CVE-2022-36110
HighSummary
Netmaker prior to version 0.15.1 had an improper authorization issue that allowed non-privileged users to execute privileged API calls. Users added to the Netmaker platform without admin privileges could use their auth tokens to run admin-level functions via the API.
Risk Assessment
The organization may be exposed to unauthorized access to administrative functions, potentially leading to serious security breaches and loss of control over the system.
Recommendation
It is recommended to upgrade to version 0.15.1 or later to mitigate this vulnerability and review user permissions on the Netmaker platform.
Other vulnerabilities in Netmaker
See all- CVE-2026-38651High
An authentication bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens, allowing an attacker to forge a JWT and impersonate any host in the network.
- CVE-2023-32079High
A mass assignment vulnerability was found in Netmaker, which creates networks with WireGuard, in versions prior to 0.17.1 and 0.18.6 that allows a non-admin user to escalate privileges to those of an admin user.
- CVE-2023-32078High
In Netmaker, which creates networks with WireGuard, an Insecure Direct Object Reference (IDOR) vulnerability was found in the user update function in versions prior to 0.17.1 and 0.18.6. It allows updating another user's password by specifying their username.
- CVE-2023-32077High
In Netmaker, prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage was found, allowing unauth users to interact with DNS API endpoints. The issue is patched in versions 0.17.1 and 0.18.6.
- CVE-2026-81034Medium
Netmaker disables certificate verification on the connection to the configured mail server. The skip-verify field is set to true unconditionally, allowing the client to accept any certificate, including one from an interposing party. Mail sent by Netmaker includes password-reset messages with single-use tokens and user invitations with enrolment links, which can be intercepted.
Original NVD description (English source)
Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1.