CVE-2021-30164: 
Redmine vulnerability analysis and mitigation

CVE-2021-30164 is a high-severity vulnerability discovered in Redmine, affecting versions before 4.0.8 and 4.1.x before 4.1.2. The vulnerability was disclosed on April 6, 2021, and allows attackers to bypass the addissuenotes permission requirement by leveraging the Issues API (NVD, Redmine Security).

The vulnerability has been assigned a CVSS v3.1 base score of 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. This indicates that the vulnerability can be exploited over the network with low attack complexity, requires no privileges or user interaction, and can result in high impact to confidentiality, integrity, and availability (NVD).

The vulnerability allows unauthorized access to issue notes functionality through the Issues API, potentially compromising the security model of Redmine installations. This could lead to unauthorized users being able to add notes to issues despite not having the proper permissions (Redmine Security).

The vulnerability has been fixed in Redmine versions 4.0.8 and 4.1.2. Users are advised to upgrade to these or later versions. For Debian 9 stretch users, the fix is available in version 3.3.1-4+deb9u4 (Debian Advisory).