Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:pypi/rdiffweb@2.9.3
purl pkg:pypi/rdiffweb@2.9.3
Next non-vulnerable version 2.10.6
Latest non-vulnerable version 2.10.6
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-2n1n-8nzg-xuh3
Aliases:
CVE-2025-67796
GHSA-v4gp-hf5j-4566
IKUS Rdiffweb allows an attacker with any valid or stolen access token to act as other users IKUS Rdiffweb version 2.10.5 and below have an improper authorization flaw that allows an attacker with any valid or stolen access token to act as other users. The API does not enforce binding between the authenticated subject and the targeted user/tenant, so crafted requests can read or modify other users data and, in some cases, perform privileged actions. This issue may enable cross-tenant access. Fixed in version 2.10.6.
2.10.6
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-06T08:24:27.431990+00:00 GitLab Importer Affected by VCID-2n1n-8nzg-xuh3 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/pypi/rdiffweb/CVE-2025-67796.yml 38.6.0