Getnora-io vulnerabilities
We track 1 vulnerability in Getnora-io products. 1 is rated high or critical, and none are known to be exploited. The most recent was published on October 28, 2026.
1vulnerabilities
0critical
1high
0exploited
7.1average CVSS score
Latest Getnora-io vulnerabilities
- 7.1 High severity
nora: Missing Authorization
NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-management UI but fails to require administrator authorization. `auth_middleware()` protects `/ui/tokens` and `/api/ui/tokens`, but state-ch