High severity7.3NVD Advisory· Published Jul 3, 2023· Updated Jun 17, 2026
CVE-2023-36815
CVE-2023-36815
Description
Sealos is a Cloud Operating System designed for managing cloud-native applications. In version 4.2.0 and prior, there is a permission flaw in the Sealos billing system, which allows users to control the recharge resource account sealos[.] io/v1/Payment, resulting in the ability to recharge any amount of 1 renminbi (RMB). The charging interface may expose resource information. The namespace of this custom resource would be user's control and may have permission to correct it. It is not clear whether a fix exists.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
github.com/labring/sealosGo | <= 4.2.0 | — |
Affected products
3Patches
Vulnerability mechanics
References
3- github.com/advisories/GHSA-vpxf-q44g-w34wghsaADVISORY
- github.com/labring/sealos/security/advisories/GHSA-vpxf-q44g-w34wnvdThird Party AdvisoryWEB
- nvd.nist.gov/vuln/detail/CVE-2023-36815ghsaADVISORY
News mentions
0No linked articles in our index yet.