CVE-2021-31590

Name: CVE-2021-31590
Creator: NVD / NIST
Published: 2021-07-19T20:15:08.66+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 2.65%

Last modified Jun 17, 2026

CVE-2021-31590 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. EPSS estimates a 2.65% chance of exploitation in the next 30 days.

Description

PwnDoc all versions until 0.4.0 (2021-08-23) has incorrect JSON Webtoken handling, leading to incorrect access control. With a valid JSON Webtoken that is used for authentication and authorization, a user can keep his admin privileges even if he is downgraded to the "user" privilege. Even after a user's account is deleted, the user can still access the administration panel (and add or delete users) and has complete access to the system.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

2.65%

83.7th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Vendor	Product	Versions
Pwndoc Project	Pwndoc	< 0.4.0

References

https://github.com/pwndoc/pwndoc/blob/59519735b0d831d8fd96d7c3387f66d28407e583/CHANGELOG.md#040-2021-08-23Patch, Release Notes, Third Party Advisory
https://github.com/pwndoc/pwndoc/commit/15f3dc0e212eda465e05fda0feb002d1bce2939dPatch, Third Party Advisory
https://github.com/pwndoc/pwndoc/commit/ff1b868cec55f5b6c7a91e15a2b0b1f4324121abPatch, Third Party Advisory
https://github.com/pwndoc/pwndoc/pull/128Patch, Third Party Advisory
https://github.com/pwndoc/pwndoc/pull/74Patch, Third Party Advisory
https://github.com/pwndoc/pwndoc/security/advisoriesBroken Link
https://www.dgc.org/responsible_disclosure_pwndoc_jwtExploit, Third Party Advisory
https://github.com/pwndoc/pwndoc/blob/59519735b0d831d8fd96d7c3387f66d28407e583/CHANGELOG.md#040-2021-08-23Patch, Release Notes, Third Party Advisory
https://github.com/pwndoc/pwndoc/commit/15f3dc0e212eda465e05fda0feb002d1bce2939dPatch, Third Party Advisory
https://github.com/pwndoc/pwndoc/commit/ff1b868cec55f5b6c7a91e15a2b0b1f4324121abPatch, Third Party Advisory
https://github.com/pwndoc/pwndoc/pull/128Patch, Third Party Advisory
https://github.com/pwndoc/pwndoc/pull/74Patch, Third Party Advisory
https://github.com/pwndoc/pwndoc/security/advisoriesBroken Link
https://www.dgc.org/responsible_disclosure_pwndoc_jwtExploit, Third Party Advisory

Timeline

Published: Jul 19, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-31590?

How severe is CVE-2021-31590?

CVE-2021-31590 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 2.65% probability of exploitation in the next 30 days.

How do I fix CVE-2021-31590?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-31590?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST