CVE-2022-29773: Aleksis

Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days.

An access control issue in aleksis/core/util/auth_helpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set.

Affected products

• Aleksis Aleksis: before 2.8.2 (fixed in 2.8.2)

Published 2022-06-03. Last modified 2026-06-17.