CVE-2023-30946: Issues notification metadata lacks authorization

Severity: medium (CVSS 4.3 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-06-29 · updated 2026-06-17
Weakness: CWE-288

Description

A security defect was identified in Foundry Issues. If a user was added to an issue on a resource that they did not have access to and consequently could not see, they could query Foundry's Notification API and receive metadata about the issue including the RID of the issue, severity, internal UUID of the author, and the user-defined title of the issue.

Affected products

Palantir Foundry Issues: before 2.497.0 — fixed in 2.497.0

How to fix

Upgrade to a fixed version: Palantir Foundry Issues 2.497.0. Check the vendor advisory for mitigations.

References

https://palantir.safebase.us/?tcuUid=4cf0b6e6-564a-467b-83ae-36fec3a491c3
https://palantir.safebase.us/?tcuUid=4cf0b6e6-564a-467b-83ae-36fec3a491c3

Get alerted when CVE-2023-30946 or the next vulnerability affects your stack