CyberRota Analysis
AI-GeneratedAn authentication bypass vulnerability in lakeFS versions up to 1.83.0 allows unauthenticated attackers to exploit the /setup_comm_prefs endpoint, enabling them to overwrite operator metadata such as email, name, and company. This could lead to unauthorized modifications of security preferences and the potential manipulation of telemetry data. Organizations using affected versions should prioritize remediation to prevent unauthorized access and ensure the integrity of their operational metadata.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
lakeFS through 1.83.0, fixed in commit 71a45ee, contains an authentication bypass vulnerability in the /setup_comm_prefs endpoint that allows unauthenticated attackers to overwrite operator metadata including email, name, and company after setup completion. Attackers can POST to this endpoint to modify security update preferences, disable security communications, and trigger falsified telemetry events using the legitimate installation ID.
Related CVEs
Other vulnerabilities affecting the same vendor(s)