CVSS 3.1 Score 5.5 of 10 (medium)


Published Feb 21, 2024
Updated: Feb 22, 2024
CWE ID 256


CVE-2024-26133 is a vulnerability found in the projections subsystem of EventStoreDB (ESDB) versions 20 prior to 20.10.6, 21 prior to 21.10.11, 22 prior to 22.10.5, and 23 prior to 23.10.1. Only database instances using custom projections are affected by this vulnerability. It allows unauthorized access to user passwords for those who can access chunk files on disk and have read access to system streams. Users in the $admins group can access system streams by default. The issue has been patched in ESDB versions 23.10.1, 22.10.5, 21.10.11, and 20.10.6, so upgrading is recommended along with resetting passwords for current and previous members of $admins and $ops groups as a best practice precautionary measure against potential misuse of compromised passwords in other systems if they were reused there as well.

Note: The information provided here is based on the given text and does not involve any external research or additional sources beyond the provided text snippet

Explore Beyond the CVE Basics with Recorded Future's Vulnerability Intelligence

Note: This is just a basic overview providing quick insights into CVE-2024-26133 information. Gain full access to comprehensive CVE data, risk scores, prioritization, and mitigation data through Recorded Future's Vulnerability Intelligence:
  • Prioritize with Risk-Based Scoring
  • Explore the Extensive Vulnerability Database
  • Receive Early Alerts on Emerging CVEs
  • Focus on Critical Exploitable Vulnerabilities
  • Streamline Remediation with Integration Options