Back to Database
Status published
High
CVE-2022-36110
Netmaker vulnerable to Insufficient Granularity of Access Control
Vulnerability Description
Netmaker makes networks with WireGuard. Prior to version 0.15.1, Improper Authorization functions lead to non-privileged users running privileged API calls. If someone adds users to the Netmaker platform who do not have admin privileges, they can use their auth tokens to run admin-level functions via the API. This problem has been patched in v0.15.1.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2022-36110
Credits & Attribution
No credits recorded in the NVD database.
References
More from gravitl
View All →CVE-2023-32079
Netmaker Privilige Escalation Vulnerability
High
8.8
CVE-2023-32078
Netmaker IDOR Vulnerability Allows User to Update Other User's Password
High
7.5
CVE-2023-32077
Netmaker has Hardcoded DNS Secret Key
High
7.5
CVE-2022-23650
Use of Hard-coded Cryptographic Key in Netmaker
High
7.2
CVE-2022-0664
Use of Hard-coded Cryptographic Key in gravitl/netmaker
High
8.8
Affected Vendor
gravitl
View all reports →Affected Software
netmaker
Vulnerable Versions:
< 0.15.1
Timeline
Official Publish:
September 9th, 2022
Last Modified:
April 23rd, 2025
Added to House:
July 21st, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H