← CVEs and Advisories

CVE-2026-63013

NationalSecurityAgency/skills-service · Severity High (CVSS 8.8) · Discovered by Pavan Nallamothu

Status: GitHub Security Advisory GHSA-67x3-r85f-822r published 2026-07-16 by the National Security Agency, carrying this CVE ID and crediting pavanchow as finder. The CVE record itself is not yet published in the registry.

A low-privilege user could assign themselves to an administrative group, escalating to full administrative control of the NSA skills-service application.

Summary

Privilege escalation via unauthorized admin-group assignment.

References

GitHub Security Advisory GHSA-67x3-r85f-822r (published advisory, names this CVE ID and credits pavanchow as finder) · CVE registry record: pending publication