CVE-2021-38616

Published: Sep 7, 2021Modified: Jun 17, 2026

8.8

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Exploitability: 2.8 / Impact: 5.9

Source: NVD

Description

In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/{user-guid}/ user edition endpoint could permit any logged-in user to increase their own permissions via a user_permissions array in a PATCH request. A guest user could modify other users' profiles and much more.

Affected (1)

Products: Eigentech: Natural Language Processing

1 product

Natural Language Processing

Configuration A

1 vulnerable

Vulnerable Software	Affected Versions
Eigentech Natural Language Processing	Version 3.10.1

References (7)

https://cds.thalesgroup.com/en/tcs-cert/CVE-2021-38616

Source: cve@mitre.org

https://eigentech.com/

Source: cve@mitre.org

Vendor Advisory

https://excellium-services.com/cert-xlm-advisory/

Source: cve@mitre.org

Third Party Advisory

https://excellium-services.com/cert-xlm-advisory/CVE-2021-38616

Source: cve@mitre.org

Third Party Advisory

https://eigentech.com/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://excellium-services.com/cert-xlm-advisory/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://excellium-services.com/cert-xlm-advisory/CVE-2021-38616

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.