CVE-2020-11671: Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass…

PriorityP347high8.1CVSS 3.1

AVNACLPRLUINSUCHIHAN

EPSS

1.11%

61.8th percentile

Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
nilsteampassnet	teampass	0 – 2.1.27.36	—
teampass	teampass	<= 2.1.27.36	—

CVSS provenance

nvdv3.18.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N

nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.