CVE-2023-32696

CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker container and the `ckan` user had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev contain a patch.

• CWE-269
• CWE-269

• https://github.com/ckan/ckan-docker-base/commit/5483c46ce9b518a4e1b626ef7032cce2c1d75c7dPatch
• https://github.com/ckan/ckan-docker-base/security/advisories/GHSA-c74x-xfvr-x5wgVendor Advisory
• https://github.com/ckan/ckan-docker-base/commit/5483c46ce9b518a4e1b626ef7032cce2c1d75c7dPatch
• https://github.com/ckan/ckan-docker-base/security/advisories/GHSA-c74x-xfvr-x5wgVendor Advisory

Published

May 30, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-32690libspdm is a sample implementation that follows the DMTF SPD…7.5
• CVE-2023-32691gost (GO Simple Tunnel) is a simple tunnel written in golang…5.9
• CVE-2023-32692CodeIgniter is a PHP full-stack web framework. This vulnerab…9.8
• CVE-2023-32693Decidim is a participatory democracy framework, written in R…6.1
• CVE-2023-32694Saleor Core is a composable, headless commerce API. Saleor's…5.4
• CVE-2023-32695socket.io parser is a socket.io encoder and decoder written …7.5
• CVE-2023-32697SQLite JDBC is a library for accessing and creating SQLite d…9.8
• CVE-2023-32698nFPM is an alternative to fpm. The file permissions on the c…7.1
• CVE-2023-32699MeterSphere is an open source continuous testing platform. V…6.5
• CVE-2023-3270Exposure of Sensitive Information to an Unauthorized Actor i…7.5
• CVE-2023-32700LuaTeX before 1.17.0 allows execution of arbitrary shell com…7.8
• CVE-2023-32701Improper Input Validation in the Networking Stack of QNX SDP…7.1