Most recent entries from all

EUVD-2026-197760

fkie_cve-2024-49376

Autolab, a course management service that enables auto-graded programming assignments, has misconfigured reset password permissions in version 3.0.0. For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords. This issue is fixed in version 3.0.1. No known workarounds exist.

GHSA-v46j-h43h-rwrm — Autolab Misconfigured Reset Password Permissions

Affected: RubyGems: Autolab

### Impact For email-based accounts, users with insufficient privileges could reset and theoretically access privileged users' accounts by resetting their passwords.

### Patches This is fixed in v3.0.1.

### Workarounds No workarounds.

### For more information If you have any questions or comments about this advisory:

Open an issue in https://github.com/autolab/Autolab/ Email us at [autolab-dev@andrew.cmu.edu](mailto:autolab-dev@andrew.cmu.edu)