{"cve":"CVE-2021-32076","nvd":{"published":"2021-08-26T15:15:06.993","modified":"2026-06-17T03:52:45.650","status":"Modified","description":"Access Restriction Bypass via referrer spoof was discovered in SolarWinds Web Help Desk 12.7.2. An attacker can access the 'Web Help Desk Getting Started Wizard', especially the admin account creation page, from a non-privileged IP address network range or loopback address by intercepting the HTTP request and changing the referrer from the public IP address to the loopback.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","score":5.3},"cwes":["CWE-290"],"references":["https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076","https://exchange.xforce.ibmcloud.com/vulnerabilities/208278","https://www.solarwinds.com/trust-center/security-advisories/cve-2021-32076"],"products":["solarwinds:web_help_desk"],"source":"nvd","synced_at":"2026-10-19T21:21:57.125947417+00:00"},"epss":{"cve":"CVE-2021-32076","score":0.01172,"percentile":0.67454,"date":"2026-10-31"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}