x/vulndb: potential Go vuln in github.com/KubeOperator/kubepi: GHSA-757p-vx43-fp9r

[GoVulnBot]

In GitHub Security Advisory GHSA-757p-vx43-fp9r, there is a vulnerability in the following Go packages or modules:

Unit	Fixed	Vulnerable Ranges
github.com/KubeOperator/kubepi	1.6.5	< 1.6.5

Cross references:

• Module github.com/KubeOperator/kubepi appears in issue x/vulndb: potential Go vuln in github.com/KubeOperator/kubepi: GHSA-vjhf-8vqx-vqpq #1283 NOT_IMPORTABLE
• Module github.com/KubeOperator/kubepi appears in issue x/vulndb: potential Go vuln in github.com/KubeOperator/kubepi: GHSA-gqx8-hxmv-c4v4 #1463 NOT_IMPORTABLE
• Module github.com/KubeOperator/kubepi appears in issue x/vulndb: potential Go vuln in github.com/KubeOperator/kubepi: GHSA-v4w5-r2xc-7f8h #1468 NOT_IMPORTABLE

See doc/triage.md for instructions on how to triage this report.

modules:
    - module: github.com/KubeOperator/kubepi
      versions:
        - fixed: 1.6.5
      vulnerable_at: 1.6.4
      packages:
        - package: github.com/KubeOperator/kubepi
summary: KubePi Privilege Escalation vulnerability
description: |-
    ### Summary A normal user has permission to create/update users, they can become
    admin by editing the `isadmin` value in the request

    ### PoC Change the value of the `isadmin` field in the request to true:
    https://drive.google.com/file/d/1e8XJbIFIDXaFiL-dqn0a0b6u7o3CwqSG/preview

    ### Impact Elevate user privileges
cves:
    - CVE-2023-37917
ghsas:
    - GHSA-757p-vx43-fp9r
references:
    - advisory: https://github.com/1Panel-dev/KubePi/security/advisories/GHSA-757p-vx43-fp9r
    - web: https://drive.google.com/file/d/1e8XJbIFIDXaFiL-dqn0a0b6u7o3CwqSG/preview
    - web: https://github.com/1Panel-dev/KubePi/releases/tag/v1.6.5
    - advisory: https://github.com/advisories/GHSA-757p-vx43-fp9r

[gopherbot]

Change https://go.dev/cl/514636 mentions this issue: data/excluded: batch add 31 excluded reports

[gopherbot]

Change https://go.dev/cl/592762 mentions this issue: data/reports: unexclude 75 reports

[gopherbot]

Change https://go.dev/cl/606789 mentions this issue: data/reports: unexclude 20 reports (9)