CVE-2022-28802

Code by Zapier before 2022-08-17 allowed intra-account privilege escalation that included execution of Python or JavaScript code. In other words, Code by Zapier was providing a customer-controlled general-purpose virtual machine that unintentionally granted full access to all users of a company's account, but was supposed to enforce role-based access control within that company's account. Before 2022-08-17, a customer could have resolved this by (in effect) using a separate virtual machine for an application that held credentials - or other secrets - that weren't supposed to be shared among all of its employees. (Multiple accounts would have been needed to operate these independent virtual machines.)

• CWE-732
• CWE-732

• https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/Mitigation, Vendor Advisory
• https://www.zenity.io/blog/zapescape-vulnerability-disclosure/Mitigation, Vendor Advisory
• https://www.zenity.io/blog/zapescape-organization-wide-control-over-code-by-zapier/Mitigation, Vendor Advisory
• https://www.zenity.io/blog/zapescape-vulnerability-disclosure/Mitigation, Vendor Advisory

Published

Sep 21, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-28793Given the TEE is compromised and controlled by the attacker,…4.4
• CVE-2022-28794Sensitive information exposure in low-battery dumpstate log …3.3
• CVE-2022-28795A vulnerability within the Avira Password Manager Browser Ex…6.5
• CVE-2022-28796jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Li…7
• CVE-2022-28799The TikTok application before 23.7.3 for Android allows acco…8.8
• CVE-2022-2880Requests forwarded by ReverseProxy include the raw query par…7.5
• CVE-2022-28803In SilverStripe Framework through 2022-04-07, Stored XSS can…5.4
• CVE-2022-28805singlevar in lparser.c in Lua from (including) 5.4.0 up to (…9.1
• CVE-2022-28806An issue was discovered on certain Fujitsu LIEFBOOK devices …7.8
• CVE-2022-28807An issue was discovered in Open Design Alliance Drawings SDK…7.8
• CVE-2022-28808An issue was discovered in Open Design Alliance Drawings SDK…7.8
• CVE-2022-28809An issue was discovered in Open Design Alliance Drawings SDK…7.8