{"action":"Upgrade @curveball/a12n-server to 0.18.2 or later.","affected":[{"fixed":"0.18.2","introduced":"0.18.0"}],"component":"@curveball/a12n-server","cve_ids":["CVE-2021-29452"],"ecosystem":"npm","epss":0.00781,"exploited":false,"fixed_versions":["0.18.2"],"ghsa_id":"GHSA-8hw9-22v6-9jr9","id":"tcs_01M5KFD5FBC4R9Y627Y35ZVRGS","modified_at":"2026-07-08T06:28:55.902862918Z","published_at":"2021-04-19T15:14:33Z","references":["https://osv.dev/vulnerability/GHSA-8hw9-22v6-9jr9","https://github.com/curveball/a12n-server/security/advisories/GHSA-8hw9-22v6-9jr9","https://nvd.nist.gov/vuln/detail/CVE-2021-29452","https://www.npmjs.com/package/@curveball/a12n-server"],"severity":{"label":"high","score":8.1},"sources":[{"source":"osv","source_id":"GHSA-8hw9-22v6-9jr9","url":"https://osv.dev/vulnerability/GHSA-8hw9-22v6-9jr9"}],"summary":"Any logged in user could edit any other logged in user."}