CVE-2026-59164

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-management UI but fails to require administrator authorization. `auth_middleware()` protects `/ui/tokens` and `/api/ui/tokens`, but state-changing requests are checked only with `role.can_write()`, not `role.can_admin()`. `tokens_page()` and `tokens_list()` call `store.list_all_tokens()`, exposing IDs and metadata across all users, while `tokens_revoke()` calls `store.revoke_token` using the supplied token ID without an ownership or admin check. A read bearer token can enumerate other users' token existence, owner, role, description, expiry and last-use metadata. A write bearer token or write-capable OIDC identity can additionally revoke arbitrary admin and service tokens, disrupting the registry and forcing credential recovery. Read-only identities cannot POST a revocation. This issue is fixed in version 0.9.5.

• CWE-862

• https://github.com/getnora-io/nora/commit/dc9e943b208095ec1e8cc2cf7b5108fdb55cab9c
• https://github.com/getnora-io/nora/pull/747
• https://github.com/getnora-io/nora/releases/tag/v0.9.5
• https://github.com/getnora-io/nora/security/advisories/GHSA-78cx-cfhm-rgmx
• https://github.com/getnora-io/nora/security/advisories/GHSA-78cx-cfhm-rgmx

Published

Oct 28, 2026

Last Modified

Nov 4, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-59157webhookd is a minimalist webhook server that triggers shell …6.5
• CVE-2026-59158Nuxt Ollama integrates the official Ollama JavaScript librar…7.5
• CVE-2026-59160Yeger is a monorepo for npm packages maintained under the ye…8.8
• CVE-2026-59161Excelize is a Go language library for reading and writing Mi…7.5
• CVE-2026-59162Excelize is a Go language library for reading and writing Mi…7.5
• CVE-2026-59163Mnemosyne is a memory layer for artificial intelligence agen…9.1
• CVE-2026-59167SunEditor is a lightweight and powerful WYSIWYG editor in va…10
• CVE-2026-59168Dasel is a command-line tool and library for querying, modif…6.2
• CVE-2026-5917libgit2 versions before 1.8.7 and 1.9.0 before 1.9.7 built w…8.8
• CVE-2026-59171JSON-java is a reference implementation of a JSON package in…5.9
• CVE-2026-59172Joker is a small Clojure interpreter, linter and formatter w…7.8
• CVE-2026-59173Uncontrolled Resource Consumption vulnerability in Apache Tr…7.5