CVE-2022-36110highCWE-1220CWE-285

CVE-2022-36110: high-severity vulnerability in gravitl netmaker

Netmaker vulnerable to Insufficient Granularity of Access Control

Published · Updated

21Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 8.8epss 0.9%
exploitation probability
0.9%top 42% of all CVEs
observed exploitation
nono source reports it
In short

Netmaker allowed non-admin users to perform administrator-level actions through the API by using their authentication tokens. This means someone without admin permission could gain full control over the network configuration and other sensitive operations.

Technical detail

Netmaker prior to v0.15.1 suffers from improper authorization in API endpoints, allowing authenticated non-privileged users to execute administrator-level functions. The vulnerability stems from insufficient access control granularity (CWE-1220, CWE-285), where API authorization checks fail to properly verify user privileges before executing sensitive operations, resulting in privilege escalation.

Summary generated and translated by AI from the official description.
Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected products
gravitl · netmaker
Related CVEs — gravitl netmaker

In the same product, most dangerous first.

CVE-2023-32077HIGHNetmaker has Hardcoded DNS Secret KeyEPSS 3.5%CVE-2022-23650HIGHUse of Hard-coded Cryptographic Key in NetmakerEPSS 1.6%CVE-2023-32079HIGHNetmaker Privilige Escalation VulnerabilityEPSS 0.9%CVE-2023-32078HIGHNetmaker IDOR Vulnerability Allows User to Update Other User's PasswordEPSS 0.7%CVE-2026-29194HIGHNetmaker: Insufficient Authorization in Host Token VerificationEPSS 0.5%CVE-2026-29771HIGHNetmaker: Denial of Service via Server Shutdown EndpointEPSS 0.4%
References
https://github.com/gravitl/netmaker/releases/tag/v0.15.1https://github.com/gravitl/netmaker/security/advisories/GHSA-ggf6-638m-vqmg