CVE-2021-36230

CVE-2021-36230 is a critical authorization bypass vulnerability affecting HashiCorp Terraform Enterprise versions up to v202106-1. It allowed an attacker to escalate privileges to organization owner by exploiting improper authorization checks on specific API requests made with a run token. Rated with a CVSS score of 8.8 (High), this vulnerability has a network attack vector and low attack complexity, enabling a remote attacker with low privileges to achieve high impact across confidentiality, integrity, and availability. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion surrounding this CVE. HashiCorp released a fix in v202107-1.