CVE-2023-35167

CVE-2023-35167 is a medium-severity vulnerability affecting Remult, a full-stack TypeScript CRUD framework. It allows an authenticated attacker to bypass access controls when the apiPrefilter option of the @Entity decorator is set to a function, enabling unauthorized read, update, and delete access to entity instances if the attacker knows the instance's ID. The CVSS score is 6.3 (Medium) with a vector of AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L, indicating network-based, low-complexity exploitation by a low-privileged user, leading to partial confidentiality, integrity, and availability impacts. There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.