CVE-2024-32466 Tolgee's API key scopes not checked when querying translation data
Attackers with valid API keys lacking translation.view scope can read translation data due to missing authorization checks.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-32466?
CVE-2024-32466 is a low-severity missing authorization vulnerability in tolgee-platform, published on 18 Apr 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Tolgee is an open-source localization platform. For the `/v2/projects/translations` and `/v2/projects/{projectId}/translations` endpoints, translation data was returned even when API key was missing `translation.view` scope. However, it was impossible to fetch the data when user was missing this scope. So this is only relevant for API keys generated by users permitted to `translation.view`. This vulnerability is fixed in v3.57.2
Weakness: CWE-862
Which versions are affected by CVE-2024-32466?
It affects 1 product.
Products include Tolgee Tolgee.
How do I fix CVE-2024-32466?
No fix has been published for CVE-2024-32466 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2024-32466 being exploited?
There is no known exploitation of CVE-2024-32466 in the wild and no public exploit code.
Other vulnerabilities in tolgee-platform
- CVE-2024-52297 Tolgee's configuration all configuration properties leaked in public configuration DTO
- CVE-2026-32251 Tolgee has an XXE Injection in Translation Import
- CVE-2023-38510 Tolgee Lacks Permission Check for API Key for some endpoints
- CVE-2024-32470 Tolgee' API keys created by server admin users bypass the permission check
- CVE-2023-41316 HTML Injection with email in Tolgee
Sources
Also known as GHSA-r95p-fqqv-fppc.