Skip to content
OpenAdvisories

Vendor

getnora-io

1 known vulnerabilities.

Products

nora 1
All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • High 7.1
    CVE-2026-59164

    NORA missing cross-user token-management authorization

    NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-management UI but fails to require administrator authorization. `auth_middleware()` protects `/ui/tokens` and `/api/ui/tokens`, but state-c…

    getnora-io nora