CVE-2023-31469 Apache StreamPipes: Privilege escalation through non-admin user

What is CVE-2023-31469?

CVE-2023-31469 is a high-severity vulnerability in Apache StreamPipes, published on 23 Jun 2023. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

A REST interface in Apache StreamPipes (versions 0.69.0 to 0.91.0) was not properly restricted to admin-only access. This allowed a non-admin user with valid login credentials to elevate privileges beyond the initially assigned roles. The issue is resolved by upgrading to StreamPipes 0.92.0.

Weakness: CWE-269

Which versions are affected by CVE-2023-31469?

2 open source packages ship an affected version, including org.apache.streampipes:streampipes-parent. It affects 1 product.

Products include Apache Streampipes.

How do I fix CVE-2023-31469?

Upgrade org.apache.streampipes:streampipes-parent to 0.92.0 or later.

Is CVE-2023-31469 being exploited?

There is no known exploitation of CVE-2023-31469 in the wild and no public exploit code.

Other vulnerabilities in Apache StreamPipes

• CVE-2024-29868 Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation Critical 9.1
• CVE-2025-47411 Apache StreamPipes: Leverage of User ID for Privilege Escalation High 8.1
• CVE-2024-31979 Apache StreamPipes: Possibility of SSRF in pipeline element installation process High 7.5
• CVE-2024-24778 Apache StreamPipes: Resources Permission Escalation Medium 6.5
• CVE-2024-31411 Apache StreamPipes: Potential remote code execution (RCE) via file upload Medium 6.0

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-pm73-x2h5-cmj3.