Most recent entries from all

fkie_cve-2010-5142

2026-10-29T21:25:26.495109+00:00

chef-server-api/app/controllers/users.rb in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.

GHSA-f68m-q26r-64f6 — Chef Improper Access Control vulnerability

2026-10-29T21:25:26.495293+00:00

Affected: RubyGems: chef

`chef-server-api/app/controllers/users.rb` in the API in Chef before 0.9.0 does not require administrative privileges for the create, destroy, and update methods, which allows remote authenticated users to manage user accounts via requests to the /users URI.

gsd-2010-5142

2026-10-29T21:25:26.495342+00:00

gsd-2010-5142