7.6
CVE-2024-58260
- EPSS 0.02%
- Veröffentlicht 02.10.2025 12:15:28
- Zuletzt bearbeitet 15.04.2026 00:35:42
- Quelle meissner@suse.de
- CVE-Watchlists
- Unerledigt
Rancher update on users can deny the service to the admin
A vulnerability has been identified within Rancher Manager where a missing server-side validation on the `.username` field in Rancher can allow users with update permissions on other User resources to cause denial of access for targeted accounts.
Daten sind bereitgestellt durch das CVE Programm von einer CVE Numbering Authority (CNA) (Unstrukturiert).
HerstellerSUSE
≫
Produkt
rancher
Default Statusunaffected
Version
2.12.0
Version <
2.12.2
Status
affected
Version
2.11.0
Version <
2.11.6
Status
affected
Version
2.10.0
Version <
2.10.10
Status
affected
Version
2.9.0
Version <
2.9.12
Status
affected
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.02% | 0.041 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| meissner@suse.de | 7.6 | 2.3 | 4.7 |
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:H
|
CWE-863 Incorrect Authorization
The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.