How severe is CVE-2024-27916?

CVE-2024-27916 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability none.

Is CVE-2024-27916 being actively exploited?

It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (47th percentile), an estimate of the probability of exploitation in the next 30 days.

What products are affected by CVE-2024-27916?

CVE-2024-27916 affects Lfprojects Minder. See the affected-products list for the exact vulnerable versions.

How do I fix CVE-2024-27916?

Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.

Does CVE-2024-27916 have an EU (EUVD) identifier?

Yes. CVE-2024-27916 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-1009.

When was CVE-2024-27916 published?

CVE-2024-27916 was published on 2024-03-21 and last updated on 2026-06-17.

CVE-2024-27916

CVE-2024-27916 is a high-severity vulnerability in Lfprojects Minder with a CVSS 3.x base score of 7.1. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-285.

Key facts

Severity: High (CVSS 3.x base score 7.1)
EPSS exploit prediction: 1% (47th percentile)
Actively exploited: Not listed in CISA KEV
EU (EUVD) id: EUVD-2024-1009
Weakness: CWE-285
Affected product: Lfprojects Minder
Published: 2024-03-21
Last modified: 2026-06-17

Description

Minder is a software supply chain security platform. Prior to version 0.0.33, a Minder user can use the endpoints `GetRepositoryByName`, `DeleteRepositoryByName`, and `GetArtifactByName` to access any repository in the database, irrespective of who owns the repo and any permissions present. The database query checks by repo owner, repo name and provider name (which is always `github`). These query values are not distinct for the particular user - as long as the user has valid credentials and a provider, they can set the repo owner/name to any value they want and the server will return information on this repo. Version 0.0.33 contains a patch for this issue.

Frequently asked questions

What is CVE-2024-27916?: Minder is a software supply chain security platform. Prior to version 0.0.33, a Minder user can use the endpoints `GetRepositoryByName`, `DeleteRepositoryByName`, and `GetArtifactByName` to access any repository in the database, irrespective of who owns the repo and any permissions present. The database query checks by repo owner, repo name and provider name (which is always `github`). These query values are not distinct for the particular user - as long as the user has valid credentials and a provider, they can set the repo owner/name to any value they want and the server will return information on this repo. Version 0.0.33 contains a patch for this issue.
How severe is CVE-2024-27916?: CVE-2024-27916 has a CVSS 3.x base score of 7.1, rated high severity. It is exploitable over network with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is low, integrity high, and availability none.
Is CVE-2024-27916 being actively exploited?: It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (47th percentile), an estimate of the probability of exploitation in the next 30 days.
What products are affected by CVE-2024-27916?: CVE-2024-27916 affects Lfprojects Minder. See the affected-products list for the exact vulnerable versions.
How do I fix CVE-2024-27916?: Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
Does CVE-2024-27916 have an EU (EUVD) identifier?: Yes. CVE-2024-27916 is tracked in the ENISA EU Vulnerability Database (EUVD) as EUVD-2024-1009.
When was CVE-2024-27916 published?: CVE-2024-27916 was published on 2024-03-21 and last updated on 2026-06-17.

References

Affected products (1)

cpe:2.3:a:lfprojects:minder:*:*:*:*:*:go:*:*

More vulnerabilities in Lfprojects Minder

CVE-2024-27093 — Medium (CVSS 4.6): Minder is a Software Supply Chain Security Platform. In version 0.0.31 and earlier, it is possible for an attacker to…

All CVEs affecting Lfprojects Minder →

Other CWE-285 (Improper Authorization) vulnerabilities

CVE-2025-65041 — Critical (CVSS 10.0): Improper authorization in Microsoft Partner Center allows an unauthorized attacker to elevate privileges over a network.
CVE-2023-33189 — Critical (CVSS 10.0): Pomerium is an identity and context-aware access proxy. With specially crafted requests, incorrect authorization…
CVE-2022-2595 — Critical (CVSS 10.0): Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.
CVE-2021-28799 — Critical (CVSS 10.0): An improper authorization vulnerability has been reported to affect QNAP NAS running HBS 3 (Hybrid Backup Sync. ) If…
CVE-2026-34048 — Critical (CVSS 9.9): Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to…
CVE-2026-5412 — Critical (CVSS 9.9): In Juju versions prior to 2.9.57 and 3.6.21, an authorization issue exists in the Controller facade. An authenticated…

Browse all CWE-285 (Improper Authorization) vulnerabilities →