---
id: CVE-2023-32079
aliases:
  - GHSA-826j-8wp2-4x6q
  - GO-2023-2025
title: Netmaker Vulnerable to Privilege Escalation From Non Admin To Admin User
summary: Netmaker Vulnerable to Privilege Escalation From Non Admin To Admin User
severity: high
cvss: 8.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
vendor: gravitl
product: github.com/gravitl/netmaker
ecosystem: go
affected:
  - github.com/gravitl/netmaker < 0.17.1
  - 'github.com/gravitl/netmaker >= 0.18.0, < 0.18.6'
patched:
  - github.com/gravitl/netmaker 0.17.1
  - github.com/gravitl/netmaker 0.18.6
published: '2023-08-25'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:49:57.402711910Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-826j-8wp2-4x6q'
references:
  - url: >-
      https://github.com/gravitl/netmaker/security/advisories/GHSA-826j-8wp2-4x6q
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2023-32079'
  - url: 'https://github.com/gravitl/netmaker'
tags:
  - osv
  - go
epss: 0.00865
epssPercentile: 0.57141
ingestedAt: '2026-09-12T03:13:01.765Z'
---

## Overview

### Impact
A Mass assignment vulnerability was found allowing a non-admin user to escalate privileges to admin user.

### Patches
Issue is patched in 0.17.1, and fixed in 0.18.6+.

If Users are using 0.17.1, they should run "docker pull gravitl/netmaker:v0.17.1" and "docker-compose up -d". This will switch them to the patched users

If users are using v0.18.0-0.18.5, they should upgrade to v0.18.6 or later.

### Workarounds
If using 0.17.1, can just pull the latest docker image of backend and restart server.

### References
Credit to Project Discovery, and in particular https://github.com/rootxharsh , https://github.com/iamnoooob, and https://github.com/projectdiscovery

## Affected packages

- `github.com/gravitl/netmaker < 0.17.1`
- `github.com/gravitl/netmaker >= 0.18.0, < 0.18.6`

## Remediation

Upgrade to a patched release:

- `github.com/gravitl/netmaker 0.17.1`
- `github.com/gravitl/netmaker 0.18.6`