4","4.0","4.0-BETA-1","4.0-BETA-2","4.0.1","4.0.2","4.0.3","4.0.4","4.0.5","4.0.6","4.1","4.1-BETA-1","4.1.1","4.1.10","4.1.2","4.1.3","4.1.4","4.1.5","4.1.6","4.1.7","4.1.8","4.1.9"]},{"source":"osv","ecosystem":"Maven","package":"com.hazelcast:hazelcast-all","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2"},{"last_affected":"4.2.8"}]}],"versions":["4.2","4.2.1","4.2.2","4.2.3","4.2.4","4.2.5","4.2.6","4.2.7","4.2.8"]}],"products":[{"vendor":"hazelcast","product":"hazelcast"}],"references":[{"url":"https://github.com/hazelcast/hazelcast/pull/25509","tags":["x_transferred","Patch","fix","web"]},{"url":"https://github.com/hazelcast/hazelcast/security/advisories/GHSA-xh6m-7cr7-xx66","tags":["x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-45859","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-xh6m-7cr7-xx66"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/45xxx/CVE-2023-45859.json","tags":["advisory"]},{"url":"https://github.com/hazelcast/hazelcast","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2023-45859","description":"In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.","status":"published","published":"2024-02-28T00:00:00Z","modified":"2024-11-29T16:42:41.602Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"adp"}],"cwes":["CWE-922"],"updated_at":"2026-11-02T14:35:22.640346Z"}],"euvd":[{"id":"EUVD-2024-0767","description":"In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.","status":"published","published":"2024-02-28T00:00:00Z","modified":"2024-11-29T16:42:41Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-03T00:04:44.439112Z"}],"ghsa":[{"id":"GHSA-xh6m-7cr7-xx66","title":"Missing permission checks on Hazelcast client protocol","description":"### Impact\nIn Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.\n\n### Patches\nFix versions: 5.2.5, 5.3.5, 5.4.0-BETA-1\n\n### Workarounds\nThere is no known workaround.","status":"published","published":"2024-02-27T21:54:15Z","modified":"2026-03-24T05:06:34Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-281","CWE-922"],"updated_at":"2026-11-02T14:39:40.633038Z"}],"nvd":[{"id":"CVE-2023-45859","description":"In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.","status":"published","published":"2024-02-28T22:15:26.07Z","modified":"2026-06-17T06:29:40.273Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-922"],"updated_at":"2026-11-02T14:09:07.077422Z"}],"osv":[{"id":"CVE-2023-45859","description":"In Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.","status":"published","published":"2024-02-28T00:00:00Z","modified":"2026-10-28T02:30:55.279298399Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:44:34.287121Z"},{"id":"GHSA-xh6m-7cr7-xx66","title":"Missing permission checks on Hazelcast client protocol","description":"### Impact\nIn Hazelcast through 4.1.10, 4.2 through 4.2.8, 5.0 through 5.0.5, 5.1 through 5.1.7, 5.2 through 5.2.4, and 5.3 through 5.3.2, some client operations don't check permissions properly, allowing authenticated users to access data stored in the cluster.\n\n### Patches\nFix versions: 5.2.5, 5.3.5, 5.4.0-BETA-1\n\n### Workarounds\nThere is no known workaround.","status":"published","published":"2024-02-27T21:54:15Z","modified":"2026-07-08T06:53:01.798761514Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L","level":"high"}],"cwes":["CWE-281","CWE-922"],"updated_at":"2026-11-02T15:46:59.835583Z"},{"id":"CLSA-2026-1769990937","title":"TuxCare security update for com.hazelcast (3 CVEs)","description":"TuxCare rebuilt 2 com.hazelcast packages to address 3 CVEs. Fixed in 4.2.8-tuxcare.1.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-11-02T19:45:12.706351658Z","updated_at":"2026-11-02T20:30:40.499236Z"}]}}