Cloudanix VulnDB

GHSA-hvc7-763r-4f3h

High · 7.5

openssl-encrypt has no owner verification on key revocation — any client can revoke any key

CVSS

7.5

EPSS

—

Published

Apr 1, 2026

CISA due date

—

The record

The `revoke_key` method in `openssl_encrypt_server/modules/keyserver/service.py` at **lines 195-270** accepts a `client_id` parameter but never verifies that the requesting client is the same as `key.owner_client_id`.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities