CVE-2023-50236 is a High severity (CVSS 7.8) incorrect default permission flaw in Siemens Polarion ALM versions before V2404.0. Weak file and folder permissions in the installation path let a local attacker escalate to SYSTEM on Windows. Update to V2404.0 or later.
What's affected
Product: Siemens Polarion ALM, all versions before V2404.0. Fixed: V2404.0 or later, per Siemens advisory SSA-871717. The advisory was first published on 13 February 2024 and last updated on 14 May 2024 (version 1.2), and NVD published the record on 13 February 2024.
Severity: the advisory gives a CVSS 3.1 base score of 7.8 and a CVSS 4.0 base score of 8.5. The NVD record uses the 3.1 score, which is 7.8 High, with vector AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. Both are High.
Scope note: Siemens says Polarion installations on Linux are not affected by this issue. The permission problem applies to Windows installations. The same advisory also covers CVE-2024-23813, an authentication issue in the REST API endpoints of the DOORS connector, with its own mitigation.
How to check if you're exposed
On a Windows server running Polarion, check the permissions on the installation folders. The built in command line tool does this.
icacls "C:\path\to\Polarion"
Replace the path with your actual install location. Look for entries that grant the BUILTIN\Users group access to the folder tree. Siemens names that group specifically in its workaround. Also check the Polarion version in the application against V2404.0.
If you run Polarion on Linux, Siemens says no action is required for this CVE, though the version check for the companion CVE still applies.
What to do now
- Update Polarion ALM to V2404.0 or later, using the download location named in the Siemens advisory.
- Until you can update, restrict permissions of BUILTIN\Users on the entire Polarion installation folders in Windows, as Siemens recommends.
- Limit who can log in to the Polarion server at the operating system level, since the attacker needs local access.
- If you do not use the DOORS connector, limit unauthenticated access in the Apache configuration for the companion CVE-2024-23813, and if you do, restrict that endpoint to the IP address of your DOORS instance.
- Record the version in your asset inventory.
Why it matters
The weakness is CWE-276, incorrect default permissions. The installer sets file and folder permissions that are too open, so an ordinary local user can change files that a privileged service later runs or loads. Siemens describes the result as the ability to escalate to NT AUTHORITY\SYSTEM.
This class is easy to underestimate because it needs local access. In practice, local access is exactly what an attacker has after any first foothold, such as a phished account or a shared build server. A permissions bug turns that small foothold into full control of the host, and on a server that holds engineering requirements and traceability data the loss could be large.
KEV is false, and neither the record nor the Siemens advisory claims exploitation. The fix is a version update, and the workaround is a permissions change that costs little. Safeguard's free scan at gold.safeguard.sh/scan handles open source dependencies, and the Gold directory shows this CVE and its weakness class.
Quick check
Does this affect Polarion on Linux?
Siemens says Linux installations are not impacted, so no action is required for this CVE on Linux.
Can an attacker use this over the network?
Not by itself. The vector is local and needs a low privilege account on the machine.
Sources
Last reviewed: 19 October 2026.
