{"cve":"CVE-2009-2737","nvd":{"published":"2009-08-11T10:30:00.670","modified":"2026-06-16T23:10:08.057","status":"Modified","description":"The EditCSVAction function in cgi/actions.py in Roundup 1.2 before 1.2.1, 1.4 through 1.4.6, and possibly other versions does not properly check permissions, which allows remote authenticated users with edit or create privileges for a class to modify arbitrary items within that class, as demonstrated by editing all queries, modifying settings, and adding roles to users.","cvss_v4":null,"cvss_v3":null,"cwes":["CWE-264"],"references":["http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=518768","http://issues.roundup-tracker.org/issue2550521","http://secunia.com/advisories/34192","http://www.debian.org/security/2009/dsa-1754","http://www.osvdb.org/56368"],"products":["toni_mueller:roundup"],"source":"nvd","synced_at":"2026-10-19T19:54:26.868835795+00:00"},"epss":{"cve":"CVE-2009-2737","score":0.02341,"percentile":0.83631,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-9rj9-5wcv-xgf2","url":"https://osv.dev/vulnerability/GHSA-9rj9-5wcv-xgf2","summary":"Roundup Improper Access Control","modified":"2026-07-06T08:11:13.325496086Z","packages":[{"ecosystem":"PyPI","name":"roundup","purl":"pkg:pypi/roundup","ranges":[">=1.2 <1.2.1"],"fixed":["1.2.1"]},{"ecosystem":"PyPI","name":"roundup","purl":"pkg:pypi/roundup","ranges":[">=1.4 <1.4.7"],"fixed":["1.4.7"]}]},{"id":"PYSEC-2026-744","url":"https://osv.dev/vulnerability/PYSEC-2026-744","summary":"Roundup Improper Access Control","modified":"2026-07-06T08:00:50.582207132Z","packages":[{"ecosystem":"PyPI","name":"roundup","purl":"pkg:pypi/roundup","ranges":[">=1.2 <1.2.1",">=1.4 <1.4.7"],"fixed":["1.2.1","1.4.7"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}