CVE-2023-33189

CriticalCVSS 10.0

Published: 30/05/2023(UTC)Updated: 17/06/2026(UTC)Translated: 18/06/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Elevated risk

0.92%

56th percentile - higher than 56% of all known CVEs

Summary

Pomerium, as an identity and context-aware access proxy, may make incorrect authorization decisions due to specially crafted requests. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4, and 0.22.2.

Risk Assessment

Incorrect authorization decisions may lead to unauthorized access to resources, posing a significant security risk to the organization.

Recommendation

It is recommended to update Pomerium to the latest version to mitigate this vulnerability.

Original NVD description (English source)

Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization decisions may be made by Pomerium. This issue has been patched in versions 0.17.4, 0.18.1, 0.19.2, 0.20.1, 0.21.4 and 0.22.2.