CVE-2023-40020

PrivateUploader is an open source image hosting server written in Vue and TypeScript. In affected versions `app/routes/v3/admin.controller.ts` did not correctly verify whether the user was an administrator (High Level) or moderator (Low Level) causing the request to continue processing. The response would be a 403 with ADMIN_ONLY, however, next() would call leading to any updates/changes in the route to process. This issue has been addressed in version 3.2.49. Users are advised to upgrade. There are no known workarounds for this vulnerability.

• CWE-287

• https://github.com/PrivateUploader/PrivateUploader/commit/869657d61e3c7a518177106fe63ea483082b0d3ePatch
• https://github.com/PrivateUploader/PrivateUploader/security/advisories/GHSA-vhrw-2472-rrjxPatch, Vendor Advisory
• https://github.com/PrivateUploader/PrivateUploader/commit/869657d61e3c7a518177106fe63ea483082b0d3ePatch
• https://github.com/PrivateUploader/PrivateUploader/security/advisories/GHSA-vhrw-2472-rrjxPatch, Vendor Advisory

Published

Aug 14, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-40014OpenZeppelin Contracts is a library for secure smart contrac…5.3
• CVE-2023-40015Vyper is a Pythonic Smart Contract Language. For the followi…5.3
• CVE-2023-40017GeoNode is an open source platform that facilitates the crea…7.5
• CVE-2023-40018FreeSWITCH is a Software Defined Telecom Stack enabling the …7.5
• CVE-2023-40019FreeSWITCH is a Software Defined Telecom Stack enabling the …6.5
• CVE-2023-4002An issue has been discovered in GitLab EE affecting all vers…6.5
• CVE-2023-40021Oppia is an online learning platform. When comparing a recei…5.3
• CVE-2023-40022Rizin is a UNIX-like reverse engineering framework and comma…7.8
• CVE-2023-40023yaklang is a programming language designed for cybersecurity…7.5
• CVE-2023-40024ScanCode.io is a server to script and automate software comp…6.1
• CVE-2023-40025Argo CD is a declarative, GitOps continuous delivery tool fo…7.1
• CVE-2023-40026Argo CD is a declarative continuous deployment framework for…4.3