Nixpkgs security tracker
8.7 HIGH
- CVSS version (CVSS): 4.0
- Attack Vector (AV): Network (N)
- Attack Complexity (AC): Low (L)
- Attack Requirement (AT): None (N)
- Privileges Required (PR): Low (L)
- User Interaction (UI): None (N)
- Vulnerable System Impact Confidentiality (VC): High (H)
- Vulnerable System Impact Integrity (VI): High (H)
- Vulnerable System Impact Availability (VA): High (H)
- Subsequent System Impact Confidentiality (SC): None (N)
- Subsequent System Impact Integrity (SI): None (N)
- Subsequent System Impact Availability (SA): None (N)
- Modified Attack Vector (MAV): Network (N)
- Modified Attack Complexity (MAC): Low (L)
- Modified Attack Requirement (MAT): None (N)
- Modified Privileges Required (MPR): Low (L)
- Modified User Interaction (MUI): None (N)
- Modified Vulnerable System Impact Confidentiality (MVC): High (H)
- Modified Vulnerable System Impact Integrity (MVI): High (H)
- Modified Vulnerable System Impact Availability (MVA): High (H)
- Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
- Modified Subsequent System Impact Integrity (MSI): Negligible (N)
- Modified Subsequent System Impact Availability (MSA): Negligible (N)
- Safety (S): Not Defined (X)
- Automatable (AU): Not Defined (X)
- Recovery (R): Not Defined (X)
- Value Density (V): Not Defined (X)
- Vulnerability Response Effort (RE): Not Defined (X)
- Provider Urgency (U): Not Defined (X)
- Confidentiality Req. (CR): Not Defined (X)
- Integrity Req. (IR): Not Defined (X)
- Availability Req. (AR): Not Defined (X)
- Exploit Maturity (E): Not Defined (X)
Activity log
- Created suggestion
Grav API Plugin 1.0.9 Privilege Escalation via Invitations groups
Grav API Plugin versions before 1.0.10 fail to validate the groups field in InvitationsController::create(), allowing authenticated api.users.write callers to assign invited accounts to groups that grant api.super permissions. Attackers can create invitation records with elevated group membership, and when accepted, the new account gains full super-admin API access without the inviter holding those permissions.
References
Affected products
- <1.0.10
- ==1.0.10
Matching in nixpkgs
pkgs.grav
Fast, simple, and flexible, file-based web platform
pkgs.gravit
Beautiful OpenGL-based gravity simulator
pkgs.antigravity
Agentic development platform, evolving the IDE into the agent-first era
pkgs.antigravity-cli
Google's Go-based terminal user interface (TUI) agent client
-
nixos-unstable -
- nixos-unstable-small 1.1.4
pkgs.antigravity-fhs
Agentic development platform, evolving the IDE into the agent-first era
pkgs.antigravity-ide
Agentic development platform, evolving the IDE into the agent-first era
-
nixos-unstable -
- nixos-unstable-small 2.1.1
pkgs.antigravity-ide-fhs
Agentic development platform, evolving the IDE into the agent-first era
-
nixos-unstable -
- nixos-unstable-small 2.1.1
pkgs.stardust-xr-gravity
Utility to launch apps and stardust clients at an offet
pkgs.kdePackages.libgravatar
Library that provides Gravatar support
pkgs.gnomeExtensions.gravatar
Synchronize GNOME Shell user icon with an avatar service, one of Gravatar or Libravatar.
pkgs.haskellPackages.gravatar
Generate Gravatar image URLs
pkgs.python313Packages.libgravatar
Library that provides a Python 3 interface for the Gravatar API
pkgs.python314Packages.libgravatar
Library that provides a Python 3 interface for the Gravatar API
pkgs.python313Packages.flask-gravatar
Small and simple integration of gravatar into flask
pkgs.python314Packages.flask-gravatar
Small and simple integration of gravatar into flask
pkgs.python313Packages.django-gravatar2
Essential Gravatar support for Django
pkgs.python314Packages.django-gravatar2
Essential Gravatar support for Django
pkgs.perlPackages.MojoliciousPluginGravatar
Globally Recognized Avatars for Mojolicious
pkgs.perl5Packages.MojoliciousPluginGravatar
Globally Recognized Avatars for Mojolicious
Package maintainers
-
@schembriaiden Aiden Schembri <aidsch@proton.me>
-
@xiaoxiangmoe ZHAO JinXiang <xiaoxiangmoe@gmail.com>
-
@Zaczero Kamil Monicz <kamil@monicz.dev>
-
@honnip Jung seungwoo <me@honnip.page>
-
@rycee Robert Helgesson <robert@rycee.net>
-
@FRidh Frederik Rietdijk <fridh@fridh.nl>
-
@LunNova Luna Nova <nixpkgs-maintainer@lunnova.dev>
-
@SuperSandro2000 Sandro Jäckel <sandro.jaeckel@gmail.com>
-
@NickCao Nick Cao <nickcao@nichi.co>
-
@nyanloutre Paul Trehiou <paul@nyanlout.re>
-
@peterhoeg Peter Hoeg <peter@hoeg.com>
-
@ilya-fedin Ilya Fedin <fedin-ilja2010@ya.ru>
-
@mjm Matt Moriarity <matt@mattmoriarity.com>
-
@bkchr Bastian Köcher <nixos@kchr.de>
-
@K900 Ilya K. <me@0upti.me>
-
@stigtsp Stig Palmquist <stig@stig.io>
-
@gador Florian Brandes <florian.brandes@posteo.de>
-
@Pandapip1 Gavin John <gavinnjohn@gmail.com>
-
@technobaboo Nova King
-
@u3kkasha Fida Waseque Choudhury <fida.waseque@gmail.com>
-
@AdrielVelazquez Adriel Velazquez <AdrielVelazquez@gmail.com>