Security readout for executives and security teams
Plain-English summary
Pomerium versions using affected Envoy builds could make wrong access decisions for specially crafted requests. If the deployment relies on path prefix policies, users may reach routes or protected content they should not access. The vendor patched this by upgrading Envoy in Pomerium 0.14.8 and 0.15.1.
Executive priority
Treat this as high priority for any Pomerium deployment guarding sensitive applications. The main business risk is unauthorized access caused by incorrect policy decisions, not service disruption. Patch or remove the trigger condition promptly, especially on externally reachable access proxies.
Technical view
CWE-863 incorrect authorization in Pomerium derives from Envoy authorization and routing issues CVE-2021-32777 and CVE-2021-32779. Affected ranges are >=0.11.0 <0.14.8 and >=0.15.0 <0.15.1. The issue is network reachable, unauthenticated, low complexity, and scoped to path prefix based policy use.
Likely exposure
Exposure is most likely in internet-facing or internal Pomerium deployments running affected versions with path prefix based policies protecting sensitive applications or routes. Deployments without path prefix policies are not described as triggerable by the source bundle.
Exploitation context
The CVE is not listed as KEV, and the supplied sources do not state active exploitation. The described attacker condition is a specially crafted network request causing incorrect authorization or routing decisions, with CVSS emphasizing confidentiality impact rather than integrity or availability.
Researcher notes
The source bundle clearly identifies affected versions, trigger condition, patch versions, CVSS, and upstream Envoy advisory links. It does not provide evidence of exploitation in the wild or broader affected products beyond Pomerium, so those should not be inferred.
Mitigation direction
- Upgrade Pomerium to 0.14.8, 0.15.1, or a later vendor-supported release.
- Remove path prefix based policies where immediate upgrade is not possible.
- Review Pomerium vendor guidance for any deployment-specific follow-up actions.
- Prioritize systems protecting sensitive internal applications or administrative routes.
Validation and detection
- Inventory Pomerium versions across production, staging, and edge access proxy deployments.
- Check policy configuration for path prefix based rules.
- Confirm affected versions are upgraded or path prefix policies removed.
- Review access logs for unexpected routing or authorization decisions around protected paths.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-39206 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 8.6 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N3.94Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
8.6HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-r222-74fw-jqr9CVE reference · x_refsource_MISC
- https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8hCVE reference · x_refsource_MISC
- https://groups.google.com/g/envoy-announce/c/5xBpsEZZDfE/m/wD05NZBbAgAJCVE reference · x_refsource_MISC
- https://github.com/pomerium/pomerium/security/advisories/GHSA-cfc2-wjcm-c8fmCVE reference · x_refsource_CONFIRM
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.