CVE-2021-47721

Orangescrum 1.8.0 Authenticated Privilege Escalation via User Session Manipulation

Orangescrum 1.8.0 contains a privilege escalation vulnerability that allows authenticated users to take over other project-assigned accounts by manipulating session cookies. Attackers can extract the victim's unique ID from the page source and replace their own session cookie to gain unauthorized access to another user's account.

Affected

Orangescrum · orangescrum

CVSS v4.0 VULNCHECK

8.7 HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CVSS v3.1 VULNCHECK

8.8 HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS

0.46% chance of exploitation in the next 30 days, 38th percentile

Published

2025-12-23

Updated

2026-03-05

Proof-of-concept exploits (1)

• https://www.exploit-db.com/exploits/50551

Security advisories

• https://www.vulncheck.com/advisories/orangescrum-authenticated-privilege-escalation-via-u…
• https://www.orangescrum.org

References

• CVE Record
• NVD entry