CVE-2023-35937: Metersphere missing permission check

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-07-06 · updated 2026-06-17
Weakness: CWE-862

Description

Metersphere is an open source continuous testing platform. In versions prior to 2.10.2 LTS, some key APIs in Metersphere lack permission checks. This allows ordinary users to execute APIs that can only be executed by space administrators or project administrators. For example, ordinary users can be updated as space administrators. Version 2.10.2 LTS has a patch for this issue.

Affected products

metersphere: before 2.10.2 — fixed in 2.10.2

How to fix

Upgrade to a fixed version: metersphere 2.10.2. Check the vendor advisory for mitigations.

References

https://github.com/metersphere/metersphere/security/advisories/GHSA-7xj3-qrx5-524r
https://github.com/metersphere/metersphere/security/advisories/GHSA-7xj3-qrx5-524r

Get alerted when CVE-2023-35937 or the next vulnerability affects your stack