CVE-2023-51386

Sandbox Accounts for Events provides multiple, temporary AWS accounts to a number of authenticated users simultaneously via a browser-based GUI. Authenticated users could potentially read data from the events table by sending request payloads to the events API, collecting information on planned events, timeframes, budgets and owner email addresses. This data access may allow users to get insights into upcoming events and join events which they have not been invited to. This issue has been patched in version 1.10.0.

• CWE-269

• https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79Patch
• https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-p7w3-j66h-m7mxThird Party Advisory
• https://github.com/awslabs/sandbox-accounts-for-events/commit/f30a0662f0a28734eb33c5868cccc1c319eb6e79Patch
• https://github.com/awslabs/sandbox-accounts-for-events/security/advisories/GHSA-p7w3-j66h-m7mxThird Party Advisory

Published

Dec 22, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-51379An incorrect authorization vulnerability was identified in G…4.9
• CVE-2023-5138Glitch detection is not enabled by default for the CortexM33…6.8
• CVE-2023-51380An incorrect authorization vulnerability was identified in G…4.3
• CVE-2023-51381Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2023-51384In ssh-agent in OpenSSH before 9.6, certain destination cons…5.5
• CVE-2023-51385In ssh in OpenSSH before 9.6, OS command injection might occ…6.5
• CVE-2023-51387Hertzbeat is an open source, real-time monitoring system. He…8.8
• CVE-2023-51388Hertzbeat is a real-time monitoring system. In `CalculateAla…9.8
• CVE-2023-51389Hertzbeat is a real-time monitoring system. At the interface…9.8
• CVE-2023-5139Potential buffer overflow vulnerability at the following loc…7.8
• CVE-2023-51390journalpump is a daemon that takes log messages from journal…7.5
• CVE-2023-51391A bug in Micrium OS Network HTTP Server permits an invalid p…7.5