CVE-2026-55734: guardian from 2.0.0 (inclusive), before 2.4.1 (exclusive), 2.0.0 to before 2.4.1

Affected technology

guardian · from 2.0.0 (inclusive), before 2.4.1 (exclusive)
ueberauth

guardian · 2.0.0 to before 2.4.1
ueberauth

guardian · b7a6128ca4d0ffb7f7df5219dd982304ff9d6802 to before 8d4efbfc352d30f5fcfc75a4d69a795b0e472724
ueberauth

Component: 'Elixir.Guardian.Permissions'
Function: 'Elixir.Guardian.Permissions':encode_permissions!/1, 'Elixir.Guardian.Permissions':encode_permissions_into_claims!/2, 'Elixir.Guardian.Permissions':do_encode_permissions!/2, on
File: lib/guardian/permissions.ex

Attack conditions (Source advisory, CVSS 4.0): Local · No privileges required · No user interaction required

What an attacker can do

The source reports that an attacker could disrupt service. Source advisory’s CVSS 4.0 assessment (base score 6.9/10) rates confidentiality and integrity impact as none; availability impact as high.