{"id":"CVE-2023-50422","aliases":["GHSA-m8rw-rcpq-2vp2","CVE-2023-50424","GHSA-59c9-pxq8-9c73","GHSA-92cg-ghq6-9587","GO-2023-2400"],"title":"Improper Privilege Management in github.com/sap/cloud-security-client-go","summary":"Improper Privilege Management in github.com/sap/cloud-security-client-go","severity":"critical","cvss":9.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","vendor":"sap","product":"github.com/sap/cloud-security-client-go","ecosystem":"go","affected":["github.com/sap/cloud-security-client-go < 0.17.0"],"patched":["github.com/sap/cloud-security-client-go 0.17.0"],"published":"2023-12-13","updated":"2026-07-08","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-m8rw-rcpq-2vp2","references":[{"url":"https://github.com/SAP/cloud-security-client-go/security/advisories/GHSA-m8rw-rcpq-2vp2"},{"url":"https://github.com/SAP/cloud-security-services-integration-library/security/advisories/GHSA-59c9-pxq8-9c73"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-50424"},{"url":"https://github.com/SAP/cloud-security-client-go/commit/2e3bd63e152e09f267316a1071034eb5d4b7f498"},{"url":"https://blogs.sap.com/2023/12/12/unveiling-critical-security-updates-sap-btp-security-note-3411067"},{"url":"https://github.com/SAP/cloud-security-client-go"},{"url":"https://me.sap.com/notes/3411067"},{"url":"https://pkg.go.dev/github.com/sap/cloud-security-client-go@v0.17.0"},{"url":"https://www.sap.com/documents/2022/02/fa865ea4-167e-0010-bca6-c68f7e60039b.html"}],"tags":["osv","go"],"epss":0.01355,"epssPercentile":0.69965,"ingestedAt":"2026-07-09T18:56:36.624Z","slug":"CVE-2023-50422","body":"## Overview\n\n### Impact\nSAP BTP Security Services Integration Library ([Golang] github.com/sap/cloud-security-client-go) allows under certain conditions an escalation of privileges. On successful exploitation, an unauthenticated attacker can obtain arbitrary permissions within the application.\n\n### Patches\nUpgrade to patched version >= 0.17.0\nWe always recommend to upgrade to the latest released version.\n\n### Workarounds\nNo workarounds\n\n### References\nhttps://www.cve.org/CVERecord?id=CVE-2023-50424\n\n## Affected packages\n\n- `github.com/sap/cloud-security-client-go < 0.17.0`\n\n## Remediation\n\nUpgrade to a patched release:\n\n- `github.com/sap/cloud-security-client-go 0.17.0`","depth":"midnight","depthScore":50,"depthScoreParts":{"impact":50.1,"likelihood":0.3,"exploitation":0,"ransomware":0},"changes":[]}