{"action":"Upgrade goauthentik.io to 2024.4.4 or later.","affected":[{"fixed":"2024.6.4","introduced":"2024.6.0-rc1"},{"fixed":"2024.4.4","introduced":"0"}],"component":"goauthentik.io","cve_ids":["CVE-2024-42490"],"ecosystem":"Go","epss":0.00477,"exploited":false,"fixed_versions":["2024.6.4","2024.4.4"],"ghsa_id":"GHSA-qxqc-27pr-wgc8","id":"tcs_01M5KFKTND6307H230KBXTKTNY","modified_at":"2026-04-17T04:57:10.157926961Z","published_at":"2024-08-22T16:39:25Z","references":["https://osv.dev/vulnerability/GHSA-qxqc-27pr-wgc8","https://github.com/goauthentik/authentik/security/advisories/GHSA-qxqc-27pr-wgc8","https://nvd.nist.gov/vuln/detail/CVE-2024-42490","https://github.com/goauthentik/authentik/commit/19318d4c00bb02c4ec3c4f8f15ac2e1dbe8d846c","https://github.com/goauthentik/authentik/commit/359b343f51524342a5ca03828e7c975a1d654b11","https://github.com/goauthentik/authentik"],"severity":{"label":"high","score":8.7},"sources":[{"source":"osv","source_id":"GHSA-qxqc-27pr-wgc8","url":"https://osv.dev/vulnerability/GHSA-qxqc-27pr-wgc8"}],"summary":"GoAuthentik vulnerable to Insufficient Authorization for several API endpoints"}