Improper access control in Harbor - CVE-2019-16097
Published: September 24, 2019 / Updated: April 7, 2026
Vulnerability identifier: #VU21322
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-16097
CWE-ID: CWE-284
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions within "core/api/user.go" when processing HTTP POST requests to "/api/users" API, when Harbor is configured to use DB as authentication backend. A remote non-authenticated attacker can send a specially crafted HTTP request to the vulnerable API endpoint and create an administrative user account.
Affected software
Harbor
VMware Harbor Container Registry for PCF
VMware Harbor Container Registry for PCF
How to mitigate CVE-2019-16097
Install updates from vendor's website.
Harbor - addressed in versions 1.7.6, 1.8.3
VMware Harbor Container Registry for PCF - addressed in versions 1.7.6, 1.8.3
VMware Harbor Container Registry for PCF - addressed in versions 1.7.6, 1.8.3
External References
- https://github.com/goharbor/harbor/commit/b6db8a8a106259ec9a2c48be8a380cb3b37cf517
- https://github.com/goharbor/harbor/compare/v1.8.2...v1.9.0-rc1
- https://github.com/goharbor/harbor/releases/tag/v1.7.6
- https://github.com/goharbor/harbor/releases/tag/v1.8.3
- https://unit42.paloaltonetworks.com/critical-vulnerability-in-harbor-enables-privilege-escalation-from-zero-to-admin-cve-2019-16097/
- https://github.com/goharbor/harbor/security/advisories/GHSA-fqvr-xx6w-m6m7