CVE-2023-32749

Name: CVE-2023-32749
Creator: NVD / NIST
Published: 2023-06-08T20:15:09.43+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

HIGHCVSS 8.8/10EPSS 14.20%

Last modified Jun 17, 2026

CVE-2023-32749 is a high-severity vulnerability rated 8.8/10 on the CVSS scale. Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. EPSS estimates a 14.20% chance of exploitation in the next 30 days.

Description

Pydio Cells allows users by default to create so-called external users in order to share files with them. By modifying the HTTP request sent when creating such an external user, it is possible to assign the new user arbitrary roles. By assigning all roles to a newly created user, access to all cells and non-personal workspaces is granted.

Metrics

CVSS 3.1

8.8/10

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

14.20%

96.1th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Pydio	Cells	< 3.0.12
Pydio	Cells	>= 4.1.0, < 4.1.3

References

http://packetstormsecurity.com/files/172645/Pydio-Cells-4.1.2-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/May/18Exploit, Mailing List, Third Party Advisory
https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analysesThird Party Advisory
https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-003/-pydio-cells-unauthorised-role-assignmentsExploit, Third Party Advisory
http://packetstormsecurity.com/files/172645/Pydio-Cells-4.1.2-Privilege-Escalation.htmlExploit, Third Party Advisory, VDB Entry
http://seclists.org/fulldisclosure/2023/May/18Exploit, Mailing List, Third Party Advisory
https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analysesThird Party Advisory
https://www.redteam-pentesting.de/en/advisories/rt-sa-2023-003/-pydio-cells-unauthorised-role-assignmentsExploit, Third Party Advisory

Timeline

Published: Jun 8, 2023
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2023-32749?

How severe is CVE-2023-32749?

CVE-2023-32749 has a CVSS score of 8.8/10 (HIGH severity). The EPSS model estimates a 14.20% probability of exploitation in the next 30 days.

How do I fix CVE-2023-32749?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2023-32749?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST