{"schema_version": "1.6.1", "id": "CVE-2023-50783", "summary": "Improper access control vulnerability on the \"varimport\" endpoint", "details": "Apache Airflow, versions before 2.8.0, is affected by a vulnerability that allows an authenticated user without the variable edit permission, to update a variable.\nThis flaw compromises the integrity of variable management, potentially leading to unauthorized data modification.\nUsers are recommended to upgrade to 2.8.0, which fixes this issue", "affected": [{"ranges": [{"type": "SEMVER", "events": [{"introduced": "0"}, {"fixed": "2.8.0"}]}]}], "references": [{"type": "WEB", "url": "https://github.com/apache/airflow/pull/33932"}, {"type": "WEB", "url": "https://lists.apache.org/thread/rs7cr3yp726mb89s1m844hy9pq7frgcn"}]}