CVE-2023-46125

Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows users to retrieve its configuration using the `GET api/v1/config` endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the internals and the backend infrastructure, such as various settings, servers’ addresses and ports and database username. This information is useful for administrative users as well as attackers, thus it should not be revealed to low-privileged users. This vulnerability allows Admin UI users with roles lower than the owner role e.g. the viewer role to retrieve the config information using the API. The vulnerability has been patched in Fides version `2.22.1`.

• CWE-200
• CWE-863

• https://github.com/ethyca/fides/commit/c9f3a620a4b4c1916e0941cb5624dcd636f06d06Patch
• https://github.com/ethyca/fides/releases/tag/2.22.1Release Notes
• https://github.com/ethyca/fides/security/advisories/GHSA-rjxg-rpg3-9r89Third Party Advisory
• https://github.com/ethyca/fides/commit/c9f3a620a4b4c1916e0941cb5624dcd636f06d06Patch
• https://github.com/ethyca/fides/releases/tag/2.22.1Release Notes
• https://github.com/ethyca/fides/security/advisories/GHSA-rjxg-rpg3-9r89Third Party Advisory

Published

Oct 25, 2023

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-4612Improper Authentication vulnerability in Apereo CAS in jakar…9.8
• CVE-2023-46120The RabbitMQ Java client library allows Java and JVM-based a…7.5
• CVE-2023-46121yt-dlp is a youtube-dl fork with additional features and fix…3.7
• CVE-2023-46122sbt is a build tool for Scala, Java, and others. Given a spe…7.1
• CVE-2023-46123jumpserver is an open source bastion machine, professional o…5.3
• CVE-2023-46124Fides is an open-source privacy engineering platform for man…7.2
• CVE-2023-46126Fides is an open-source privacy engineering platform for man…5.4
• CVE-2023-46127Frappe is a full-stack web application framework that uses P…5.4
• CVE-2023-46128Nautobot is a Network Automation Platform built as a web app…6.5
• CVE-2023-46129NATS.io is a high performance open source pub-sub distribute…7.5
• CVE-2023-4613This vulnerability allows remote attackers to execute arbitr…9.8
• CVE-2023-46130Discourse is an open source platform for community discussio…5.4