CVE-2024-46881

Develocity (formerly Gradle Enterprise) before 2024.1.8 has Incorrect Access Control. Project-level access control configuration was introduced in Enterprise Config schema version 8. Migration functionality from schema version 8 to versions 9 and 10 (in affected vulnerable versions) does not include the projects section of the configuration. This leads to all of the project settings being reset to their defaults when the old schema is loaded. In the case of projects.enabled, the default is false. Thus, using an enterprise config v8 results in Project level access control being disabled, even if it was previously enabled, and previously restricted project information disclosed. Most commonly, this occurs when a Develocity instance is upgraded from an earlier version. Specifically, this occurs if: Develocity 2023.3.X is upgraded to 2023.4.X; Develocity 2023.3.X is upgraded to 2024.1.X up to and including 2024.1.7; or Develocity 2023.4.X is upgraded to 2024.1.X up to and including 2024.1.7. The flaw does not occur when upgrading to a fixed version. An upgrade can only be triggered via administrator access, and cannot be forced by an external attacker.

• CWE-732

• https://security.gradle.com/advisory/2024-03

Published

Jan 26, 2025

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-46872Mattermost versions 9.10.x <= 9.10.2, 9.11.x <= 9.11.1, 9.5.…4.6
• CVE-2024-46873Multiple SHARP routers leave the hidden debug function enabl…9.8
• CVE-2024-46874Ruijie Reyee OS versions 2.206.x up to but not including 2.3…9.9
• CVE-2024-46878A Cross-Site Scripting (XSS) vulnerability exists in the pag…5.4
• CVE-2024-46879A Reflected Cross-Site Scripting (XSS) vulnerability exists …5.4
• CVE-2024-4688A vulnerability classified as problematic was found in Campc…6.1
• CVE-2024-46886The web server of affected devices does not properly validat…5.1
• CVE-2024-46887The web server of affected devices do not properly authentic…6.9
• CVE-2024-46888A vulnerability has been identified in SINEC INS (All versio…9.9
• CVE-2024-46889A vulnerability has been identified in SINEC INS (All versio…6.9
• CVE-2024-4689Cross-Site Request Forgery (CSRF) vulnerability in ShortPixe…4.3
• CVE-2024-46890A vulnerability has been identified in SINEC INS (All versio…9.4