CVE-2022-34621

Mealie 1.0.0beta3 was discovered to contain an Insecure Direct Object Reference (IDOR) vulnerability which allows attackers to modify user passwords and other attributes via modification of the user_id parameter.

• CWE-639

• https://cwe.mitre.org/data/definitions/639.htmlThird Party Advisory
• https://docs.mealie.io/changelog/v0.5.6/Release Notes, Third Party Advisory
• https://gainsec.com/2022/08/19/cve-2022-34615-cve-2022-34621-cve-2022-34623-cve-2022-34624/Third Party Advisory
• https://hub.docker.com/r/hkotel/mealieProduct, Third Party Advisory
• https://portswigger.net/web-security/access-control/idorThird Party Advisory
• https://cwe.mitre.org/data/definitions/639.htmlThird Party Advisory
• https://docs.mealie.io/changelog/v0.5.6/Release Notes, Third Party Advisory
• https://gainsec.com/2022/08/19/cve-2022-34615-cve-2022-34621-cve-2022-34623-cve-2022-34624/Third Party Advisory
• https://hub.docker.com/r/hkotel/mealieProduct, Third Party Advisory
• https://portswigger.net/web-security/access-control/idorThird Party Advisory

Published

Aug 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-34612Rizin v0.4.0 and below was discovered to contain an integer …5.5
• CVE-2022-34613Mealie 1.0.0beta3 contains an arbitrary file upload vulnerab…9.8
• CVE-2022-34615Mealie 1.0.0beta3 employs weak password requirements which a…9.8
• CVE-2022-34618A stored cross-site scripting (XSS) vulnerability in Mealie …5.4
• CVE-2022-34619A stored cross-site scripting (XSS) vulnerability in Mealie …5.4
• CVE-2022-3462The Highlight Focus WordPress plugin through 1.1 does not sa…4.8
• CVE-2022-34623Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultID…
• CVE-2022-34624Mealie1.0.0beta3 does not terminate download tokens after a …5.9
• CVE-2022-34625Mealie1.0.0beta3 was discovered to contain a Server-Side Tem…7.2
• CVE-2022-3463The Contact Form Plugin WordPress plugin before 4.3.13 does …9.8
• CVE-2022-34632Rocket-Chip commit 4f8114374d8824dfdec03f576a8cd68bebce4e56 …9.1
• CVE-2022-34633CVA6 commit d315ddd0f1be27c1b3f27eb0b8daf471a952299a execute…5.5