{"id":"CVE-2022-31259","aliases":["GHSA-qx32-f6g6-fcfr","GO-2022-0463"],"title":"Access control bypass in beego","summary":"Access control bypass in beego","severity":"critical","cvss":9.8,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","vendor":"beego","product":"github.com/beego/beego/v2","ecosystem":"go","affected":["github.com/beego/beego/v2 < 2.0.3","github.com/beego/beego < 1.12.9"],"patched":["github.com/beego/beego/v2 2.0.3","github.com/beego/beego 1.12.9"],"published":"2022-05-22","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-qx32-f6g6-fcfr","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-31259"},{"url":"https://github.com/beego/beego/issues/4946"},{"url":"https://github.com/beego/beego/pull/4954"},{"url":"https://github.com/beego/beego/pull/4958"},{"url":"https://github.com/beego/beego/commit/228576173a236c81a2122923fcf8099ad294e009"},{"url":"https://github.com/beego/beego/commit/64cf44d725c8cc35d782327d333df9cbeb1bf2dd"},{"url":"https://github.com/advisories/GHSA-qx32-f6g6-fcfr"},{"url":"https://github.com/beego/beego"},{"url":"https://github.com/beego/beego/tree/v2.0.2"},{"url":"https://pkg.go.dev/vuln/GO-2022-0463"}],"tags":["osv","go"],"epss":0.22158,"epssPercentile":0.97564,"ingestedAt":"2026-07-09T18:56:36.892Z","slug":"CVE-2022-31259","body":"## Overview\n\nThe route lookup process in beego prior to 1.12.9 and 2.x prior to 2.0.3 allows attackers to bypass access control. When a /`p1`/`p2`/`:name` route is configured, attackers can access it by appending .xml in various places (e.g., p1.xml instead of p1).\n\n## Affected packages\n\n- `github.com/beego/beego/v2 < 2.0.3`\n- `github.com/beego/beego < 1.12.9`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/beego/beego/v2 2.0.3`\n- `github.com/beego/beego 1.12.9`","depth":"midnight","depthScore":58,"depthScoreParts":{"impact":53.9,"likelihood":4.4,"exploitation":0,"ransomware":0},"changes":[]}