CVE-2026-59164— NORA missing cross-user token-management authorization

Quick assessment

Affected

getnora-io nora

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

NORA 是一个自托管的制品仓库及拉取缓存系统。在 0.9.5 版本之前，虽然对令牌管理用户界面进行了身份验证，却未能强制要求管理员权限。函数保护了和路径，但针对状态变更请求，仅通过进行校验，而未使用。和函数调用了，从而泄露了所有用户的令牌 ID 及元数据；而函数则直接使用提供的令牌 ID 调用，且未进行所有权或管理员权限检查。攻击者若持有只读类型的 Bearer 令牌，即可枚举其他用户的令牌是否存在，并获取其所有者、角色、描述、过期时间及最后使用记录等元数据。若攻击者持有可写类型的 Bea

CVSS 7.1 · High Updated Oct 28, 2026

Possible ATT&CK Techniques 3 AI

T1078 · Valid Accounts T1530 · Data from Cloud Storage T1068 · Exploitation for Privilege Escalation

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

NORA missing cross-user token-management authorization

Source: CVE Program / CVE List V5

Vulnerability Description

NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-management UI but fails to require administrator authorization. `auth_middleware()` protects `/ui/tokens` and `/api/ui/tokens`, but state-changing requests are checked only with `role.can_write()`, not `role.can_admin()`. `tokens_page()` and `tokens_list()` call `store.list_all_tokens()`, exposing IDs and metadata across all users, while `tokens_revoke()` calls `store.revoke_token` using the supplied token ID without an ownership or admin check. A read bearer token can enumerate other users' token existence, owner, role, description, expiry and last-use metadata. A write bearer token or write-capable OIDC identity can additionally revoke arbitrary admin and service tokens, disrupting the registry and forcing credential recovery. Read-only identities cannot POST a revocation. This issue is fixed in version 0.9.5.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:N

Source: CVE Program / CVE List V5

Vulnerability Type

授权机制缺失

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
getnora-io	nora	< 0.9.5	-

II. Public POCs for CVE-2026-59164

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-59164

请登录查看更多情报信息。

Other References for CVE-2026-59164 (4)

https://github.com/getnora-io/nora/pull/747 x_refsource_MISC
https://github.com/getnora-io/nora/releases/tag/v0.9.5 x_refsource_MISC
https://github.com/getnora-io/nora/security/advisories/GHSA-78cx-cfhm-rgmx x_refsource_CONFIRM
https://github.com/getnora-io/nora/commit/dc9e943b208095ec1e8cc2cf7b5108fdb55cab9c x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-59164

IV. Related Vulnerabilities

Same weakness: CWE-862