---
id: CVE-2024-27292
aliases:
  - GHSA-jq57-3w7p-vwvv
  - PYSEC-2026-1309
  - PYSEC-2026-2453
title: Docassemble unauthorized access through URL manipulation
summary: Docassemble unauthorized access through URL manipulation
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'
vendor: docassemble-webapp
product: docassemble-webapp
ecosystem: pip
affected:
  - 'docassemble-webapp >= 1.4.53, < 1.4.97'
  - 'docassemble-base >= 1.4.53, < 1.4.97'
patched:
  - docassemble-webapp 1.4.97
  - docassemble-base 1.4.97
published: '2024-02-29'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:05.738115429Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-jq57-3w7p-vwvv'
references:
  - url: >-
      https://github.com/jhpyle/docassemble/security/advisories/GHSA-jq57-3w7p-vwvv
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-27292'
  - url: >-
      https://github.com/jhpyle/docassemble/commit/97f77dc486a26a22ba804765bfd7058aabd600c9
  - url: 'https://github.com/jhpyle/docassemble'
tags:
  - osv
  - pip
  - exploit-available
epss: 0.69486
epssPercentile: 0.99341
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/th3gokul/CVE-2024-27292'
    - 'https://github.com/NingXin2002/Docassemble_poc'
  nuclei:
    - CVE-2024-27292
  checkedAt: '2026-09-25T08:20:43.063Z'
exploitAvailable: true
ingestedAt: '2026-07-08T18:25:50.853Z'
---

## Overview

### Impact
The vulnerability allows attackers to gain unauthorized access to information on the system through URL manipulation. It affects versions 1.4.53 to 1.4.96.

### Patches
The vulnerability has been patched in version 1.4.97 of the master branch. The Docker image on docker.io has been patched.

### Workarounds
If upgrading is not possible, manually apply the changes of [97f77dc](https://github.com/jhpyle/docassemble/commit/97f77dc486a26a22ba804765bfd7058aabd600c9) and restart the server.

### Credit

The vulnerability was discovered by Riyush Ghimire (@richighimi).

### For more information
If you have any questions or comments about this advisory:

* Open an issue in [docassemble](https://github.com/jhpyle/docassemble/issues)
* Join the [Slack channel](https://join.slack.com/t/docassemble/shared_invite/zt-2cspzjo9j-YyE7SrLmi5muAvnPv~Bz~A)
* Email us at jhpyle@gmail.com

## Affected packages

- `docassemble-webapp >= 1.4.53, < 1.4.97`
- `docassemble-base >= 1.4.53, < 1.4.97`

## Remediation

Upgrade to a patched release:

- `docassemble-webapp 1.4.97`
- `docassemble-base 1.4.97`