CWE-672: Operation on a Resource after Expiration or Release
Class
The product uses, accesses, or otherwise operates on a resource after that resource has been expired, released, or revoked.
Consequences
- Integrity, Confidentiality: Modify Application Data, Read Application Data
- Other, Availability: Other, DoS: Crash, Exit, or Restart
Recent advisories
- GHSA-2vg6-77g8-24mp — Better Auth: Stale sessions persist after user deletion across admin, anonymous, and SCIM flows
- GHSA-2gf8-q9rr-jq3h — zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip
- GHSA-hw87-6jcq-9f8q — Mattermost doesn't enforce the PostEditTimeLimit on non-message post fields
- GHSA-q8ff-7ffm-m3r9 — OpenClaw's Webhooks SecretRef route secret remains valid after rotation/reload
- GHSA-xmxx-7p24-h892 — OpenClaw: Gateway HTTP endpoints re-resolve bearer auth after SecretRef rotation
- GHSA-4hf6-3x24-c9m8 — Parse Server's MFA recovery codes not consumed after use
- GHSA-j477-6vpg-6c8x — Juju has broken CMR authorization
- GHSA-655h-hg88-5qmf — Rust XCB `xcb::Connection::connect_to_fd*` functions violate I/O safety
- GHSA-fm79-3f68-h2fc — Wasmtime CLI is vulnerable to host panic through its fd_renumber function
- GHSA-56p6-qw3c-fq2g — Suspended Directus user can continue to use session token to access API
- GO-2024-3138 — ZITADEL Allows Unauthorized Access After Organization or Project Deactivation
- GO-2024-3139 — ZITADEL's Service Users Deactivation not Working
- GO-2024-3137 — ZITADEL's User Grant Deactivation not Working
- GHSA-w3q8-m492-4pwp — Possibility to circumvent the invitation token expiry period
- GHSA-2xm2-xj2q-qgpj — receiving subscription objects with deleted session
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor