Threats tagged 'ghsa-fr98-98p8-3mxf'

Vault Community Edition and Vault Enterprise had a vulnerability where explicit ACL policy deny rules were not consistently enforced for request paths differing only by a trailing slash. This inconsistency could allow an authenticated user with broad delete permissions to disable critical components like secrets engines, auth methods, or audit devices that more specific deny rules were meant to protect. The issue is fixed in Vault Community Edition 2.2.2 and Vault Enterprise versions 2.2.2, 1.21.14, and 1.19.25.