CVE-2018-1000211

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2018-07-13 · updated 2026-06-17
Weakness: CWE-732

Description

Doorkeeper version 4.2.0 and later contains a Incorrect Access Control vulnerability in Token revocation API's authorized method that can result in Access tokens are not revoked for public OAuth apps, leaking access until expiry.

Affected products

doorkeeper-gem doorkeeper: through 4.2.0

References

https://github.com/doorkeeper-gem/doorkeeper/issues/891
https://github.com/doorkeeper-gem/doorkeeper/pull/1119
https://github.com/doorkeeper-gem/doorkeeper/issues/891
https://github.com/doorkeeper-gem/doorkeeper/pull/1119

Get alerted when CVE-2018-1000211 or the next vulnerability affects your stack