CVE-2023-32078
HighSummary
In Netmaker, which creates networks with WireGuard, an Insecure Direct Object Reference (IDOR) vulnerability was found in the user update function in versions prior to 0.17.1 and 0.18.6. It allows updating another user's password by specifying their username.
Risk Assessment
This vulnerability may lead to unauthorized access to user accounts, posing a serious threat to data security within the organization.
Recommendation
It is recommended to upgrade to version 0.17.1 or 0.18.6 and later to mitigate this vulnerability. Users should execute the commands `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d` to switch to the patched version.
Other vulnerabilities in Netmaker
See all- CVE-2026-38651High
An authentication bypass vulnerability exists in Netmaker versions prior to 1.5.0. The VerifyHostToken function in logic/jwts.go fails to validate the JWT signature when verifying host tokens, allowing an attacker to forge a JWT and impersonate any host in the network.
- CVE-2023-32079High
A mass assignment vulnerability was found in Netmaker, which creates networks with WireGuard, in versions prior to 0.17.1 and 0.18.6 that allows a non-admin user to escalate privileges to those of an admin user.
- CVE-2023-32077High
In Netmaker, prior to versions 0.17.1 and 0.18.6, hardcoded DNS key usage was found, allowing unauth users to interact with DNS API endpoints. The issue is patched in versions 0.17.1 and 0.18.6.
- CVE-2022-36110High
Netmaker prior to version 0.15.1 had an improper authorization issue that allowed non-privileged users to execute privileged API calls. Users added to the Netmaker platform without admin privileges could use their auth tokens to run admin-level functions via the API.
- CVE-2026-81034Medium
Netmaker disables certificate verification on the connection to the configured mail server. The skip-verify field is set to true unconditionally, allowing the client to accept any certificate, including one from an interposing party. Mail sent by Netmaker includes password-reset messages with single-use tokens and user invitations with enrolment links, which can be intercepted.
Original NVD description (English source)
Netmaker makes networks with WireGuard. An Insecure Direct Object Reference (IDOR) vulnerability was found in versions prior to 0.17.1 and 0.18.6 in the user update function. By specifying another user's username, it was possible to update the other user's password. The issue is patched in 0.17.1 and fixed in 0.18.6. If Users are using 0.17.1, they should run `docker pull gravitl/netmaker:v0.17.1` and `docker-compose up -d`. This will switch them to the patched users. If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later. As a workaround, someone using version 0.17.1 can pull the latest docker image of the backend and restart the server.