CVE-2021-32076: Access Restriction bypass vulnerability via referrer spoof - Business Logic Bypass

Severity: medium (CVSS 5.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-08-26 · updated 2026-06-17
Weakness: CWE-290

Description

Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.

Affected products

SolarWinds Web Help Desk: through 12.7.2

References

https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076
https://exchange.xforce.ibmcloud.com/vulnerabilities/208278
https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076

Get alerted when CVE-2021-32076 or the next vulnerability affects your stack