{"action":"Upgrade prosody-modules to 0.0~hg20200128.09e7e880e056+dfsg-1 or later.","affected":[{"introduced":"0"}],"component":"prosody-modules","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["0.0~hg20200128.09e7e880e056+dfsg-1"],"id":"tcs_01M5NF8A5NZDYKWVPJZ2CAMMJH","modified_at":"2026-10-26T12:02:33.846734570Z","published_at":"2020-01-28T17:15:12.460Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2020-8086","https://security-tracker.debian.org/tracker/CVE-2020-8086"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2020-8086","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2020-8086"}],"summary":"The mod_auth_ldap and mod_auth_ldap2 Community Modules through 2020-01-27 for Prosody incompletely verify the XMPP address passed to the is_admin() function. This grants remote entities admin-only fun"}