GitHub Advisoryadvisory · PyPI

GHSA-5vcc-86wm-547q Improper Privilege Management in djangorestframework-simplejwt

LOW Published 2024-03-16 Modified 2025-09-02 Official page ↗
Aliases
CVE-2024-22513
Ecosystem
PyPI
Packages
djangorestframework-simplejwt
Severity
Low
Weaknesses
CWE-269
Reviewed
2024-03-18

Affected packages

• PyPI djangorestframework-simplejwt: < 5.5.1 → fixed in 5.5.1

Description

djangorestframework-simplejwt before version 5.5.1 is vulnerable to information disclosure. A user can access web application resources even after their account has been disabled due to missing user validation checks via the for_user method.

Related

Alias · CVE (1)

  • CVE-2024-22513 djangorestframework-simplejwt version 5.3.1 and before is vulnerable to information disclosure. vulnerability

Weakness · CWE (1)

  • CWE-269 Improper Privilege Management weakness

References