CVE-2024-39324

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions 2022.10.10, 2023.10.6, and 2024.4.2 contain a patch for the issue.

• CWE-863
• CWE-1220
• CWE-863

• https://github.com/aimeos/ai-admin-graphql/commit/4eabc2b973509ffa5924e7f88c8f87ee96e93b38Patch
• https://github.com/aimeos/ai-admin-graphql/commit/687059d7eb2e1d55a09ed72dad3814f35edad038Patch
• https://github.com/aimeos/ai-admin-graphql/commit/a839a5adf16fee4221d444b7d2f5140d8cabf0acPatch
• https://github.com/aimeos/ai-admin-graphql/commit/acbb044620f4ff8e8d78a775cd205ec47cf119b3Patch
• https://github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-jj68-cp4v-98qfVendor Advisory
• https://github.com/aimeos/ai-admin-graphql/commit/4eabc2b973509ffa5924e7f88c8f87ee96e93b38Patch
• https://github.com/aimeos/ai-admin-graphql/commit/687059d7eb2e1d55a09ed72dad3814f35edad038Patch
• https://github.com/aimeos/ai-admin-graphql/commit/a839a5adf16fee4221d444b7d2f5140d8cabf0acPatch
• https://github.com/aimeos/ai-admin-graphql/commit/acbb044620f4ff8e8d78a775cd205ec47cf119b3Patch
• https://github.com/aimeos/ai-admin-graphql/security/advisories/GHSA-jj68-cp4v-98qfVendor Advisory

Published

Jul 2, 2024

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-39319aimeos/ai-controller-frontend is the Aimeos frontend control…5.3
• CVE-2024-3932A vulnerability classified as problematic has been found in …3.1
• CVE-2024-39320Discourse is an open source discussion platform. Prior to 3.…6.1
• CVE-2024-39321Traefik is an HTTP reverse proxy and load balancer. Versions…7.5
• CVE-2024-39322aimeos/ai-admin-jsonadm is the Aimeos e-commerce JSON API fo…5.5
• CVE-2024-39323aimeos/ai-admin-graphql is the Aimeos GraphQL API admin inte…7.1
• CVE-2024-39325aimeos/ai-controller-frontend is the Aimeos frontend contro…5.3
• CVE-2024-39326SkillTree is a micro-learning gamification platform. Prior t…4.4
• CVE-2024-39327Incorrect Access Control vulnerability in Atos Eviden IDRA b…9.9
• CVE-2024-39328Insecure Permissions in Atos Eviden IDRA and IDCA before 2.7…6.8
• CVE-2024-39329An issue was discovered in Django 5.0 before 5.0.7 and 4.2 b…5.3
• CVE-2024-3933In Eclipse OpenJ9 release versions prior to 0.44.0 and after…7.3