CVE-2023-46125 Fides Information Disclosure Vulnerability in Config API Endpoint
Low-privileged users can access sensitive backend infrastructure details via the config API, exposing internal settings and database credentials.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-46125?
CVE-2023-46125 is a medium-severity vulnerability in ethyca fides, published on 24 Oct 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in a runtime environment, and the enforcement of privacy regulations in code. The Fides webserver API allows users to retrieve its configuration using the `GET api/v1/config` endpoint. The configuration data is filtered to suppress most sensitive configuration information before it is returned to the user, but even the filtered data contains information about the internals and the backend infrastructure, such as various settings, servers’ addresses and ports and database username. This information is useful for administrative users as well as attackers, thus it should not be revealed to low-privileged users. This vulnerability allows Admin UI users with roles lower than the owner role e.g. the viewer role to retrieve the config information using the API. The vulnerability has been patched in Fides version `2.22.1`.
Which versions are affected by CVE-2023-46125?
3 open source packages ship an affected version, including ethyca-fides. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
ethyca-fides PyPI | All versions | 2.22.1 |
ethyca-fides PyPI | All versions | 2.22.1 |
ethyca-fides PyPI | All versions | 2.22.1 |
Products include Ethyca Fides.
How do I fix CVE-2023-46125?
Upgrade ethyca-fides to 2.22.1 or later.
Is CVE-2023-46125 being exploited?
There is no known exploitation of CVE-2023-46125 in the wild and no public exploit code.
Other vulnerabilities in ethyca fides
- CVE-2024-45053 Remote Code Execution Vulnerability via SSTI in Fides Webserver Jinja Email Templating Engine
- CVE-2023-41319 Remote Code Execution in Custom Integration Upload in Fides
- CVE-2025-57817 Fides Webserver API is Vulnerable to OAuth Client Privilege Escalation
- CVE-2023-48224 Cryptographically Weak Generation of One-Time Codes for Identity Verification in ethyca-fides
- CVE-2023-46124 Server-Side Request Forgery Vulnerability in Custom Integration Upload
Sources
Also known as GHSA-rjxg-rpg3-9r89, PYSEC-2026-1347.