NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| github.com/nats-io/nats-server/v2(Go) | 2.0.0 | 2.7.2 | N/A |
| github.com/nats-io/nats-streaming-server(Go) | 0.15.0 | 0.24.1 | N/A |
CVSS Metrics
