CVE-2026-44884

Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8 and 2.39.1, a missing authorization vulnerability in the Custom Template file endpoint (GET /api/custom_templates/{id}/file) allows any authenticated user to read the file content of any custom template by enumerating sequential integer IDs, bypassing Resource Control access restrictions. Template files may contain environment-specific values such as connection strings, API tokens, or registry credentials that administrators would not expect standard users to read. This vulnerability is fixed in 2.33.8 and 2.39.1.

CVSS v3 6.5 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.8 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/portainer/portainer/security/advisories/GHSA-cqpq-2fgr-8mvc	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:portainer:portainer:::::community:::*
	cpe:2.3:a:portainer:portainer:::::community:::*

History

No history.

Information

Published : 2026-05-28 22:16

Updated : 2026-07-21 10:10

NVD link : CVE-2026-44884

Mitre link : CVE-2026-44884

CVE.ORG link : CVE-2026-44884

JSON object : View

Products Affected

portainer

portainer

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-44884", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-44884", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-05-29T13:55:28.420055Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.0, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "portainer", "product": "portainer", "versions": [{"status": "affected", "version": ">= 2.33.0, < 2.33.8"}, {"status": "affected", "version": ">= 2.39.0, < 2.39.1"}]}]}], "published": "2026-05-28T22:16:59.677", "references": [{"url": "https://github.com/portainer/portainer/security/advisories/GHSA-cqpq-2fgr-8mvc", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Portainer Community Edition is a lightweight service delivery platform for containerized applications that can be used to manage Docker, Swarm, Kubernetes and ACI environments. From 2.33.0 to before 2.33.8 and 2.39.1, a missing authorization vulnerability in the Custom Template file endpoint (GET /api/custom_templates/{id}/file) allows any authenticated user to read the file content of any custom template by enumerating sequential integer IDs, bypassing Resource Control access restrictions. Template files may contain environment-specific values such as connection strings, API tokens, or registry credentials that administrators would not expect standard users to read. This vulnerability is fixed in 2.33.8 and 2.39.1."}, {"lang": "es", "value": "Portainer Community Edition es una plataforma ligera de entrega de servicios para aplicaciones contenerizadas que puede utilizarse para gestionar entornos Docker, Swarm, Kubernetes y ACI. Desde la versi\u00f3n 2.33.0 hasta antes de la 2.33.8 y la 2.39.1, una vulnerabilidad de autorizaci\u00f3n faltante en el endpoint de archivo de plantilla personalizada (GET /API/custom_templates/{id}/file) permite a cualquier usuario autenticado leer el contenido del archivo de cualquier plantilla personalizada enumerando IDs enteros secuenciales, eludiendo las restricciones de acceso de Resource Control. Los archivos de plantilla pueden contener valores espec\u00edficos del entorno, como cadenas de conexi\u00f3n, tokens de API o credenciales de registro que los administradores no esperar\u00edan que los usuarios est\u00e1ndar leyeran. Esta vulnerabilidad est\u00e1 corregida en las versiones 2.33.8 y 2.39.1."}], "lastModified": "2026-07-21T10:10:00.103", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "4E7FE81D-D489-4034-9DB4-D48E3B6C3CE4", "versionEndExcluding": "2.33.8", "versionStartIncluding": "2.33.0"}, {"criteria": "cpe:2.3:a:portainer:portainer:*:*:*:*:community:*:*:*", "vulnerable": true, "matchCriteriaId": "69AF042A-AD6A-4580-9862-B9C1E54946DF", "versionEndExcluding": "2.39.1", "versionStartIncluding": "2.39.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}