Live › vulnerability › CVE-2026-59164
Go to dashboardNORA, a self-hosted artifact registry, lets any read token list every user's token metadata and lets any write token revoke admin and service tokens. An attacker can lock out administrators or services and learn who holds which credentials.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 14:33 UTC. All times on this page are UTC.
Teams running self-hosted NORA before where users hold read or write tokens or write-capable OIDC identities. Deployments where only administrators hold tokens are less exposed, but the flaw still lets any write holder revoke admin tokens.
0.9.5No product ranges from the sources yet.
nora-registry version; anything below 0.9.5 is affected.nora-registry to 0.9.5 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, nora-registry authenticates the token-management UI but fails to require administrator authorization. auth_middleware() protects /ui/tokens and /api/ui/tokens, but state-changing requests are checked only with role.can_write(), not role.can_admin(). tokens_page() and tokens_list() call store.list_all_tokens(), exposing IDs and metadata across all users, while tokens_revoke() calls store.revoke_token using the supplied token ID without an ownership or admin check. A read bearer token can enumerate other users' token existence, owner, role, description, expiry and last-use metadata. A write bearer token or write-capable OIDC identity can additionally revoke arbitrary admin and service tokens, disrupting the registry and forcing credential recovery. Read-only identities cannot POST a revocation. This issue is fixed in version 0.9.5.
This page as .md · .json · in your agent: get_signal("CVE-2026-59164")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.