Mage-ai missing user authentication
Date: 2023-05
Affected: pip/mage-ai
Attack vector: auth-bypass
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2023-31143
CWE: CWE-306
CVSS: 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N)

### Impact You may be impacted if you're using Mage with user authentication enabled. The terminal could be accessed by users who are not signed in or do not have editor permissions. ### Patches The vulnerability has been resolved in Mage version 0.8.72.


Mitigations:

Architectural layers (MAESTRO):