CVE-2017-15052

TeamPass before 2.1.27.9 does not properly enforce manager access control when requesting users.queries.php. It is then possible for a manager user to delete an arbitrary user (including admin), or modify attributes of any arbitrary user except administrator. To exploit the vulnerability, an authenticated attacker must have the manager rights on the application, then tamper with the requests sent directly, for example by changing the "id" parameter when invoking "delete_user" on users.queries.php.

• CWE-269

• http://blog.amossys.fr/teampass-multiple-cve-01.htmlExploit, Technical Description, Third Party Advisory
• https://github.com/nilsteampassnet/TeamPass/commit/8f2d51dd6c24f76e4f259d0df22cff9b275f2dd1Patch
• http://blog.amossys.fr/teampass-multiple-cve-01.htmlExploit, Technical Description, Third Party Advisory
• https://github.com/nilsteampassnet/TeamPass/commit/8f2d51dd6c24f76e4f259d0df22cff9b275f2dd1Patch

Published

Nov 27, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-15045LAME 3.99, 3.99.1, 3.99.2, 3.99.3, 3.99.4, 3.99.5, 3.98.4, 3…
• CVE-2017-15046LAME 3.99.5, 3.99.4, 3.98.4, 3.98.2, 3.98 and 3.97 have a st…5.5
• CVE-2017-15047The clusterLoadConfig function in cluster.c in Redis 4.0.2 a…
• CVE-2017-15048Stack-based buffer overflow in the ZoomLauncher binary in th…8.8
• CVE-2017-15049The ZoomLauncher binary in the Zoom client for Linux before …8.8
• CVE-2017-15051Multiple stored cross-site scripting (XSS) vulnerabilities i…
• CVE-2017-15053TeamPass before 2.1.27.9 does not properly enforce manager a…
• CVE-2017-15054An arbitrary file upload vulnerability, present in TeamPass …
• CVE-2017-15055TeamPass before 2.1.27.9 does not properly enforce item acce…
• CVE-2017-15056p_lx_elf.cpp in UPX 3.94 mishandles ELF headers, which allow…
• CVE-2017-1506IBM Cognos TM1 10.2 and 10.2.2 is vulnerable to cross-site s…
• CVE-2017-15063There are CSRF vulnerabilities in Subrion CMS 4.1.x through …