---
id: CVE-2021-22565
aliases:
  - GHSA-wx8q-rgfr-cf6v
  - GO-2022-0270
title: >-
  Insufficient Granularity of Access Control in
  github.com/google/exposure-notifications-verification-server
summary: >-
  Insufficient Granularity of Access Control in
  github.com/google/exposure-notifications-verification-server
severity: medium
cvss: 6.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L'
vendor: google
product: github.com/google/exposure-notifications-verification-server
ecosystem: go
affected:
  - github.com/google/exposure-notifications-verification-server < 1.1.2
patched:
  - github.com/google/exposure-notifications-verification-server 1.1.2
published: '2021-11-10'
updated: '2026-07-08'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-wx8q-rgfr-cf6v'
references:
  - url: >-
      https://github.com/google/exposure-notifications-verification-server/security/advisories/GHSA-wx8q-rgfr-cf6v
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2021-22565'
  - url: 'https://github.com/google/exposure-notifications-verification-server'
  - url: >-
      https://github.com/google/exposure-notifications-verification-server/releases/tag/v1.1.2
tags:
  - osv
  - go
epss: 0.00425
epssPercentile: 0.3419
ingestedAt: '2026-07-09T18:56:36.971Z'
---

## Overview

### Impact
Users or API keys with permission to expire verification codes could have expired codes that belonged to another realm if they guessed the UUID.

### Patches
v1.1.2+

### Workarounds
There are no workarounds, and there are no indications this has been exploited in the wild. Verification codes can only be expired by providing their 64-bit UUID, and verification codes are already valid for a very short period of time (thus the UUID rotates frequently).

### For more information
Contact exposure-notifications-feedback@google.com

## Affected packages

- `github.com/google/exposure-notifications-verification-server < 1.1.2`

## Remediation

Upgrade to a patched release:

- `github.com/google/exposure-notifications-verification-server 1.1.2`