---
id: "CVE-2026-59164"
kind: "vulnerability"
aliases: ["CVE-2026-59164"]
title: "NORA registry: write-role tokens can revoke any user's token"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["artifact-registry", "nora", "oidc", "package", "self-hosted"]
not_affected_if: ["version-0.9.5-or-later"]
published_at: "2026-10-28T14:17:04+00:00"
first_seen_at: "2026-10-28T14:33:23+00:00"
updated_at: "2026-10-28T14:34:30+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-59164", "first_seen_at": "2026-10-28T14:33:23+00:00"}]
---

# NORA registry: write-role tokens can revoke any user's token

NORA, a self-hosted artifact registry, lets any read token list every user's token metadata and lets any write token revoke admin and service tokens. An attacker can lock out administrators or services and learn who holds which credentials.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed `nora-registry` version; anything below `0.9.5` is affected.
- Review which bearer tokens and OIDC identities have write access to the token-management UI.

## Fix

- Upgrade `nora-registry` to `0.9.5` or later.
- Rotate admin and service tokens if a write-capable identity may have misused the revoke endpoint.

## Timeline

- 2026-10-28T14:33:23+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-59164

## From the sources

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-management UI but fails to require administrator authorization. `auth_middleware()` protects `/ui/tokens` and `/api/ui/tokens`, but state-changing requests are checked only with `role.can_write()`, not `role.can_admin()`. `tokens_page()` and `tokens_list()` call `store.list_all_tokens()`, exposing IDs and metadata across all users, while `tokens_revoke()` calls `store.revoke_token` using the supplied token ID without an ownership or admin check. A read bearer token can enumerate other users' token existence, owner, role, description, expiry and last-use metadata. A write bearer token or write-capable OIDC identity can additionally revoke arbitrary admin and service tokens, disrupting the registry and forcing credential recovery. Read-only identities cannot POST a revocation. This issue is fixed in version 0.9.5.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_