CVE-2023-32199

Published: Oct 29, 2025Modified: Jun 17, 2026Deferred

4.3

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L

Exploitability: 0.9 / Impact: 3.4

Source: meissner@suse.de (Secondary)

Description

A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or the corresponding binding, the user still retains access to clusters. This only affects custom Global Roles that have a * on * in * rule for resources or have a * on * rule for non-resource URLs

Related CWEs

CWE-281

Improper Preservation of Permissions

The product does not preserve permissions or incorrectly preserves permissions when copying, restoring, or sharing objects, which can cause them to have less restrictive permissions than intended.

References (2)

https://bugzilla.suse.com/show_bug.cgi?id=CVE-2023-32199

Source: meissner@suse.de

https://github.com/rancher/rancher/security/advisories/GHSA-j4vr-pcmw-hx59

Source: meissner@suse.de

Timeline

No history available yet.