{"id":"GHSA-2g9v-7mr5-fgjg","revision":"ed38812806624eb1b2aa60747b44ec2b","records":[{"revision":"ed38812806624eb1b2aa60747b44ec2b","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-2g9v-7mr5-fgjg","aliases":["CVE-2026-42300","GO-2026-4988"],"title":"DevGuard has an unauthenticated identity assertion via `X-Admin-Token` header","description":"### Impact\nThe `SessionMiddleware` accepts a client-supplied `X-Admin-Token` HTTP request header and uses its raw string value as the authenticated `userID` when no Kratos session cookie is present. An unauthenticated attacker who knows or can guess a target user's Kratos identity UUID can issue requests as that user. Where the target user is an organisation `admin` or `owner`, this gives the attacker full control over that organisation's DevGuard resources.\n\n### Patches\nThe release v1.2.2 patches this issue. Update your DevGuard API Instances to this version.\n\n### Workarounds\nConfigure a reverse proxy to strip the `X-Admin-Token` header before sending requests to the DevGuard API.\n\n### Resources\nFixed commit: https://github.com/l3montree-dev/devguard/commit/6f38310bf93b2a63df3055038f4da82b1f4e6d9a","state":0,"publishedAt":"2026-05-05T20:58:27+00:00","modifiedAt":"2026-05-20T19:41:10.9067755+00:00","affected":[{"ecosystem":"Go","name":"github.com/l3montree-dev/devguard","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.2.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V4","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"CRITICAL"}],"references":["https://github.com/l3montree-dev/devguard/security/advisories/GHSA-2g9v-7mr5-fgjg","https://nvd.nist.gov/vuln/detail/CVE-2026-42300","https://github.com/l3montree-dev/devguard/commit/6f38310bf93b2a63df3055038f4da82b1f4e6d9a","https://github.com/l3montree-dev/devguard"],"sourceUrl":"https://github.com/advisories/GHSA-2g9v-7mr5-fgjg","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-2g9v-7mr5-fgjg","identifiers":["GHSA-2g9v-7mr5-fgjg","CVE-2026-42300","GO-2026-4988"]},"retained":false,"historicalAffected":[]}],"coverage":[]}