CVE-2021-21246

OneDev is an all-in-one devops platform. In OneDev before version 4.0.3, the REST UserResource endpoint performs a security check to make sure that only administrators can list user details. However for the `/users/{id}` endpoint there are no security checks enforced so it is possible to retrieve arbitrary user details including their Access Tokens! These access tokens can be used to access the API or clone code in the build spec via the HTTP(S) protocol. It has permissions to all projects accessible by the user account. This issue may lead to `Sensitive data leak` and leak the Access Token which can be used to impersonate the administrator or any other users. This issue was addressed in 4.0.3 by removing user info from restful api.

• CWE-862

• https://github.com/theonedev/onedev/commit/a4491e5f79dc6cc96eac20972eedc8905ddf6089Patch, Third Party Advisory
• https://github.com/theonedev/onedev/security/advisories/GHSA-66v7-gg85-f4gxThird Party Advisory
• https://github.com/theonedev/onedev/commit/a4491e5f79dc6cc96eac20972eedc8905ddf6089Patch, Third Party Advisory
• https://github.com/theonedev/onedev/security/advisories/GHSA-66v7-gg85-f4gxThird Party Advisory

Published

Jan 15, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-21240httplib2 is a comprehensive HTTP client library for Python. …7.5
• CVE-2021-21241The Python "Flask-Security-Too" package is used for adding s…7.4
• CVE-2021-21242OneDev is an all-in-one devops platform. In OneDev before ve…9.8
• CVE-2021-21243OneDev is an all-in-one devops platform. In OneDev before ve…9.8
• CVE-2021-21244OneDev is an all-in-one devops platform. In OneDev before ve…9.8
• CVE-2021-21245OneDev is an all-in-one devops platform. In OneDev before ve…9.8
• CVE-2021-21247OneDev is an all-in-one devops platform. In OneDev before ve…8.8
• CVE-2021-21248OneDev is an all-in-one devops platform. In OneDev before ve…8.8
• CVE-2021-21249OneDev is an all-in-one devops platform. In OneDev before ve…8.8
• CVE-2021-2125Vulnerability in the Oracle VM VirtualBox product of Oracle …4.6
• CVE-2021-21250OneDev is an all-in-one devops platform. In OneDev before ve…6.5
• CVE-2021-21251OneDev is an all-in-one devops platform. In OneDev before ve…8.8