cve.bz

CVE-2023-32199

4.3 mediumEPSS 0.2%

Medium (4.3). EPSS 0.2% chance of exploitation in the next 30 days. Fixed in github.com/rancher/rancher 0.0.0-20251014212116-7faa74a968c2.

A vulnerability has been identified within Rancher Manager, where after removing a custom GlobalRole that gives administrative access or the corresponding binding, the user still retains access to clusters. This only affects custom Global Roles that have a * on * in * rule for resources or have a * on * rule for non-resource URLs

Severity

CVSS 3.1

4.3 medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:L
EPSS
0.2% chance of exploitation in the next 30 days; higher than 12% of CVEs (scores of 2026-10-31)
CWE
CWE-281
Published
Modified
Record from
the NVD, synced

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-j4vr-pcmw-hx59Gogithub.com/rancher/rancher<0.0.0-20251014212116-7faa74a968c20.0.0-20251014212116-7faa74a968c2
GO-2025-4073Gogithub.com/rancher/rancher<0.0.0-20251014212116-7faa74a968c20.0.0-20251014212116-7faa74a968c2

References

Check your stackJSON