CVE-2020-11671

Lack of authorization controls in REST API functions in TeamPass through 2.1.27.36 allows any TeamPass user with a valid API token to become a TeamPass administrator and read/modify all passwords via authenticated api/index.php REST API calls. NOTE: the API is not available by default.

• CWE-862

• https://github.com/nilsteampassnet/TeamPass/issues/2765Exploit, Issue Tracking, Third Party Advisory
• https://github.com/nilsteampassnet/TeamPass/issues/2765Exploit, Issue Tracking, Third Party Advisory

Published

May 4, 2020

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-11664CA API Developer Portal 4.3.1 and earlier handles homeRedire…6.1
• CVE-2020-11665CA API Developer Portal 4.3.1 and earlier handles loginRedir…6.1
• CVE-2020-11666CA API Developer Portal 4.3.1 and earlier contains an access…8.8
• CVE-2020-11668In the Linux kernel before 5.6.1, drivers/media/usb/gspca/xi…7.1
• CVE-2020-11669An issue was discovered in the Linux kernel before 5.2 on th…5.5
• CVE-2020-1167<p>A remote code execution vulnerability exists in the way t…7.8
• CVE-2020-11673An issue was discovered in the Responsive Poll through 1.3.4…9.8
• CVE-2020-11674Cerner medico 26.00 allows variable reuse, possibly causing …8.8
• CVE-2020-11675Cerner medico 26.00 has a Local Buffer Overflow (issue 1 of …8.8
• CVE-2020-11676Cerner medico 26.00 has a Local Buffer Overflow (issue 2 of …8.8
• CVE-2020-11677Cerner medico 26.00 has a Local Buffer Overflow (issue 3 of …8.8
• CVE-2020-11679Castel NextGen DVR v1.0.0 is vulnerable to privilege escalat…8.8