CVE-2024-32470mediumCWE-863

CVE-2024-32470: medium-severity vulnerability in tolgee-platform

Tolgee' API keys created by server admin users bypass the permission check

Published · Updated

Follow this CVE+ Monitor tolgee-platform

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 6.5epss 0.6%
Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57.4.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Affected products
tolgee · tolgee-platform
Related CVEs — tolgee-platform

In the same product, most dangerous first.

CVE-2023-38510HIGHTolgee Lacks Permission Check for API Key for some endpointsEPSS 0.6%CVE-2024-52297CRITICALTolgee's configuration all configuration properties leaked in public configuration DTOEPSS 0.6%CVE-2023-41316MEDIUMHTML Injection with email in TolgeeEPSS 0.5%CVE-2026-32251CRITICALTolgee has an XXE Injection in Translation ImportEPSS 0.4%CVE-2024-32466LOWTolgee's API key scopes not checked when querying translation dataEPSS 0.4%