CVE-2021-21246: OneDev REST user endpoint missing authorization leaks access tokens

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: high.

high priorityUnauthenticated network-reachable token disclosure with a CVSS of 7.5 and very high EPSS percentile, though no confirmed in-the-wild exploitation is documented.

What it is

OneDev before 4.0.3 fails to enforce an authorization check on the REST /users/{id} endpoint, while the UserResource listing endpoint does check for administrator privileges. An unauthenticated caller can retrieve arbitrary user details, including access tokens, exposing sensitive data.

Impact

An attacker obtains user access tokens that grant API access and HTTP(S) code cloning with the permissions of the affected account, including administrator impersonation.

Attack surface

Reachable over the network via the REST API with no authentication and no user interaction, per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Not listed in CISA KEV and no public exploit references are tagged, but EPSS is 0.49051 (98.8th percentile), indicating elevated predicted exploitation activity.

What to do

• Upgrade OneDev to 4.0.3 or later, which removes user info from the REST API.
• If immediate upgrade is not possible, restrict network access to the OneDev REST API to trusted sources.
• Rotate all user access tokens issued before remediation, prioritizing administrator accounts.
• Audit API and repository access logs for unauthorized /users/{id} requests.

Detection

• Monitor HTTP access logs for GET requests to /users/{id} from unauthenticated or unexpected clients.
• Alert on access token usage from new IP addresses or user agents following suspicious /users/{id} requests.
• Review repository clone and API activity for anomalous access patterns tied to exposed tokens.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.