CVE-2024-32470

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-32470
Tolgee is an open-source localization platform. When API key created by admin user is used it bypasses the permission check at all. This error was introduced in v3.57.2 and immediately fixed in v3.57.4.

6.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.2 / Impact : 5.2

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://github.com/tolgee/tolgee-platform/commit/a0d861028d931f8a54387770eaf3a75031b81234 Patch
https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-pm57-hcm8-38gw Vendor Advisory
https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-r95p-fqqv-fppc Not Applicable
https://github.com/tolgee/tolgee-platform/commit/a0d861028d931f8a54387770eaf3a75031b81234 Patch
https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-pm57-hcm8-38gw Vendor Advisory
https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-r95p-fqqv-fppc Not Applicable
Configurations

Configuration 1 (hide)

cpe:2.3:a:tolgee:tolgee:*:*:*:*:*:*:*:*
History

11 Sep 2025, 21:29

Type Values Removed Values Added
References () https://github.com/tolgee/tolgee-platform/commit/a0d861028d931f8a54387770eaf3a75031b81234 - () https://github.com/tolgee/tolgee-platform/commit/a0d861028d931f8a54387770eaf3a75031b81234 - Patch
References () https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-pm57-hcm8-38gw - () https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-pm57-hcm8-38gw - Vendor Advisory
References () https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-r95p-fqqv-fppc - () https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-r95p-fqqv-fppc - Not Applicable
First Time Tolgee
Tolgee tolgee
CPE cpe:2.3:a:tolgee:tolgee:*:*:*:*:*:*:*:*

21 Nov 2024, 09:14

Type Values Removed Values Added
References () https://github.com/tolgee/tolgee-platform/commit/a0d861028d931f8a54387770eaf3a75031b81234 - () https://github.com/tolgee/tolgee-platform/commit/a0d861028d931f8a54387770eaf3a75031b81234 -
References () https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-pm57-hcm8-38gw - () https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-pm57-hcm8-38gw -
References () https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-r95p-fqqv-fppc - () https://github.com/tolgee/tolgee-platform/security/advisories/GHSA-r95p-fqqv-fppc -
Summary
  • (es) Tolgee es una plataforma de localización de código abierto. Cuando se utiliza la clave API creada por el usuario administrador, se omite la verificación de permisos. Este error se introdujo en la versión 3.57.2 y se solucionó inmediatamente en la versión 3.57.4.

18 Apr 2024, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-04-18 15:15

Updated : 2025-09-11 21:29

NVD link : CVE-2024-32470

Mitre link : CVE-2024-32470

CVE.ORG link : CVE-2024-32470

JSON object : View

Products Affected

tolgee

  • tolgee
CWE
CWE-863

Incorrect Authorization