CVE-2021-38616: Eigentech Natural Language Processing

High severity, CVSS 8.8. EPSS: 1.3% chance of exploitation in the next 30 days.

In Eigen NLP 3.10.1, a lack of access control on the /auth/v1/user/{user-guid}/ user edition endpoint could permit any logged-in user to increase their own permissions via a user_permissions array in a PATCH request. A guest user could modify other users' profiles and much more.

Affected products

• Eigentech Natural Language Processing: version 3.10.1 only

Published 2021-09-07. Last modified 2026-06-17.