Back to Database
Status published
Medium
CVE-2023-32669
Authorization Bypass on BuddyBoss
Vulnerability Description
Authorization bypass vulnerability in BuddyBoss 2.2.9 version, the exploitation of which could allow an authenticated user to access and rename other users' albums. This vulnerability can be exploited by changing the album identification (id).
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-32669
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Anxo Januario Gonzales
More from BuddyBoss
View All →CVE-2025-1909
BuddyBoss Platform Pro <= 2.7.01 - Authentication Bypass via Apple OAuth provider
Critical
9.8
CVE-2023-45755
WordPress BuddyPress Global Search Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)
Medium
5.9
CVE-2023-32671
BuddyBoss XSS vulnerability
Medium
6.3
CVE-2023-32670
BuddyBoss XSS vulnerability
Critical
9
Affected Vendor
BuddyBoss
View all reports →Affected Software
BuddyBoss
Vulnerable Versions:
2.2.9
Timeline
Official Publish:
October 3rd, 2023
Last Modified:
September 6th, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N