Versions of OctoPrint prior to 1.8.3 did not require the current user password in order to change that users password. As a result users could be locked out of their accounts or have their accounts stolen under certain circumstances.
{ "nvd_published_at": "2022-08-22T12:15:00Z", "cwe_ids": [ "CWE-620" ], "severity": "MODERATE", "github_reviewed": true, "github_reviewed_at": "2022-08-30T20:25:13Z" }