Rancher Labs rancher server 1.2.0+ is vulnerable to authenticated users disabling access control via an API call. This is fixed in versions rancher/server:v1.2.4, rancher/server:v1.3.5, rancher/server:v1.4.3, and rancher/server:v1.5.3.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Rancher | Suse | 1.2.0 (including) | 1.2.4 (excluding) |
| Rancher | Suse | 1.3.0 (including) | 1.3.5 (excluding) |
| Rancher | Suse | 1.4.0 (including) | 1.4.3 (excluding) |
| Rancher | Suse | 1.5.0 (including) | 1.5.3 (excluding) |