CVE-2023-50976 Missing authorization in n/a

Critical 9.8 Published 17 Dec 2023 Updated 20 May 2025

Attackers can bypass authorization checks in the Transactions API to read or modify data without proper permissions.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2023-50976?

CVE-2023-50976 is a critical missing authorization vulnerability in n/a, published on 17 Dec 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Redpanda before 23.1.21 and 23.2.x before 23.2.18 has missing authorization checks in the Transactions API.

Weakness: CWE-862

Which versions are affected by CVE-2023-50976?

It affects 1 product.

Products include Redpanda Redpanda.

How do I fix CVE-2023-50976?

No fix has been published for CVE-2023-50976 yet. Limit exposure of the affected software until one is available.

Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.

Is CVE-2023-50976 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-50976 exists.

Sources

Also known as GHSA-v5cv-j9qw-9f6c.