{"action":"No fix published. Pin and monitor.","affected":[{"introduced":"0"}],"component":"goauthentik.io","cve_ids":["CVE-2024-42490"],"ecosystem":"Go","epss":0.00477,"exploited":false,"fixed_versions":[],"ghsa_id":"GHSA-qxqc-27pr-wgc8","id":"tcs_01M5KG4ZDJWAGXN4Y4Y08PKPT3","modified_at":"2026-04-17T04:57:10.157926961Z","published_at":"2024-08-30T17:18:07Z","references":["https://osv.dev/vulnerability/GO-2024-3085","https://github.com/goauthentik/authentik/security/advisories/GHSA-qxqc-27pr-wgc8","https://nvd.nist.gov/vuln/detail/CVE-2024-42490","https://github.com/goauthentik/authentik/commit/19318d4c00bb02c4ec3c4f8f15ac2e1dbe8d846c","https://github.com/goauthentik/authentik/commit/359b343f51524342a5ca03828e7c975a1d654b11"],"severity":{"label":"unknown"},"sources":[{"source":"osv","source_id":"GO-2024-3085","url":"https://osv.dev/vulnerability/GO-2024-3085"}],"summary":"GoAuthentik vulnerable to Insufficient Authorization for several API endpoints in goauthentik.io"}