CVE-2024-32470

MEDIUM

Tolgee 3.57.2-3.57.4 - Incorrect Authorization via Admin API Key

Title source: llm
STIX 2.1

Description

Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57.4.

References (3)

Core 3

Scores

CVSS v3 6.5
EPSS 0.0056
EPSS Percentile 41.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-863
Status published
Products (1)
tolgee/tolgee 3.57.2 - 3.57.4
Published Apr 18, 2024
Tracked Since Feb 18, 2026