Cloudanix VulnDB

GHSA-w24r-5266-9c3c

High · 8.1

CVSS

8.1

EPSS

—

Published

Apr 30, 2026

CISA due date

—

The record

Clerk has an authorization bypass when combining organization, billing, or reverification checks

Affected packages

Ecosystem Package Introduced Fixed
npm @clerk/astro 2.0.0 2.17.11
npm @clerk/astro 3.0.0 3.0.18
npm @clerk/backend 2.0.0 2.33.3
npm @clerk/backend 3.0.0 3.2.14
npm @clerk/chrome-extension 1.3.5 2.9.15
npm @clerk/chrome-extension 3.0.0 3.1.15
npm @clerk/clerk-expo 2.2.11 2.19.36
npm @clerk/clerk-js 5.22.0 5.125.10
npm @clerk/clerk-js 6.0.0 6.7.5
npm @clerk/clerk-react 5.9.0 5.61.6
npm @clerk/expo 3.0.0 3.2.2
npm @clerk/express 0.1.0 1.7.79
npm @clerk/express 2.0.0 2.1.6
npm @clerk/fastify 1.0.42 2.6.31
npm @clerk/fastify 3.0.0 3.1.16
npm @clerk/hono 0.0.2 0.1.16
npm @clerk/nextjs 6.0.0 6.39.3
npm @clerk/nextjs 7.0.0 7.2.4
npm @clerk/nuxt 1.0.0 1.13.29
npm @clerk/nuxt 2.0.0 2.2.5
npm @clerk/react 6.0.0 6.4.3
npm @clerk/react-router 0.0.1 2.4.13
npm @clerk/react-router 3.0.0 3.1.4
npm @clerk/shared 3.0.0 3.47.5
npm @clerk/shared 4.0.0 4.8.3
npm @clerk/tanstack-react-start 0.0.1 0.29.11
npm @clerk/tanstack-react-start 1.0.0 1.1.4
npm @clerk/vue 1.0.0 1.17.21
npm @clerk/vue 2.0.0 2.0.16

Related vulnerabilities