CVE-2021-36758: Input Validation
1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be used to perform privilege escalation. Malicious users authorized to create Secrets Automation access tokens can create tokens that have access beyond what the user is authorized to access, but limited to the existing authorizations of the Secret Automation the token is created in.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2021-36758?
CVE-2021-36758 is considered a high severity vulnerability due to the potential for privilege escalation through unauthorized access tokens.
How do I fix CVE-2021-36758?
To fix CVE-2021-36758, update your 1Password Connect server to version 1.2 or later.
Who is affected by CVE-2021-36758?
CVE-2021-36758 affects users of the 1Password Connect server version prior to 1.2.
What are the consequences of CVE-2021-36758?
The consequences of CVE-2021-36758 include the potential for unauthorized users to create access tokens that allow privilege escalation.
Is there a workaround for CVE-2021-36758?
There is no specific workaround for CVE-2021-36758; the only resolution is to upgrade to a patched version.