CVE-2021-29452: Any logged in user could edit any other logged in user.

Severity: medium (CVSS 6.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-16 · updated 2026-06-17
Weakness: CWE-269

Description

a12n-server is an npm package which aims to provide a simple authentication system. A new HAL-Form was added to allow editing users in version 0.18.0. This feature should only have been accessible to admins. Unfortunately, privileges were incorrectly checked allowing any logged in user to make this change. Patched in v0.18.2.

Affected products

curveball a12n-server: from 0.18.0 before 0.18.2 — fixed in 0.18.2

How to fix

Upgrade to a fixed version: curveball a12n-server 0.18.2. Check the vendor advisory for mitigations.

References

https://github.com/curveball/a12n-server/security/advisories/GHSA-8hw9-22v6-9jr9
https://www.npmjs.com/package/%40curveball/a12n-server
https://github.com/curveball/a12n-server/security/advisories/GHSA-8hw9-22v6-9jr9
https://www.npmjs.com/package/%40curveball/a12n-server

Get alerted when CVE-2021-29452 or the next vulnerability affects your stack