CVE-2026-59164
NORA missing cross-user token-management authorization
Description
NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-management UI but fails to require administrator authorization. `auth_middleware()` protects `/ui/tokens` and `/api/ui/tokens`, but state-changing requests are checked only with `role.can_write()`, not `role.can_admin()`. `tokens_page()` and `tokens_list()` call `store.list_all_tokens()`, exposing IDs and metadata across all users, while `tokens_revoke()` calls `store.revoke_token` using the supplied token ID without an ownership or admin check. A read bearer token can enumerate other users' token existence, owner, role, description, expiry and last-use metadata. A write bearer token or write-capable OIDC identity can additionally revoke arbitrary admin and service tokens, disrupting the registry and forcing credential recovery. Read-only identities cannot POST a revocation. This issue is fixed in version 0.9.5.
INFO
Published Date :
Oct. 28, 2026, 2:17 p.m.
Last Modified :
Nov. 4, 2026, 11:10 p.m.
Remotely Exploit :
Yes !
Source :
[email protected]
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | MITRE-CVE | ||||
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update NORA to version 0.9.5 or later.
- Verify administrator authorization checks are enforced.
- Review token management access controls.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-59164.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-59164 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-59164
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-59164 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-59164 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Nov. 04, 2026
Action Type Old Value New Value Added Translation Title: NORA, Description: NORA es un registro de artefactos autoalojado y una caché de paso. Versiones anteriores a la 0.9.5, “nora-registry” autentica la interfaz de usuario de gestión de tokens, pero no exige la autorización de administrador. “auth_middleware()” protege “/ui/tokens” y “/api/ui/tokens”, pero las solicitudes que cambian el estado se verifican solo con “role.can_write()”, no con “role.can_admin()”. “tokens_page()” y “tokens_list()” llaman a “store.list_all_tokens()”, exponiendo IDs y metadatos de todos los usuarios, mientras que “tokens_revoke()” llama a “store.revoke_token” utilizando el ID de token proporcionado sin una verificación de propiedad o de administrador. Un token portador de lectura puede enumerar la existencia, el propietario, el rol, la descripción, la caducidad y los metadatos de último uso de los tokens de otros usuarios. Un token portador de escritura o una identidad OIDC con capacidad de escritura puede, además, revocar tokens de administrador y de servicio arbitrarios, interrumpiendo el registro y forzando la recuperación de credenciales. Las identidades de solo lectura no pueden realizar una solicitud POST de revocación. Este problema se solucionó en la versión 0.9.5. -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Oct. 29, 2026
Action Type Old Value New Value Added Reference https://github.com/getnora-io/nora/security/advisories/GHSA-78cx-cfhm-rgmx Added SSVC {'id': 'CVE-2026-59164', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'poc'}, {'automatable': 'no'}, {'technicalImpact': 'partial'}], 'version': '2.0.3', 'timestamp': '2026-10-29T18:32:25.903625Z'} -
New CVE Received by [email protected]
Oct. 28, 2026
Action Type Old Value New Value Added Description NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-management UI but fails to require administrator authorization. `auth_middleware()` protects `/ui/tokens` and `/api/ui/tokens`, but state-changing requests are checked only with `role.can_write()`, not `role.can_admin()`. `tokens_page()` and `tokens_list()` call `store.list_all_tokens()`, exposing IDs and metadata across all users, while `tokens_revoke()` calls `store.revoke_token` using the supplied token ID without an ownership or admin check. A read bearer token can enumerate other users' token existence, owner, role, description, expiry and last-use metadata. A write bearer token or write-capable OIDC identity can additionally revoke arbitrary admin and service tokens, disrupting the registry and forcing credential recovery. Read-only identities cannot POST a revocation. This issue is fixed in version 0.9.5. Added CVSS V3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N Added CWE CWE-862 Added Affected New affected value received. <a href="https://github.com/CVEProject/cvelistV5/blob/main/cves/2026/59xxx/CVE-2026-59164.json">CVE-2026-59164</a> Added Reference https://github.com/getnora-io/nora/commit/dc9e943b208095ec1e8cc2cf7b5108fdb55cab9c Added Reference https://github.com/getnora-io/nora/pull/747 Added Reference https://github.com/getnora-io/nora/releases/tag/v0.9.5 Added Reference https://github.com/getnora-io/nora/security/advisories/GHSA-78cx-cfhm-rgmx