CVE-2022-31164: Tovy before v0.7.51 vulnerable to users logging in as and impersonating other users

Severity: high (CVSS 7.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2022-07-22 · updated 2026-06-17
Weakness: CWE-287

Description

Tovy is a a staff management system for Roblox groups. A vulnerability in versions prior to 0.7.51 allows users to log in as other users, including privileged users such as the other of the instance. The problem has been patched in version 0.7.51.

Affected products

tovyblox tovy: before 0.7.51 — fixed in 0.7.51

How to fix

Upgrade to a fixed version: tovyblox tovy 0.7.51. Check the vendor advisory for mitigations.

References

https://github.com/tovyblox/tovy/pull/63
https://github.com/tovyblox/tovy/security/advisories/GHSA-j6f8-wh4v-jc37
https://github.com/tovyblox/tovy/pull/63
https://github.com/tovyblox/tovy/security/advisories/GHSA-j6f8-wh4v-jc37

Get alerted when CVE-2022-31164 or the next vulnerability affects your stack