CVE-2023-22648 — Privilege Dropping / Lowering Errors in Rancher

CWE-271 — Privilege Dropping / Lowering ErrorsCWE-269 — Improper Privilege ManagementCWE-384 — Session Fixation4 documents4 sources
Severity
8.8HIGHNVD
CNA8.0
EPSS
0.2%
top 60.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Suse RancherGithub.com Rancher Rancher
Timeline
PublishedJun 1
Latest updateMar 3

Description

A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged in the Rancher UI. This would cause the users to retain their previous permissions in Rancher, even if they change groups on Azure AD, for example, to a lower privileged group, or are removed from a group, thus retaining their access to Rancher instead of losing it. This issue affects Rancher: from >= 2.6.7 before = 2.7.0 before < 2.7.4.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages3 packages

▶CVEListV5suse/rancher>= 2.6.7 — < 2.6.13+1
▶NVDsuse/rancher2.6.7 — 2.6.13+1
▶Gogithub.com/rancher_rancher2.6.7 — 2.6.13+1

🔴Vulnerability Details

3
OSV
Rancher's Azure AD permission changes are not reflected on active sessions↗2026-03-03
▶
GHSA
Rancher's Azure AD permission changes are not reflected on active sessions↗2026-03-03
▶
CVEList
CVE-2023-22648: A Improper Privilege Management vulnerability in SUSE Rancher causes permission changes in Azure AD not to be reflected to users while they are logged↗2023-06-01
▶
CVE-2023-22648 — Privilege Dropping / Lowering Errors | cvebase