CVE-2020-12478 TeamPass files are available without authentication

What is CVE-2020-12478?

CVE-2020-12478 is a high-severity missing authorization vulnerability in Teampass Teampass, published on 29 Apr 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

TeamPass 2.1.27.36 allows an unauthenticated attacker to retrieve files from the TeamPass web root. This may include backups or LDAP debug files.

Weakness: CWE-306

Which versions are affected by CVE-2020-12478?

2 open source packages ship an affected version, including nilsteampassnet/teampass. It affects 1 product.

Products include Teampass Teampass.

How do I fix CVE-2020-12478?

No fix has been published for CVE-2020-12478 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2020-12478 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-12478 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Teampass Teampass

• CVE-2019-1000001 TeamPass Storing Passwords in a Recoverable Format vulnerability Critical 9.8
• CVE-2017-9436 TeamPass SQL injection in users.queries.php Critical 9.8
• CVE-2015-7564 TeamPass vulnerable to SQL Injection Critical 9.8
• CVE-2026-3106 Multiple vulnerabilities in Teampass Critical 9.3
• CVE-2026-3107 Multiple vulnerabilities in Teampass Critical 9.3

All Teampass Teampass vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-83h6-22cp-f22w.