GCVE-110-CLOUD-2021-0021

Advisory Published

Vulnetix · Advisory published August 26, 2021

Azure's Cosmos DB database service was vulnerable to remote account takeover. Any Azure user could gain full admin access to other customers' Cosmos DB instances without authorization. The vulnerability had a trivial exploit that doesn't require any previous access to the target environment.

Download JSON Open in Console

Affected Products

Vendor	Product	Versions	Platforms
Azure	Cosmos DB	—	—
Azure	OMI	—	—

Aliases

CVE-2021-38645 CVE-2021-38647 CVE-2021-38648 CVE-2021-38649

References

OMIGOD

advisory

ChaosDB

advisory

Browse GCVE Records

74,352 records in the GCVE database · Updated July 22, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON