{"id":"CVE-2026-59164","kind":"vulnerability","aliases":["CVE-2026-59164"],"related":[],"title":"NORA registry: write-role tokens can revoke any user's token","description":"NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-management UI but fails to require administrator authorization. `auth_middleware()` protects `/ui/tokens` and `/api/ui/tokens`, but state-changing requests are checked only with `role.can_write()`, not `role.can_admin()`. `tokens_page()` and `tokens_list()` call `store.list_all_tokens()`, exposing IDs and metadata across all users, while `tokens_revoke()` calls `store.revoke_token` using the supplied token ID without an ownership or admin check. A read bearer token can enumerate other users' token existence, owner, role, description, expiry and last-use metadata. A write bearer token or write-capable OIDC identity can additionally revoke arbitrary admin and service tokens, disrupting the registry and forcing credential recovery. Read-only identities cannot POST a revocation. This issue is fixed in version 0.9.5.","summary":"NORA, a self-hosted artifact registry, lets any read token list every user's token metadata and lets any write token revoke admin and service tokens. An attacker can lock out administrators or services and learn who holds which credentials.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["artifact-registry","nora","oidc","package","self-hosted"],"not_affected_if":["version-0.9.5-or-later"],"how_to_check":"- Check the installed `nora-registry` version; anything below `0.9.5` is affected.\n- Review which bearer tokens and OIDC identities have write access to the token-management UI.","fix":"- Upgrade `nora-registry` to `0.9.5` or later.\n- Rotate admin and service tokens if a write-capable identity may have misused the revoke endpoint.","status":"open","published_at":"2026-10-28T14:17:04+00:00","first_seen_at":"2026-10-28T14:33:23+00:00","triaged_at":"2026-10-28T14:34:30+00:00","updated_at":"2026-10-28T14:34:30+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-28T14:34:30Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade `nora-registry` to `0.9.5` or later.\n- Rotate admin and service tokens if a write-capable identity may have misused the revoke endpoint.","reach":"network","title":"NORA registry: write-role tokens can revoke any user's token","impact":"medium","summary":"NORA, a self-hosted artifact registry, lets any read token list every user's token metadata and lets any write token revoke admin and service tokens. An attacker can lock out administrators or services and learn who holds which credentials.","category":"package","nicknames":[],"who_cares":["nora","self-hosted","artifact-registry","oidc"],"confidence":0.8,"needs_auth":"yes","worst_case":"Any write token holder can revoke admin tokens and read all users' token metadata","analyst_note":"","how_to_check":"- Check the installed `nora-registry` version; anything below `0.9.5` is affected.\n- Review which bearer tokens and OIDC identities have write access to the token-management UI.","needs_analyst":false,"not_affected_if":["version-0.9.5-or-later"],"who_is_affected":"Teams running self-hosted NORA before `0.9.5` where users hold read or write tokens or write-capable OIDC identities. Deployments where only administrators hold tokens are less exposed, but the flaw still lets any write holder revoke admin tokens.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000606,"input_tokens":3536,"output_tokens":504,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-59164':15A,18A '/api/ui/tokens':105C '/ui/tokens':103C '0.9.5':84C,211C 'across':133C 'addit':183C 'admin':51B,119C,151C,186C 'administr':60B,98C 'arbitrari':185C 'artifact':20B,33B,75C 'artifact-registri':19B 'attack':56B 'auth':100C 'authent':88C 'author':99C 'bearer':155C,174C 'cach':81C 'call':125C,139C 'cannot':201C 'capabl':179C 'chang':109C 'check':112C,152C 'credenti':68B,195C 'cve':13A,16A 'descript':165C 'disrupt':190C 'enumer':158C 'everi':40B 'exist':162C 'expiri':166C 'expos':129C 'fail':95C 'fix':208C 'forc':194C 'hold':66B 'host':27B,32B,74C 'id':130C,146C 'ident':181C,200C 'issu':206C 'last':169C 'last-us':168C 'learn':64B 'let':35B,46B 'list':39B,124C 'lock':58B 'manag':92C 'metadata':44B,132C,171C 'middlewar':101C 'nora':1A,22B,28B,69C,86C 'nora-registri':85C 'oidc':23B,180C 'owner':163C 'ownership':149C 'packag':24B 'page':121C 'post':202C 'prior':82C 'protect':102C 'pull':79C 'pull-through':78C 'read':37B,154C,198C 'read-on':197C 'recoveri':196C 'registri':2A,21B,34B,76C,87C,192C 'request':110C 'requir':97C 'revoc':204C 'revok':8A,50B,138C,184C 'role':5A,164C 'role.can':115C,118C 'self':26B,31B,73C 'self-host':25B,30B,72C 'servic':53B,62B,188C 'state':108C 'state-chang':107C 'store.list':126C 'store.revoke':140C 'suppli':144C 'token':6A,12A,38B,43B,49B,54B,91C,120C,123C,128C,137C,141C,145C,156C,161C,175C,189C 'token-manag':90C 'ui':93C 'use':142C,170C 'user':10A,41B,135C,160C 'version':210C 'without':147C 'write':4A,48B,116C,173C,178C 'write-cap':177C 'write-rol':3A","nicknames":[],"mitigations":[],"who_affected":"Teams running self-hosted NORA before `0.9.5` where users hold read or write tokens or write-capable OIDC identities. Deployments where only administrators hold tokens are less exposed, but the flaw still lets any write holder revoke admin tokens.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T14:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-59164","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-59164","severity":null,"published_at":"2026-10-28T14:17:04+00:00","modified_at":"2026-10-28T14:17:04+00:00","first_seen_at":"2026-10-28T14:33:23+00:00","fetched_at":"2026-10-28T14:33:23+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}