CVE-2021-42192

Konga v0.14.9 is affected by an incorrect access control vulnerability where a specially crafted request can lead to privilege escalation.

• CWE-863

• https://docs.google.com/document/d/1-YU9zWiDVUps3Mb6zos3996yvZ48vW_vfOvaJLLHc4I/edit?usp=sharingExploit, Third Party Advisory
• https://github.com/pantsel/konga/Product, Third Party Advisory
• https://github.com/pantsel/konga/commit/d61535277aced18b5be0313ab2d124f60f649978
• https://github.com/whokilleddb/Konga-Privilege-Escalation-ExploitExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/50521Exploit, Third Party Advisory, VDB Entry
• https://docs.google.com/document/d/1-YU9zWiDVUps3Mb6zos3996yvZ48vW_vfOvaJLLHc4I/edit?usp=sharingExploit, Third Party Advisory
• https://github.com/pantsel/konga/Product, Third Party Advisory
• https://github.com/pantsel/konga/commit/d61535277aced18b5be0313ab2d124f60f649978
• https://github.com/whokilleddb/Konga-Privilege-Escalation-ExploitExploit, Third Party Advisory
• https://www.exploit-db.com/exploits/50521Exploit, Third Party Advisory, VDB Entry

Published

May 4, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2021-42171Zenario CMS 9.0.54156 is vulnerable to File Upload. The web …7.2
• CVE-2021-4218A flaw was found in the Linux kernel’s implementation of rea…5.5
• CVE-2021-42183MasaCMS 7.2.1 is affected by a path traversal vulnerability …7.5
• CVE-2021-42185wdja v2.1 is affected by a SQL injection vulnerability in th…9.8
• CVE-2021-42186Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2021-4219A flaw was found in ImageMagick. The vulnerability occurs du…5.5
• CVE-2021-42193nopCommerce 4.40.3 is vulnerable to XSS in the Product Name …6.1
• CVE-2021-42194The wechat_return function in /controller/Index.php of EyouC…7.2
• CVE-2021-42195An issue was discovered in swftools through 20201222. A heap…7.8
• CVE-2021-42196An issue was discovered in swftools through 20201222. A NULL…5.5
• CVE-2021-42197An issue was discovered in swftools through 20201222 through…7.8
• CVE-2021-42198An issue was discovered in swftools through 20201222. A NULL…5.5