{"id":"CVE-2021-22565","aliases":["GHSA-wx8q-rgfr-cf6v","GO-2022-0270"],"title":"Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server","summary":"Insufficient Granularity of Access Control in github.com/google/exposure-notifications-verification-server","severity":"medium","cvss":6.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","vendor":"google","product":"github.com/google/exposure-notifications-verification-server","ecosystem":"go","affected":["github.com/google/exposure-notifications-verification-server < 1.1.2"],"patched":["github.com/google/exposure-notifications-verification-server 1.1.2"],"published":"2021-11-10","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-wx8q-rgfr-cf6v","references":[{"url":"https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-wx8q-rgfr-cf6v"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22565"},{"url":"https://github.com/google/exposure-notifications-verification-server"},{"url":"https://github.com/google/exposure-notifications-verification-server/releases/tag/v1.1.2"}],"tags":["osv","go"],"epss":0.00425,"epssPercentile":0.36448,"ingestedAt":"2026-07-09T18:56:36.971Z","slug":"CVE-2021-22565","body":"## Overview\n\n### Impact\nUsers or API keys with permission to expire verification codes could have expired codes that belonged to another realm if they guessed the UUID.\n\n### Patches\nv1.1.2+\n\n### Workarounds\nThere are no workarounds, and there are no indications this has been exploited in the wild. Verification codes can only be expired by providing their 64-bit UUID, and verification codes are already valid for a very short period of time (thus the UUID rotates frequently).\n\n### For more information\nContact exposure-notifications-feedback@google.com\n\n## Affected packages\n\n- `github.com/google/exposure-notifications-verification-server < 1.1.2`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/google/exposure-notifications-verification-server 1.1.2`","depth":"sunlit","depthScore":36,"depthScoreParts":{"impact":35.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}