Skip to content
OpenAdvisories

Vendor

tgstation

5 known vulnerabilities.

Products

tgstation-server 5
All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • High 8.8
    CVE-2025-21611

    tgstation-server's role authorization incorrectly OR'd with user's enabled status

    tgstation-server is a production scale tool for BYOND server management. Prior to 6.12.3, roles used to authorize API methods were incorrectly OR'd instead of AND'ed with the role used to determine if a user was enabled. This allows enabled users access to mo…

    tgstation tgstation-server
  • High 8.4
    CVE-2024-41799

    tgstation-server's DreamMaker environment files outside the deployment directory can be compiled and ran by insufficiently permissioned users

    tgstation-server is a production scale tool for BYOND server management. Prior to 6.8.0, low permission users using the "Set .dme Path" privilege could potentially set malicious .dme files existing on the host machine to be compiled and executed. These .dme f…

    tgstation tgstation-server Tgstation.Server.Host Tgstation.Server.Api NuGet
  • High 7.7
    CVE-2023-32687

    Insufficiently Protected ChatBot Credentials in tgstation-server

    tgstation-server is a toolset to manage production BYOND servers. Starting in version 4.7.0 and prior to 5.12.1, instance users with the list chat bots permission can read chat bot connections strings without the associated permission. This issue is patched i…

    tgstation tgstation-server