Vulnerability-Lookup

PYSEC-2026-1808

Vulnerability from pysec - Published: 2026-07-07 14:34 - Updated: 2026-07-29 15:52

Details

A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the AutoAddObjPermsMixin (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.

Severity

6.7 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

8.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Impacted products

Name	purl
pulpcore	pkg:pypi/pulpcore

Aliases

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pulpcore",
        "purl": "pkg:pypi/pulpcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.56.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ],
      "versions": [
        "3.0.0",
        "3.0.0b1",
        "3.0.0b10",
        "3.0.0b11",
        "3.0.0b12",
        "3.0.0b13",
        "3.0.0b14",
        "3.0.0b15",
        "3.0.0b16",
        "3.0.0b17",
        "3.0.0b18",
        "3.0.0b19",
        "3.0.0b2",
        "3.0.0b20",
        "3.0.0b21",
        "3.0.0b22",
        "3.0.0b23",
        "3.0.0b3",
        "3.0.0b4",
        "3.0.0b5",
        "3.0.0b6",
        "3.0.0b7",
        "3.0.0b8",
        "3.0.0b9",
        "3.0.0rc1",
        "3.0.0rc2",
        "3.0.0rc3",
        "3.0.0rc4",
        "3.0.0rc5",
        "3.0.0rc6",
        "3.0.0rc7",
        "3.0.0rc8",
        "3.0.0rc9",
        "3.0.1",
        "3.1.0",
        "3.1.1",
        "3.10.0",
        "3.11.0",
        "3.11.0.post0",
        "3.11.1",
        "3.11.2",
        "3.12.0",
        "3.12.1",
        "3.12.2",
        "3.13.0",
        "3.14.0",
        "3.14.1",
        "3.14.10",
        "3.14.11",
        "3.14.12",
        "3.14.13",
        "3.14.14",
        "3.14.15",
        "3.14.16",
        "3.14.17",
        "3.14.18",
        "3.14.19",
        "3.14.2",
        "3.14.3",
        "3.14.4",
        "3.14.5",
        "3.14.6",
        "3.14.7",
        "3.14.8",
        "3.14.9",
        "3.15.0",
        "3.15.1",
        "3.15.2",
        "3.15.3",
        "3.15.4",
        "3.15.5",
        "3.15.6",
        "3.15.7",
        "3.15.8",
        "3.15.9",
        "3.16.0",
        "3.16.1",
        "3.16.10",
        "3.16.11",
        "3.16.12",
        "3.16.13",
        "3.16.14",
        "3.16.15",
        "3.16.16",
        "3.16.17",
        "3.16.18",
        "3.16.19",
        "3.16.2",
        "3.16.20",
        "3.16.21",
        "3.16.22",
        "3.16.23",
        "3.16.24",
        "3.16.3",
        "3.16.4",
        "3.16.5",
        "3.16.6",
        "3.16.7",
        "3.16.8",
        "3.16.9",
        "3.17.0",
        "3.17.1",
        "3.17.2",
        "3.17.3",
        "3.17.4",
        "3.17.5",
        "3.17.6",
        "3.17.7",
        "3.17.8",
        "3.18.0",
        "3.18.1",
        "3.18.10",
        "3.18.11",
        "3.18.12",
        "3.18.13",
        "3.18.14",
        "3.18.15",
        "3.18.16",
        "3.18.17",
        "3.18.18",
        "3.18.19",
        "3.18.2",
        "3.18.20",
        "3.18.21",
        "3.18.22",
        "3.18.23",
        "3.18.24",
        "3.18.25",
        "3.18.26",
        "3.18.27",
        "3.18.28",
        "3.18.29",
        "3.18.3",
        "3.18.30",
        "3.18.31",
        "3.18.32",
        "3.18.33",
        "3.18.34",
        "3.18.35",
        "3.18.4",
        "3.18.5",
        "3.18.6",
        "3.18.7",
        "3.18.8",
        "3.18.9",
        "3.19.0",
        "3.19.1",
        "3.2.0",
        "3.2.1",
        "3.20.0",
        "3.21.0",
        "3.21.1",
        "3.21.10",
        "3.21.11",
        "3.21.12",
        "3.21.13",
        "3.21.14",
        "3.21.15",
        "3.21.16",
        "3.21.17",
        "3.21.18",
        "3.21.19",
        "3.21.2",
        "3.21.20",
        "3.21.21",
        "3.21.22",
        "3.21.23",
        "3.21.24",
        "3.21.25",
        "3.21.26",
        "3.21.29",
        "3.21.3",
        "3.21.30",
        "3.21.31",
        "3.21.32",
        "3.21.33",
        "3.21.34",
        "3.21.35",
        "3.21.36",
        "3.21.4",
        "3.21.5",
        "3.21.6",
        "3.21.7",
        "3.21.8",
        "3.21.9",
        "3.22.0",
        "3.22.1",
        "3.22.10",
        "3.22.11",
        "3.22.12",
        "3.22.13",
        "3.22.14",
        "3.22.15",
        "3.22.16",
        "3.22.17",
        "3.22.18",
        "3.22.19",
        "3.22.2",
        "3.22.20",
        "3.22.21",
        "3.22.22",
        "3.22.24",
        "3.22.25",
        "3.22.26",
        "3.22.27",
        "3.22.28",
        "3.22.29",
        "3.22.3",
        "3.22.30",
        "3.22.31",
        "3.22.32",
        "3.22.33",
        "3.22.34",
        "3.22.35",
        "3.22.4",
        "3.22.5",
        "3.22.6",
        "3.22.7",
        "3.22.8",
        "3.22.9",
        "3.23.0",
        "3.23.1",
        "3.23.10",
        "3.23.11",
        "3.23.12",
        "3.23.13",
        "3.23.14",
        "3.23.15",
        "3.23.16",
        "3.23.17",
        "3.23.18",
        "3.23.19",
        "3.23.2",
        "3.23.20",
        "3.23.21",
        "3.23.22",
        "3.23.23",
        "3.23.24",
        "3.23.3",
        "3.23.4",
        "3.23.5",
        "3.23.6",
        "3.23.7",
        "3.23.8",
        "3.23.9",
        "3.24.0",
        "3.24.1",
        "3.25.0",
        "3.25.1",
        "3.26.0",
        "3.26.1",
        "3.26.2",
        "3.27.0",
        "3.27.1",
        "3.27.2",
        "3.28.0",
        "3.28.1",
        "3.28.10",
        "3.28.11",
        "3.28.12",
        "3.28.13",
        "3.28.14",
        "3.28.15",
        "3.28.16",
        "3.28.17",
        "3.28.18",
        "3.28.19",
        "3.28.2",
        "3.28.20",
        "3.28.21",
        "3.28.22",
        "3.28.23",
        "3.28.24",
        "3.28.25",
        "3.28.26",
        "3.28.27",
        "3.28.28",
        "3.28.29",
        "3.28.3",
        "3.28.30",
        "3.28.31",
        "3.28.32",
        "3.28.33",
        "3.28.34",
        "3.28.35",
        "3.28.36",
        "3.28.37",
        "3.28.38",
        "3.28.39",
        "3.28.4",
        "3.28.40",
        "3.28.41",
        "3.28.42",
        "3.28.43",
        "3.28.44",
        "3.28.5",
        "3.28.6",
        "3.28.7",
        "3.28.8",
        "3.28.9",
        "3.29.0",
        "3.29.1",
        "3.29.2",
        "3.29.3",
        "3.29.4",
        "3.29.5",
        "3.29.6",
        "3.29.7",
        "3.29.8",
        "3.3.0",
        "3.3.1",
        "3.30.0",
        "3.31.0",
        "3.32.0",
        "3.32.1",
        "3.33.0",
        "3.34.0",
        "3.35.0",
        "3.36.0",
        "3.37.0",
        "3.38.0",
        "3.38.1",
        "3.39.0",
        "3.39.1",
        "3.39.10",
        "3.39.11",
        "3.39.12",
        "3.39.13",
        "3.39.14",
        "3.39.15",
        "3.39.16",
        "3.39.17",
        "3.39.18",
        "3.39.19",
        "3.39.2",
        "3.39.20",
        "3.39.21",
        "3.39.22",
        "3.39.23",
        "3.39.24",
        "3.39.25",
        "3.39.26",
        "3.39.27",
        "3.39.28",
        "3.39.29",
        "3.39.3",
        "3.39.30",
        "3.39.31",
        "3.39.32",
        "3.39.33",
        "3.39.34",
        "3.39.35",
        "3.39.4",
        "3.39.5",
        "3.39.6",
        "3.39.7",
        "3.39.8",
        "3.39.9",
        "3.4.0",
        "3.4.1",
        "3.40.0",
        "3.40.1",
        "3.40.2",
        "3.40.3",
        "3.40.4",
        "3.41.0",
        "3.41.1",
        "3.42.0",
        "3.43.0",
        "3.43.1",
        "3.43.2",
        "3.43.3",
        "3.44.0",
        "3.44.1",
        "3.45.0",
        "3.45.1",
        "3.45.2",
        "3.45.3",
        "3.45.4",
        "3.46.0",
        "3.47.0",
        "3.48.0",
        "3.49.0",
        "3.49.1",
        "3.49.10",
        "3.49.11",
        "3.49.12",
        "3.49.13",
        "3.49.14",
        "3.49.15",
        "3.49.16",
        "3.49.17",
        "3.49.18",
        "3.49.19",
        "3.49.2",
        "3.49.20",
        "3.49.21",
        "3.49.22",
        "3.49.23",
        "3.49.24",
        "3.49.25",
        "3.49.26",
        "3.49.27",
        "3.49.28",
        "3.49.29",
        "3.49.3",
        "3.49.30",
        "3.49.31",
        "3.49.32",
        "3.49.33",
        "3.49.34",
        "3.49.35",
        "3.49.36",
        "3.49.37",
        "3.49.38",
        "3.49.39",
        "3.49.4",
        "3.49.40",
        "3.49.41",
        "3.49.42",
        "3.49.43",
        "3.49.44",
        "3.49.45",
        "3.49.46",
        "3.49.47",
        "3.49.48",
        "3.49.49",
        "3.49.5",
        "3.49.50",
        "3.49.51",
        "3.49.52",
        "3.49.53",
        "3.49.54",
        "3.49.55",
        "3.49.56",
        "3.49.57",
        "3.49.58",
        "3.49.59",
        "3.49.6",
        "3.49.60",
        "3.49.61",
        "3.49.62",
        "3.49.63",
        "3.49.7",
        "3.49.8",
        "3.49.9",
        "3.5.0",
        "3.50.0",
        "3.50.1",
        "3.50.2",
        "3.50.3",
        "3.51.0",
        "3.51.1",
        "3.51.2",
        "3.51.3",
        "3.52.0",
        "3.53.0",
        "3.53.1",
        "3.54.0",
        "3.54.1",
        "3.55.0",
        "3.55.1",
        "3.55.2",
        "3.55.3",
        "3.56.0",
        "3.6.0",
        "3.6.1",
        "3.6.2",
        "3.6.3",
        "3.6.4",
        "3.6.5.post1",
        "3.6.5.post2",
        "3.7.0",
        "3.7.1",
        "3.7.2",
        "3.7.3",
        "3.7.4",
        "3.7.5",
        "3.7.5.post0",
        "3.7.6",
        "3.7.7",
        "3.7.8",
        "3.7.9",
        "3.8.0",
        "3.8.1",
        "3.9.0",
        "3.9.1",
        "3.49.64",
        "3.49.65",
        "3.49.66",
        "3.49.67",
        "3.49.68"
      ]
    }
  ],
  "aliases": [
    "CVE-2024-7143",
    "GHSA-9m5j-4xx9-44j9"
  ],
  "details": "A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn\u0027t dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.",
  "id": "PYSEC-2026-1808",
  "modified": "2026-07-29T15:52:54.328473Z",
  "published": "2026-07-07T14:34:38.535044Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7143"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:6765"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2024-7143"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2300125"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pulp/pulpcore"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pulp/pulpcore/blob/93f241f34c503da0fbac94bdba739feda2636e12/pulpcore/tasking/_util.py#L108"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pulp/pulpcore/blob/main/CHANGES.md"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/pulpcore"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-9m5j-4xx9-44j9"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Pulp incorrectly assigns RBAC permissions in tasks that create objects"
}

CVE-2024-7143 (GCVE-0-2024-7143)

Vulnerability from cvelistv5 – Published: 2024-08-07 16:49 – Updated: 2026-06-02 15:17

Title

Pulpcore: rbac permissions incorrectly assigned in tasks that create objects

Summary

A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn't dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.

Severity

6.7 (Medium)


                        
                          CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

SSVC

Exploitation: none Automatable: no Technical Impact: total

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-08-07 17:28 UTC

CWE

CWE-277 - Insecure Inherited Permissions

Assigner

redhat redhat root

References

6 references

URL	Tags
https://access.redhat.com/errata/RHSA-2024:6765	vendor-advisoryx_refsource_REDHAT
https://access.redhat.com/security/cve/CVE-2024-7143	vdb-entryx_refsource_REDHAT
https://bugzilla.redhat.com/show_bug.cgi?id=2300125	issue-trackingx_refsource_REDHAT
https://github.com/advisories/GHSA-9m5j-4xx9-44j9
https://github.com/pulp/pulpcore/blob/93f241f34c5…
https://github.com/pulp/pulpcore/blob/main/CHANGES.md

Impacted products

4 products

Vendor	Product	Version
		Affected: 0 , ≤ 3.56.0 (semver)
Red Hat	Red Hat Ansible Automation Platform 2	cpe:/a:redhat:ansible_automation_platform:2
Red Hat	Red Hat Satellite 6	cpe:/a:redhat:satellite:6
Red Hat	Red Hat Update Infrastructure 4 for Cloud Providers	cpe:/a:redhat:rhui:4::el8

Date Public

2024-08-07 13:50

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-7143",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-08-07T17:28:33.839214Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-08-07T17:28:52.787Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-09-10T22:53:16.986Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "https://github.com/pulp/pulpcore/blob/main/CHANGES.md"
          }
        ],
        "title": "CVE Program Container",
        "x_generator": {
          "engine": "ADPogram 0.0.1"
        }
      }
    ],
    "cna": {
      "affected": [
        {
          "collectionURL": "https://github.com/pulp/pulpcore",
          "defaultStatus": "unaffected",
          "packageName": "pulp",
          "versions": [
            {
              "lessThanOrEqual": "3.56.0",
              "status": "affected",
              "version": "0",
              "versionType": "semver"
            }
          ]
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "affected",
          "packageName": "python3x-pulpcore",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:ansible_automation_platform:2"
          ],
          "defaultStatus": "affected",
          "packageName": "python-pulpcore",
          "product": "Red Hat Ansible Automation Platform 2",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:satellite:6"
          ],
          "defaultStatus": "unaffected",
          "packageName": "python-pulpcore",
          "product": "Red Hat Satellite 6",
          "vendor": "Red Hat"
        },
        {
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "cpes": [
            "cpe:/a:redhat:rhui:4::el8"
          ],
          "defaultStatus": "unaffected",
          "packageName": "python-pulpcore",
          "product": "Red Hat Update Infrastructure 4 for Cloud Providers",
          "vendor": "Red Hat"
        }
      ],
      "datePublic": "2024-08-07T13:50:03.893Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn\u0027t dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing."
        }
      ],
      "metrics": [
        {
          "other": {
            "content": {
              "namespace": "https://access.redhat.com/security/updates/classification/",
              "value": "Moderate"
            },
            "type": "Red Hat severity rating"
          }
        },
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "LOW",
            "baseScore": 6.7,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
            "version": "3.0"
          },
          "format": "CVSS"
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-277",
              "description": "Insecure Inherited Permissions",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-06-02T15:17:14.856Z",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "name": "RHSA-2024:6765",
          "tags": [
            "vendor-advisory",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/errata/RHSA-2024:6765"
        },
        {
          "tags": [
            "vdb-entry",
            "x_refsource_REDHAT"
          ],
          "url": "https://access.redhat.com/security/cve/CVE-2024-7143"
        },
        {
          "name": "RHBZ#2300125",
          "tags": [
            "issue-tracking",
            "x_refsource_REDHAT"
          ],
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2300125"
        },
        {
          "url": "https://github.com/advisories/GHSA-9m5j-4xx9-44j9"
        },
        {
          "url": "https://github.com/pulp/pulpcore/blob/93f241f34c503da0fbac94bdba739feda2636e12/pulpcore/tasking/_util.py#L108"
        }
      ],
      "timeline": [
        {
          "lang": "en",
          "time": "2024-07-26T19:01:06.000Z",
          "value": "Reported to Red Hat."
        },
        {
          "lang": "en",
          "time": "2024-08-07T13:50:03.893Z",
          "value": "Made public."
        }
      ],
      "title": "Pulpcore: rbac permissions incorrectly assigned in tasks that create objects",
      "x_generator": {
        "engine": "cvelib 1.8.0"
      },
      "x_redhatCweChain": "CWE-277: Insecure Inherited Permissions"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2024-7143",
    "datePublished": "2024-08-07T16:49:29.842Z",
    "dateReserved": "2024-07-26T18:48:08.747Z",
    "dateUpdated": "2026-06-02T15:17:14.856Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

GHSA-9M5J-4XX9-44J9

Vulnerability from github – Published: 2024-08-07 18:30 – Updated: 2026-03-20 21:18

Summary

Pulp incorrectly assigns RBAC permissions in tasks that create objects

Details

Severity

6.7 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

8.6 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "PyPI",
        "name": "pulpcore"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "last_affected": "3.56.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-7143"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-277"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-08-07T19:45:30Z",
    "nvd_published_at": "2024-08-07T17:15:52Z",
    "severity": "HIGH"
  },
  "details": "A flaw was found in the Pulp package. When a role-based access control (RBAC) object in Pulp is set to assign permissions on its creation, it uses the `AutoAddObjPermsMixin` (typically the add_roles_for_object_creator method). This method finds the object creator by checking the current authenticated user. For objects that are created within a task, this current user is set by the first user with any permissions on the task object. This means the oldest user with model/domain-level task permissions will always be set as the current user of a task, even if they didn\u0027t dispatch the task. Therefore, all objects created in tasks will have their permissions assigned to this oldest user, and the creating user will receive nothing.",
  "id": "GHSA-9m5j-4xx9-44j9",
  "modified": "2026-03-20T21:18:09Z",
  "published": "2024-08-07T18:30:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-7143"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2024:6765"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/security/cve/CVE-2024-7143"
    },
    {
      "type": "WEB",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2300125"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/pulp/pulpcore"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pulp/pulpcore/blob/93f241f34c503da0fbac94bdba739feda2636e12/pulpcore/tasking/_util.py#L108"
    },
    {
      "type": "WEB",
      "url": "https://github.com/pulp/pulpcore/blob/main/CHANGES.md"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L",
      "type": "CVSS_V3"
    },
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Pulp incorrectly assigns RBAC permissions in tasks that create objects"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

PYSEC-2026-1808

CVE-2024-7143 (GCVE-0-2024-7143)

GHSA-9M5J-4XX9-44J9

Tags

Sightings

Nomenclature

Related by attack behaviour