CVE-2024-23637mediumCWE-287CWE-620

CVE-2024-23637: medium-severity vulnerability in OctoPrint

OctoPrint Unverified Password Change via Access Control Settings

Published · Updated

Follow this CVE+ Monitor OctoPrint+ Monitor octoprint

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 4.2epss 0.5%
OctoPrint is a web interface for 3D printer.s OctoPrint versions up until and including 1.9.3 contain a vulnerability that allows malicious admins to change the password of other admin accounts, including their own, without having to repeat their password. An attacker who managed to hijack an admin account might use this to lock out actual admins from their OctoPrint instance. The vulnerability will be patched in version 1.10.0.
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:L/A:L
Affected products
OctoPrint · OctoPrint
Related CVEs — OctoPrint

In the same product, most dangerous first.

CVE-2025-58180HIGHOctoPrint is Vulnerable to RCE Attacks via Unsanitized Filename in File UploadEPSS 26.1%CVE-2024-32977HIGHOctoPrint Authentication Bypass via X-Forwarded-For Header when autologinLocal is enabledEPSS 0.9%CVE-2023-41047MEDIUMImproper Neutralization of Special Elements Used in a Template Engine in OctoPrintEPSS 0.6%CVE-2024-28237MEDIUMOctoPrint XSS via the "Snapshot Test" feature in Classic Webcam plugin settingsEPSS 0.4%CVE-2026-23892MEDIUMOctoPrint has Timing Side-Channel Vulnerability in API Key AuthenticationEPSS 0.4%CVE-2026-54134HIGHOctoPrint: File exfiltration possible via query parameters on upload endpointsEPSS 0.3%