CVE-2021-46561

controller/org.controller/org.controller.js in the CVE Services API 1.1.1 before 5c50baf3bda28133a3bc90b854765a64fb538304 allows an organizational administrator to transfer a user account to an arbitrary new organization, and thereby achieve unintended access within the context of that new organization.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 55%
VendorProductVersion
mitrecve_services
1.1.1
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/CVEProject/cve-services/commit/5c50baf3bda28133a3bc90b854765a64fb538304
https://github.com/CVEProject/cve-services/commit/5c50baf3bda28133a3bc90b854765a64fb538304