Vulnerability · Published Dec 23, 2025 · Assigned by VulnCheck
CVE-2021-47721Orangescrum 1.8.0 Authenticated Privilege Escalation via User Session Manipulation
High 8.8
In plain English
A high-severity authorization bypass via user-controlled key in orangescrum from Orangescrum. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities).
Severity (CVSS 3.1)8.8High
Exploit odds (30 days)0.5%top 60.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Orangescrum 1.8.0 contains a privilege escalation vulnerability that allows authenticated users to take over other project-assigned accounts by manipulating session cookies. Attackers can extract the victim's unique ID from the page source and replace their own session cookie to gain unauthorized access to another user's account.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Orangescrum | orangescrum | 1.8.0 |
Weakness: CWE-639 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
References
- ExploitDB-50551 exploit
- Official Product Homepage product
- VulnCheck Advisory: Orangescrum 1.8.0 Authenticated Privilege Escalation via User Session Manipulation third-party-advisory