{"cve":"CVE-2024-53916","nvd":{"published":"2024-11-25T00:15:04.423","modified":"2026-06-17T08:09:29.897","status":"Deferred","description":"In OpenStack Neutron before 25.0.1, neutron/extensions/tagging.py can use an incorrect ID during policy enforcement. It does not apply the proper policy check for changing network tags. An unprivileged tenant is able to change (add and clear) tags on network objects that do not belong to the tenant, and this action is not subjected to the proper policy authorization check. This affects 23 before 23.2.1, 24 before 24.0.2, and 25 before 25.0.1.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","score":7.5},"cwes":["CWE-754"],"references":["https://github.com/openstack/neutron/blob/363ffa6e9e1ab5968f87d45bc2f1cb6394f48b9f/neutron/extensions/tagging.py#L138-L232","https://review.opendev.org/c/openstack/neutron/+/935883","https://review.opendev.org/q/project:openstack/neutron","https://security.openstack.org/ossa/OSSA-2024-005.html","http://www.openwall.com/lists/oss-security/2024/12/03/1"],"products":[],"source":"nvd","synced_at":"2026-10-19T21:57:34.731061660+00:00"},"epss":{"cve":"CVE-2024-53916","score":0.00714,"percentile":0.53706,"date":"2026-11-01"},"kev":null,"osv":[{"id":"GHSA-f27h-g923-68hw","url":"https://osv.dev/vulnerability/GHSA-f27h-g923-68hw","summary":"OpenStack Neutron can use an incorrect ID during policy enforcement","modified":"2026-07-07T17:56:56.404866102Z","packages":[{"ecosystem":"PyPI","name":"neutron","purl":"pkg:pypi/neutron","ranges":[">=23.0.0 <23.2.1"],"fixed":["23.2.1"]},{"ecosystem":"PyPI","name":"neutron","purl":"pkg:pypi/neutron","ranges":[">=24.0.0 <24.0.2"],"fixed":["24.0.2"]},{"ecosystem":"PyPI","name":"neutron","purl":"pkg:pypi/neutron","ranges":[">=25.0.0 <25.0.1"],"fixed":["25.0.1"]}]},{"id":"PYSEC-2026-1693","url":"https://osv.dev/vulnerability/PYSEC-2026-1693","summary":"OpenStack Neutron can use an incorrect ID during policy enforcement","modified":"2026-07-07T17:47:07.174068631Z","packages":[{"ecosystem":"PyPI","name":"neutron","purl":"pkg:pypi/neutron","ranges":[">=23.0.0 <23.2.1",">=24.0.0 <24.0.2",">=25.0.0 <25.0.1"],"fixed":["23.2.1","24.0.2","25.0.1"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}