Vulnerability record · CVE-2022-31155 · published 1 August 2022

CVE-2022-31155: Sourcegraph incorrect authorization vulnerability

Sourcegraph · Sourcegraph

Sourcegraph is an opensource code search and navigation engine. In Sourcegraph versions before 3.41.0, it is possible for an attacker to delete other users’ saved searches due to a bug in the authorization check. The vulnerability does not allow the reading of other users’ saved searches, only overwriting them with attacker-controlled searches. The issue is patched in Sourcegraph version 3.41.0. There is no workaround for this issue and updating to a secure version is highly recommended.

4.3 CVSS 3.1 Medium EPSS 0.49% · top 60.2% CWE-863 · Incorrect authorization

4.3CVSS 3.1 base score

0.49%EPSS exploitation probability, 30 days

NoNot in CISA KEV

1Affected product versions listed by NVD

4References

17 Jun 2026Last modified by NVD

Description

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

Sourcegraph Sourcegraph

References

Link	Tags
https://github.com/sourcegraph/sourcegraph/commit/2832d7882396a6295ba5803b5ef48dc7d5a24c59	PatchThird Party Advisory
https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-37qp-9jq6-f6mx	Third Party Advisory
https://github.com/sourcegraph/sourcegraph/commit/2832d7882396a6295ba5803b5ef48dc7d5a24c59	PatchThird Party Advisory
https://github.com/sourcegraph/sourcegraph/security/advisories/GHSA-37qp-9jq6-f6mx	Third Party Advisory

Track CVE-2022-31155 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

8.8CVE-2022-23642Sourcegraph gitserver git config injection enables remote code executionSourcegraph before 3.37 fails to restrict calls to `git config` in its gitserver service, which acts as a git exec proxy. An attacker can set the `co…EPSS 74%analysed18 Feb 2022 7.8CVE-2022-41942Sourcegraph improper input validation vulnerabilitySourcegraph is a code intelligence platform. In versions prior to 4.1.0 a command Injection vulnerability existed in the gitserver service, present i…EPSS 2.8%22 Nov 2022 7.2CVE-2022-41943Sourcegraph incorrect default permissions vulnerabilitysourcegraph is a code intelligence platform. As a site admin it was possible to execute arbitrary commands on Gitserver when the experimental `custom…EPSS 1.8%22 Nov 2022 7.2CVE-2022-29171Sourcegraph injection vulnerabilitySourcegraph is a fast and featureful code search and navigation engine. Versions before 3.38.0 are vulnerable to Remote Code Execution in the gitserv…EPSS 1.4%6 May 2022 6.5CVE-2022-23643Sourcegraph information exposure vulnerabilitySourcegraph is a code search and navigation engine. Sourcegraph versions 3.35 and 3.36 reintroduced a previously fixed side-channel vulnerabilitity i…EPSS 0.80%15 Feb 2022 6.5CVE-2021-43823Sourcegraph information exposure vulnerabilitySourcegraph is a code search and navigation engine. Sourcegraph prior to version 3.33.2 is vulnerable to a side-channel attack where strings in priva…EPSS 0.84%13 Dec 2021 6.1CVE-2020-12283Sourcegraph open redirect vulnerabilitySourcegraph before 3.15.1 has a vulnerable authentication workflow because of improper validation in the SafeRedirectURL method in cmd/frontend/auth/…EPSS 1.3%30 Apr 2020 4.3CVE-2022-31154Sourcegraph incorrect authorization vulnerabilitySourcegraph is an opensource code search and navigation engine. It is possible for an authenticated Sourcegraph user to edit the Code Monitors owned …EPSS 0.49%1 Aug 2022

Source: NIST National Vulnerability Database (record CVE-2022-31155), CISA KEV, FIRST EPSS (scores of 2026-09-27). This page is refreshed as NVD updates the record.