{"id":"CVE-2023-22648","revision":"62448a3519e94d9d833757daac439be1","records":[{"revision":"62448a3519e94d9d833757daac439be1","observedAt":"2026-10-24T21:17:28.488+00:00","statement":{"source":"nvd","id":"CVE-2023-22648","aliases":[],"title":"A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users ","description":"A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users \nwhile they are logged in the Rancher UI. This would cause the users to \nretain their previous permissions in Rancher, even if they change groups\n on Azure AD, for example, to a lower privileged group, or are removed \nfrom a group, thus retaining their access to Rancher instead of losing \nit.\nThis issue affects Rancher: from >= 2.6.7 before < 2.6.13, from >= 2.7.0 before < 2.7.4.","state":0,"publishedAt":"2023-06-01T13:15:10.553+00:00","modifiedAt":"2026-10-24T13:10:00.147+00:00","affected":[],"metrics":[{"system":"CVSS 3.1 · meissner@suse.de · Secondary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H","score":8,"severity":"HIGH"},{"system":"CVSS 3.1 · nvd@nist.gov · Primary","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":8.8,"severity":"HIGH"}],"references":["https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-22648","https://github.com/rancher/rancher/security/advisories/GHSA-vf6j-6739-78m8"],"sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2023-22648","license":"NIST NVD usage terms; underlying source attribution retained","enrichment":{"sourceStatus":"Modified","weaknesses":["CWE-271","NVD-CWE-Other"],"productCriteria":["cpe:2.3:a:suse:rancher:*:*:*:*:*:*:*:*"],"sourceDates":{"published":"2023-06-01T13:15:10.553","lastModified":"2026-10-24T13:10:00.147"},"relatedAdvisories":[],"note":"NVD analysis and CPE criteria are source context, not proof that a package or your environment is affected. Complete affected data, logical configurations and SSVC are retained in the original JSON."},"key":"nvd:CVE-2023-22648","identifiers":["CVE-2023-22648"]},"retained":false,"historicalAffected":[]}],"coverage":[]}