Description
A race condition exists in Audited 4.0.0 before 5.3.3 that can result in an authenticated user to cause audit log entries to be attributed to another user.
Affected products
collectiveidea: audited
References10
- github.com/collectiveidea/audited/issues/601 Issue TrackingPatchVendor Advisory
- github.com/collectiveidea/audited/security/advisories/GHSA-hjp3… Vendor Advisory
- github.com/collectiveidea/audited/issues/601 Issue TrackingPatchVendor Advisory
- github.com/collectiveidea/audited/security/advisories/GHSA-hjp3… Vendor Advisory
- github.com/collectiveidea/audited/pull/669 Patch
- github.com/collectiveidea/audited/pull/671 Patch
- github.com/collectiveidea/audited/pull/669 Patch
- github.com/collectiveidea/audited/pull/671 Patch
- github.com/advisories/GHSA-hjp3-5g2q-7jww Third Party Advisory
- vulncheck.com/advisories/vc-advisory-GHSA-hjp3-5g2q-7jww Third Party Advisory
Metrics
- CVSS 3.1
-
3.1
LOW
Score source: NVD
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:N - EPSS — exploit probability
- 0% percentile: 43 · as of 5 November 2026
- CWE
- CWE-362
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.