{"id":"GHSA-8cfq-jgf7-8m27","summary":"traQ: Privilege escalation by OAuth prompt=none request","details":"In OAuth2 silent authorization (`prompt=none`), when the `scope` parameter was empty or omitted, all scopes registered for the OAuth client became eligible for issuance. However, the prior consent check was performed against the empty requested scope set. As a result, an attacker could obtain an access token with broader scopes than the user had previously consented to, without requiring additional consent.\n\n## Impact\n\nIf an attacker controls an OAuth client capable of receiving authorization codes, and a user has already consented to only a subset of that client’s scopes, the attacker may be able to obtain a token containing all scopes registered for that client by sending an authorization request with `prompt=none` and an empty or omitted `scope`.\n\nIf the user has not consented to the client at all, `consent_required` is returned as usual.\n\n## Patches\n\nThis issue has been fixed in v3.28.3. After the fix, the consent check for `prompt=none` verifies the scopes that will actually be issued, rather than the empty requested scope set. If the user has not consented to all scopes after expansion, `consent_required` is returned.\n\ntraQ also recommends revoking any existing OAuth tokens created before the fix if they were potentially affected.\n\n## Workarounds\n\nIf users cannot update immediately, they should apply the following mitigations:\n\n- Disable untrusted OAuth clients, minimize registered client scopes, and revoke existing tokens\n- Reject authorization requests with `prompt=none` where `scope` is empty or omitted","aliases":["CVE-2026-63198"],"modified":"2026-11-09T21:00:04.049318937Z","published":"2026-11-09T20:55:17Z","database_specific":{"nvd_published_at":"2026-11-03T19:18:09Z","cwe_ids":["CWE-863"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-11-09T20:55:17Z"},"references":[{"type":"WEB","url":"https://github.com/traPtitech/traQ/security/advisories/GHSA-8cfq-jgf7-8m27"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-63198"},{"type":"WEB","url":"https://github.com/traPtitech/traQ/commit/5510fe8aa9bb15fc4755c78792381dbb03d576c3"},{"type":"PACKAGE","url":"https://github.com/traPtitech/traQ"},{"type":"WEB","url":"https://github.com/traPtitech/traQ/releases/tag/v3.28.3"}],"affected":[{"package":{"name":"github.com/traPtitech/traQ","ecosystem":"Go","purl":"pkg:golang/github.com/traPtitech/traQ"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.0.0-rc.2.0.20260629134940-5510fe8aa9bb"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/11/GHSA-8cfq-jgf7-8m27/GHSA-8cfq-jgf7-8m27.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N"}]}