https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2025-57817.htmlhttps://patchthecve.com/cve/CVE-2025-57817.htmlWed, 17 Jun 2026 09:43:29 +0000HIGH 7.2: Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the OAuth client creation and update endpoints of the Fides Webserver API do not properly authorize scope assignment. This allows highly privileged users with `client:create` or `client:update` permissions to escalate thehttps://patchthecve.com/cve/CVE-2025-57816.htmlhttps://patchthecve.com/cve/CVE-2025-57816.htmlWed, 17 Jun 2026 09:43:29 +0000HIGH 7.5: Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Webserver API's built-in IP-based rate limiting is ineffective in environments with CDNs, proxies or load balancers. The system incorrectly applies rate limits based on directly connected infrastructure IPs rathhttps://patchthecve.com/cve/CVE-2025-57815.htmlhttps://patchthecve.com/cve/CVE-2025-57815.htmlWed, 17 Jun 2026 09:43:29 +0000MEDIUM 6.5: Fides is an open-source privacy engineering platform. Prior to version 2.69.1, the Fides Admin UI login endpoint relies on a general IP-based rate limit for all API traffic and lacks specific anti-automation controls designed to protect against brute-force attacks. This could allow attackers to condhttps://patchthecve.com/cve/CVE-2025-57766.htmlhttps://patchthecve.com/cve/CVE-2025-57766.htmlWed, 17 Jun 2026 09:43:23 +0000MEDIUM 4.8: Fides is an open-source privacy engineering platform. Prior to version 2.69.1, admin UI user password changes in Fides do not invalidate active user sessions, creating a vulnerability chaining opportunity where attackers who have obtained session tokens through other attack vectors (such as XSS) canhttps://patchthecve.com/cve/CVE-2024-52008.htmlhttps://patchthecve.com/cve/CVE-2024-52008.htmlWed, 17 Jun 2026 08:06:47 +0000HIGH 8.8: Fides is an open-source privacy engineering platform. The user invite acceptance API endpoint lacks server-side password policy enforcement, allowing users to set arbitrarily weak passwords by bypassing client-side validation. While the UI enforces password complexity requirements, direct API calls https://patchthecve.com/cve/CVE-2024-45053.htmlhttps://patchthecve.com/cve/CVE-2024-45053.htmlWed, 17 Jun 2026 07:53:30 +0000CRITICAL 9.1: Fides is an open-source privacy engineering platform. Starting in version 2.19.0 and prior to version 2.44.0, the Email Templating feature uses Jinja2 without proper input sanitization or rendering environment restrictions, allowing for Server-Side Template Injection that grants Remote Code Executiohttps://patchthecve.com/cve/CVE-2024-45052.htmlhttps://patchthecve.com/cve/CVE-2024-45052.htmlWed, 17 Jun 2026 07:53:29 +0000MEDIUM 5.3: Fides is an open-source privacy engineering platform. Prior to version 2.44.0, a timing-based username enumeration vulnerability exists in Fides Webserver authentication. This vulnerability allows an unauthenticated attacker to determine the existence of valid usernames by analyzing the time it takehttps://patchthecve.com/cve/CVE-2024-31223.htmlhttps://patchthecve.com/cve/CVE-2024-31223.htmlWed, 17 Jun 2026 07:28:00 +0000MEDIUM 5.3: Fides is an open-source privacy engineering platform, and `SERVER_SIDE_FIDES_API_URL` is a server-side configuration environment variable used by the Fides Privacy Center to communicate with the Fides webserver backend. The value of this variable is a URL which typically includes a private IP addreshttps://patchthecve.com/cve/CVE-2024-38537.htmlhttps://patchthecve.com/cve/CVE-2024-38537.htmlWed, 17 Jun 2026 07:40:29 +0000NONE 0.0: Fides is an open-source privacy engineering platform. `fides.js`, a client-side script used to interact with the consent management features of Fides, used the `polyfill.io` domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard. Th