Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.8

Appwrite CLI Storing Sensitive Credentials in Accessible File

CVE-2023-50974 · published 2 years ago
Summary

The Appwrite CLI tool stores user credentials in a file on your computer that can be accessed by other users. This means that anyone with access to your computer can see your login details. Update to the latest version of the Appwrite CLI to fix this issue and protect your credentials.

What to do
  • Update GitHub Actions appwrite-cli to version 3.0.0.
  • Update appwrite team appwrite to version 3.0.0.
  • Update appwrite command_line_interface to version 3.0.0 or later.
Affected software
Ecosystem VendorProductAffected versions
npm GitHub Actions appwrite-cli < 3.0.0
Fix: upgrade to 3.0.0
– appwrite command_line_interface < 3.0.0
cpe:2.3:a:appwrite:command_line_interface:*:*:*:*:*:*:*:*
pip appwrite team appwrite < 3.0.0
Fix: upgrade to 3.0.0
Original advisory text
In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local sys...
In Appwrite CLI before 3.0.0, when using the login command, the credentials of the Appwrite user are stored in a ~/.appwrite/prefs.json file with 0644 as UNIX permissions. Any user of the local system can access those credentials.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.8 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-798Use of Hard-coded Credentials
Timeline
Published9 Jan 2024
Updated3 Nov 2026
First seen6 Mar 2026
Sources
GHSA-g777-crp9-m27g · GHSA
CVE-2023-50974 · NVD
Track software like this
Free during beta