CVE-2024-55072

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-55072
A Broken Object Level Authorization vulnerability in the component /api/users/{user-id} of hay-kot mealie v2.2.0 allows users to edit their own profile in order to give themselves more permissions or to change their household.
CVSS

No CVSS.

References
Link Resource
https://github.com/mealie-recipes/mealie/issues/4593 Issue Tracking
https://m10x.de/posts/2025/03/all-your-recipe-are-belong-to-us-part-3/3-broken-access-controls-leading-to-privilege-escalation-and-more-in-mealie/ Exploit
Configurations

Configuration 1 (hide)

cpe:2.3:a:mealie:mealie:2.2.0:*:*:*:*:*:*:*
History

30 Apr 2025, 16:42

Type Values Removed Values Added
References () https://github.com/mealie-recipes/mealie/issues/4593 - () https://github.com/mealie-recipes/mealie/issues/4593 - Issue Tracking
References () https://m10x.de/posts/2025/03/all-your-recipe-are-belong-to-us-part-3/3-broken-access-controls-leading-to-privilege-escalation-and-more-in-mealie/ - () https://m10x.de/posts/2025/03/all-your-recipe-are-belong-to-us-part-3/3-broken-access-controls-leading-to-privilege-escalation-and-more-in-mealie/ - Exploit
CPE cpe:2.3:a:mealie:mealie:2.2.0:*:*:*:*:*:*:*
First Time Mealie
Mealie mealie

27 Mar 2025, 19:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-27 19:15

Updated : 2025-04-30 16:42

NVD link : CVE-2024-55072

Mitre link : CVE-2024-55072

JSON object : View

Products Affected

mealie

  • mealie
CWE

No CWE.