CVE-2021-36758

MEDIUM 5.4CVE-2021-36758 · Published 16/07/2021 · updated 17/06/2026

In short

CVE-2021-36758 is a MEDIUM (CVSS 5.4) vulnerability affecting connect (1password).
Chance of exploitation in the next 30 days (EPSS): 0.47%, higher than 41.1% of all vulnerabilities.
Fix: update to 1.2 or later.

Package	Affected versions	Patched versions
connect 1password	`< 1.2`	`1.2`

Description

1Password Connect server before 1.2 is missing validation checks, permitting users to create Secrets Automation access tokens that can be used to perform privilege escalation. Malicious users authorized to create Secrets Automation access tokens can create tokens that have access beyond what the user is authorized to access, but limited to the existing authorizations of the Secret Automation the token is created in.

References

support.1password.com/kb/202106 · Patch

More vulnerabilities in connect

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free