nora vulnerabilities

1 known vulnerability in nora from Getnora-io. 1 is rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.1 High severity

  nora: Missing Authorization

  CVE-2026-59164Oct 28, 2026Getnora-io

  NORA is a self-hosted artifact registry and pull-through cache. Prior to 0.9.5, `nora-registry` authenticates the token-management UI but fails to require administrator authorization. `auth_middleware()` protects `/ui/tokens` and `/api/ui/tokens`, but state-ch