CVE-2023-32696 - CVE House
Back to Database
Status published High CVE-2023-32696

Excessive permissions for ckan user

Vulnerability Description

CKAN is an open-source data management system for powering data hubs and data portals. Prior to versions 2.9.9 and 2.10.1, the `ckan` user (equivalent to www-data) owned code and configuration files in the docker container and the `ckan` user had the permissions to use sudo. These issues allowed for code execution or privilege escalation if an arbitrary file write bug was available. Versions 2.9.9, 2.9.9-dev, 2.10.1, and 2.10.1-dev contain a patch.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2023-32696

Credits & Attribution

No credits recorded in the NVD database.

References

More from ckan

View All →
CVE-2025-64100
CKAN Vulnerable to Session Cookie Fixation
Medium 6.1
CVE-2025-54384
CKAN stored XSS vulnerability in Markdown description fields
Medium 6.3
CVE-2025-24372
XSS vector in user uploaded images in group/org and user profiles in ckan
High 7.3
CVE-2024-43371
Potential access to sensitive URLs via CKAN extensions (SSRF)
Medium 4.5
CVE-2024-41675
CKAN has a Cross-site Scripting vector in the Datatables view plugin
Medium 6.8

Affected Vendor

Affected Software

ckan-docker-base
Vulnerable Versions:
< 2.9.9, >= 2.10.0, < 2.10.1

Timeline

Official Publish: May 30th, 2023
Last Modified: January 9th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-269

MITRE ATT&CK TTPs

T1078 Valid Accounts
Persistence
T1098 Account Manipulation
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1222 File and Directory Permissions Modification
Defense Evasion
T1134 Access Token Manipulation
Defense Evasion