CVE-2021-25973.yml

---
gem: publify_core
cve: 2021-25973
ghsa: x24j-87x9-jvv5
url: https://github.com/publify/publify/commit/3447e0241e921b65f6eb1090453d8ea73e98387e
title: Improper Authorization in Publify
date: 2021-11-03
description: |
  In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control.
  `guest` role users can self-register even when the admin does not allow.
  This happens due to front-end restriction only.
cvss_v3: 6.5
unaffected_versions:
  - "< 9.0.0.pre1"
patched_versions:
  - ">= 9.2.5"
related:
  url:
    - https://www.whitesourcesoftware.com/vulnerability-database/CVE-2021-25973