{"id":"CVE-2019-16097","details":"core/api/user.go in Harbor 1.7.0 through 1.8.2 allows non-admin users to create admin accounts via the POST /api/users API, when Harbor is setup with DB as authentication backend and allow user to do self-registration. Fixed version: v1.7.6 v1.8.3. v.1.9.0. Workaround without applying the fix: configure Harbor to use non-DB authentication backend such as LDAP.","aliases":["GHSA-9wvh-ff5f-xjpj","GO-2022-0818"],"modified":"2026-08-07T14:52:41.674155Z","published":"2019-09-08T16:15:11.820Z","references":[{"type":"ADVISORY","url":"http://www.vmware.com/security/advisories/VMSA-2019-0015.html"},{"type":"ADVISORY","url":"https://github.com/goharbor/harbor/releases/tag/v1.7.6"},{"type":"ADVISORY","url":"https://github.com/goharbor/harbor/releases/tag/v1.8.3"},{"type":"ADVISORY","url":"https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/"},{"type":"FIX","url":"https://github.com/goharbor/harbor/commit/b6db8a8a106259ec9a2c48be8a380cb3b37cf517"},{"type":"FIX","url":"https://github.com/goharbor/harbor/compare/v1.8.2...v1.9.0-rc1"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/goharbor/harbor","events":[{"introduced":"8017a20e0c04a66367d71d6a9ea80c8430ee51ef"},{"last_affected":"3ab5d5f0e55d905f5651ccc6c08ada719c26eb90"},{"fixed":"b6db8a8a106259ec9a2c48be8a380cb3b37cf517"},{"fixed":"afb558e7bcab81e98e56036f1e493cb5a3823a53"},{"fixed":"220e3dee88b561bd4a4a15bc6d0aaa83d63638b0"}],"database_specific":{"cpe":["cpe:2.3:a:linuxfoundation:harbor:1.7.0:-:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:harbor:1.7.0:rc1:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:harbor:1.7.0:rc2:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:harbor:1.7.1:*:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:harbor:1.7.2:*:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:harbor:1.7.3:*:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:harbor:1.7.4:*:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:harbor:1.7.5:*:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:harbor:1.8.0:-:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:harbor:1.8.0:rc1:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:harbor:1.8.0:rc2:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:harbor:1.8.1:*:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:harbor:1.8.2:-:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:harbor:1.8.2:rc2:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:harbor:1.8.2:rc1:*:*:*:*:*:*","cpe:2.3:a:linuxfoundation:harbor:1.9.0:rc1:*:*:*:*:*:*"],"extracted_events":[{"introduced":"1.7.0-NA"},{"last_affected":"1.7.0-NA"},{"introduced":"1.7.0-rc1"},{"last_affected":"1.7.0-rc1"},{"introduced":"1.7.0-rc2"},{"last_affected":"1.7.0-rc2"},{"introduced":"1.7.1"},{"last_affected":"1.7.1"},{"introduced":"1.7.2"},{"last_affected":"1.7.2"},{"introduced":"1.7.3"},{"last_affected":"1.7.3"},{"introduced":"1.7.4"},{"last_affected":"1.7.4"},{"introduced":"1.7.5"},{"last_affected":"1.7.5"},{"introduced":"1.8.0-NA"},{"last_affected":"1.8.0-NA"},{"introduced":"1.8.0-rc1"},{"last_affected":"1.8.0-rc1"},{"introduced":"1.8.0-rc2"},{"last_affected":"1.8.0-rc2"},{"introduced":"1.8.1"},{"last_affected":"1.8.1"},{"introduced":"1.8.2-NA"},{"last_affected":"1.8.2-NA"},{"introduced":"1.8.2-rc2"},{"last_affected":"1.8.2-rc2"},{"introduced":"1.8.2-rc1"},{"last_affected":"1.8.2-rc1"},{"introduced":"1.9.0-rc1"},{"last_affected":"1.9.0-rc1"}],"source":["CPE_STRING","REFERENCES"]}}],"versions":["1.7.0-NA","1.7.0-rc1","1.7.0-rc2","1.7.1","1.7.2","1.7.3","1.7.4","1.7.5","1.8.0-NA","1.8.0-rc1","1.8.0-rc2","1.8.1","1.8.2-NA","1.8.2-rc1","1.9.0-rc1","v1.7.5","v1.7.4","v1.7.3","v1.7.2","v1.7.1","v1.7.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-16097.json"}}],"schema_version":"1.8.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N"}]}