Publify `guest` role users can self-register even when the admin does not allow it

中危 6.5CVE-2021-25973 · BIT-publify-2021-25973 · GHSA-x24j-87x9-jvv5 · Published 02/11/2021 · updated 17/06/2026

要点

CVE-2021-25973 是影响 publify_core, publify (publify project) 的中危 (CVSS 6.5)漏洞。
未来 30 天内被利用的概率（EPSS）：0.83%，高于 57.5% 的漏洞。
修复：升级到 9.2.5 或更高版本。

Package	Affected versions	Patched versions
publify_core RubyGems	`≥ 9.0.0.pre1, < 9.2.5`	`9.2.5`
publify publify_project	`≥ 9.0.0, ≤ 9.2.4`	No fix yet

Description

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. guest role users can self-register even when the admin does not allow it. This happens due to front-end restriction only.

NVD description

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only.

References

nvd.nist.gov/vuln/detail/CVE-2021-25973 · ADVISORY
publify/publify commit 3447e02 · WEB
publify/publify · WEB
rubysec/ruby-advisory-db · WEB
whitesourcesoftware.com/vulnerability-database/CVE-2021-25973 · WEB

publify_core 的其他漏洞

查看全部 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

publify_core

RubyGems

≥ 9.0.0.pre1, < 9.2.5

9.2.5

publify

publify_project

≥ 9.0.0, ≤ 9.2.4

No fix yet

Description

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. guest role users can self-register even when the admin does not allow it. This happens due to front-end restriction only.

NVD description

In Publify, 9.0.0.pre1 to 9.2.4 are vulnerable to Improper Access Control. “guest” role users can self-register even when the admin does not allow. This happens due to front-end restriction only.

publify_core 的其他漏洞

查看全部 →