Ethyca Fides vulnerabilities

CVE-2024-31223 [MEDIUM] CWE-497 CVE-2024-31223: Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-si Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP address, private domain name, and/or port. A vulnerabilit

CVE-2024-38537 [CRITICAL] CWE-829 CVE-2024-38537: Fides is an open-source privacy engineering platform. `fides.js`, a client-side script used to inter Fides is an open-source privacy engineering platform. `fides.js`, a client-side script used to interact with the consent management features of Fides, used the `polyfill.io` domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard. Therefore it was possible for users of legacy, pre-

CVE-2023-48224 [CRITICAL] CWE-338 CVE-2023-48224: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy re Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides Privacy Center allows data subject users to submit privacy and consent requests to data controller users of the Fides web application. Privacy requests al

CVE-2024-52008 [HIGH] CWE-602 CVE-2024-52008: Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password complexity requirements, direct API calls can circumvent these checks, enabling the creation of

CVE-2023-36827 [HIGH] CWE-22 CVE-2023-36827: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy re Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. A path traversal (directory traversal) vulnerability affects fides versions lower than version `2.15.1`, allowing remote attackers to access arbitrary files on the fides

CVE-2024-45053 [HIGH] CWE-1336 CVE-2024-45053: Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to versio Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code Execution to privileged users. A privileged user refers to a

CVE-2023-41319 [HIGH] CWE-94 CVE-2023-41319: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy re Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows custom integrations to be uploaded as a ZIP file. This ZIP file must contain YAML files, but Fides can be configured to also accept the in

CVE-2025-57817 [HIGH] CWE-862 CVE-2025-57817: Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the OAuth client crea Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the OAuth client creation and update endpoints of the Fides Webserver API do not properly authorize scope assignment. This allows highly privileged users with `client:create` or `client:update` permissions to escalate their privileges to owner-level. Version 2.69.1 fixes th

CVE-2023-46124 [HIGH] CWE-918 CVE-2023-46124: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy re Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, and the enforcement of privacy regulations in code. The Fides web application allows a custom integration to be uploaded as a ZIP file containing configuration and dataset definitions in YAML format. It was discovered tha

CVE-2025-57816 [HIGH] CWE-799 CVE-2025-57816: Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Webserver A Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Webserver API's built-in IP-based rate limiting is ineffective in environments with CDNs, proxies or load balancers. The system incorrectly applies rate limits based on directly connected infrastructure IPs rather than client IPs, and stores counters in-memory rat

CVE-2026-44541 [HIGH] CWE-79 CVE-2026-44541: Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, Fides is an open-source privacy engineering platform. From version 2.33.0 to before version 2.84.5, there is a DOM-based XSS vulnerability in fides.js via the fides_description override. This issue has been patched in version 2.84.5.

CVE-2025-57815 [MEDIUM] CWE-307 CVE-2025-57815: Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Admin UI lo Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to conduct credential testing attacks, such as credential

CVE-2023-46125 [MEDIUM] CWE-200 CVE-2023-46125: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy re Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows users to retrieve its configuration using the `GET api/v1/config` endpoint. The configuration data is filtered to suppress most sensiti

CVE-2024-35189 [MEDIUM] CWE-200 CVE-2024-35189: Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints Fides is an open-source privacy engineering platform. The Fides webserver has a number of endpoints that retrieve `ConnectionConfiguration` records and their associated `secrets` which _can_ contain sensitive data (e.g. passwords, private keys, etc.). These `secrets` are stored encrypted at rest (in the application database), and the associated endpo

CVE-2026-42303 [MEDIUM] CWE-288 CVE-2026-42303: Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployment Fides is an open-source privacy engineering platform. From 2.75.0 to before 2.83.2, Fides deployments that enable both subject identity verification and duplicate privacy request detection are affected by a vulnerability in which an administrator can approve a privacy request whose identity was never verified. For erasure policies, this can result i

CVE-2023-47114 [MEDIUM] CWE-79 CVE-2023-47114: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy re Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating

CVE-2024-45052 [MEDIUM] CWE-208 CVE-2024-45052: Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based userna Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takes for the server to respond to login requests. The

CVE-2025-57766 [MEDIUM] CWE-613 CVE-2025-57766: Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user passwor Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors (such as XSS) can maintain access even after password reset. This is

CVE-2023-46126 [MEDIUM] CWE-79 CVE-2023-46126: Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy re Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in runtime environments, helping enforce privacy regulations in code. The Fides web application allows users to edit consent and privacy notices such as cookie banners. The vulnerability makes it possible to craft a payload in the privacy policy

CVE-2023-37480 [MEDIUM] CWE-400 CVE-2023-37480: Fides is an open-source privacy engineering platform for managing data privacy requests and privacy Fides is an open-source privacy engineering platform for managing data privacy requests and privacy regulations. The Fides webserver is vulnerable to a type of Denial of Service (DoS) attack. Attackers can exploit a weakness in the connector template upload feature to upload a malicious zip bomb file, resulting in resource exhaustion and service unav