CVE-2021-41230

Pomerium is an open source identity-aware access proxy. In affected versions changes to the OIDC claims of a user after initial login are not reflected in policy evaluation when using `allowed_idp_claims` as part of policy. If using `allowed_idp_claims` and a user's claims are changed, Pomerium can make incorrect authorization decisions. This issue has been resolved in v0.15.6. For users unable to upgrade clear data on `databroker` service by clearing redis or restarting the in-memory databroker to force claims to be updated.

• CWE-863

• https://github.com/pomerium/pomerium/pull/2724Patch, Third Party Advisory
• https://github.com/pomerium/pomerium/security/advisories/GHSA-j6wp-3859-vxfgThird Party Advisory
• https://github.com/pomerium/pomerium/pull/2724Patch, Third Party Advisory
• https://github.com/pomerium/pomerium/security/advisories/GHSA-j6wp-3859-vxfgThird Party Advisory

Published

Nov 5, 2021

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-41225TensorFlow is an open source platform for machine learning. …7.8
• CVE-2021-41226TensorFlow is an open source platform for machine learning. …7.1
• CVE-2021-41227TensorFlow is an open source platform for machine learning. …5.5
• CVE-2021-41228TensorFlow is an open source platform for machine learning. …7.8
• CVE-2021-41229BlueZ is a Bluetooth protocol stack for Linux. In affected v…6.5
• CVE-2021-4123livehelperchat is vulnerable to Cross-Site Request Forgery (…6.5
• CVE-2021-41231OpenMage LTS is an e-commerce platform. Prior to versions 19…7.2
• CVE-2021-41232Thunderdome is an open source agile planning poker tool in t…9.8
• CVE-2021-41233Nextcloud text is a collaborative document editing using Mar…5.3
• CVE-2021-41236OroPlatform is a PHP Business Application Platform. In affec…4.8
• CVE-2021-41238Hangfire is an open source system to perform background job …7.5
• CVE-2021-41239Nextcloud server is a self hosted system designed to provide…5.3