CVE-2024-50703: Teampass Auth Bypass Vulnerability

CVE-2024-50703 Overview

CVE-2024-50703 is a privilege escalation vulnerability affecting TeamPass, an open-source collaborative password manager. The vulnerability exists because TeamPass before version 3.1.3.1 does not properly prevent a user from acting with the privileges of a different user_id. This authorization bypass flaw allows authenticated attackers to perform actions as other users within the system, potentially gaining unauthorized access to sensitive password data and administrative functions.

Critical Impact

Authenticated users can impersonate other users and access or modify their stored credentials, compromising the integrity of the entire password management system.

Affected Products

• TeamPass versions prior to 3.1.3.1
• TeamPass version 3.1.3
• TeamPass version 3.1.2 and earlier

Discovery Timeline

• 2024-12-30 - CVE-2024-50703 published to NVD
• 2025-09-29 - Last updated in NVD database

Technical Details for CVE-2024-50703

Vulnerability Analysis

This vulnerability is classified under CWE-472 (External Control of Assumed-Immutable Web Parameter). The flaw resides in how TeamPass handles user identity during API requests. The application fails to properly validate that the user_id parameter in requests corresponds to the authenticated user's session, allowing attackers to manipulate this parameter to impersonate other users.

The vulnerability enables horizontal privilege escalation, where an authenticated user can perform actions on behalf of any other user in the system. In a password management context, this is particularly severe as attackers could potentially access, modify, or delete password entries belonging to other users, including administrators.

Root Cause

The root cause lies in the improper handling of user identity parameters in the users.js.php page and related query handlers. The application accepted a user-controllable id parameter without proper validation against the authenticated session, assuming the client would always send its own user ID. This assumption violates the principle of never trusting client-supplied data for authorization decisions.

Attack Vector

The attack is network-based and requires only low-privilege authentication. An attacker with a valid TeamPass account can exploit this vulnerability by:

1. Authenticating to TeamPass with their legitimate credentials
2. Intercepting or crafting API requests that include user identity parameters
3. Modifying the id parameter to specify a different user's ID
4. Executing actions (such as changing authentication settings) as the target user

The vulnerability requires no user interaction and can be exploited remotely over the network.

// Security patch showing the parameter rename fix
// Source: https://github.com/nilsteampassnet/TeamPass/commit/c7f7f809071eaa9e04505ee79cec7049a42959e9

// Before (vulnerable):
        var data = {
-            'id': $('.selected-user').data('user-id'),
+            'user_id': $('.selected-user').data('user-id'),
             'auth_type': auth
         };

Source: TeamPass Security Commit

The patch changes the parameter name from id to user_id, likely accompanied by server-side validation to ensure the requesting user can only modify their own settings.

Detection Methods for CVE-2024-50703

Indicators of Compromise

• API requests where the id or user_id parameter does not match the authenticated session's user ID
• Unusual modification of user authentication settings by users other than the account owner
• Access logs showing a single session performing actions across multiple user accounts
• Unexpected changes to password entries or user permissions without corresponding legitimate administrator activity

Detection Strategies

• Implement logging to compare the user_id in API requests against the authenticated session's identity
• Monitor for anomalous patterns where a single IP or session accesses resources belonging to multiple user accounts
• Deploy web application firewall (WAF) rules to flag requests with manipulated identity parameters
• Enable audit logging for all user-related modifications with session correlation

Monitoring Recommendations

• Review TeamPass access logs for requests containing user_id or id parameters that don't match the authenticated user
• Set up alerts for bulk or rapid changes to user authentication settings
• Monitor for privilege escalation patterns where standard users access administrative functions
• Correlate session tokens with user actions to identify impersonation attempts

How to Mitigate CVE-2024-50703

Immediate Actions Required

• Upgrade TeamPass to version 3.1.3.1 or later immediately
• Audit recent activity logs for signs of unauthorized user impersonation
• Review user permission changes and password access logs for anomalies
• Consider temporarily restricting access to TeamPass until the patch is applied
• Force password resets for sensitive accounts if compromise is suspected

Patch Information

The vulnerability is addressed in TeamPass version 3.1.3.1. The security patch is available via the official TeamPass GitHub repository. Version comparisons are available showing changes between 3.1.2 to 3.1.3.1 and 3.1.3 to 3.1.3.1.

Organizations should update to the latest version and verify the installation includes the security fix by checking the commit hash c7f7f809071eaa9e04505ee79cec7049a42959e9.

Workarounds

• If immediate patching is not possible, restrict network access to TeamPass to trusted IP ranges only
• Implement additional authentication layers such as VPN requirements for accessing TeamPass
• Enable verbose logging and actively monitor for parameter manipulation attempts
• Consider temporarily disabling user self-service features until the patch is applied

# Configuration example - Restrict access to TeamPass via web server
# Apache example: Allow only trusted networks
<Directory /var/www/teampass>
    Require ip 10.0.0.0/8
    Require ip 192.168.0.0/16
</Directory>

# Nginx example: Restrict to internal network
location /teampass {
    allow 10.0.0.0/8;
    allow 192.168.0.0/16;
    deny all;
}