GHSA-x24j-87x9-jvv5

Publify `guest` role users can self-register even when the admin does not allow it

Source: GitHub Advisory Database (reviewed) Moderate CVE-2021-25973

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	publify_core	>= 9.0.0.pre1, < 9.2.5	9.2.5

Details

As written in the advisory (Markdown source, shown as plain text).

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. `guest` role users can self-register even when the admin does not allow it. This happens due to front-end restriction only.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2021-25973 advisory
https://github.com/publify/publify/commit/3447e0241e921b65f6eb1090453d8ea73e98387e web
https://github.com/publify/publify web
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/publify_core/CVE-2021-25973.yml web
https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25973 web