Vulnerability-Lookup

GHSA-8R96-J25H-HJ4G

Vulnerability from github – Published: 2022-05-24 22:28 – Updated: 2022-05-24 22:28

Details

The check-in record page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID and date in specific parameters to access particular employee’s check-in record.

Severity

4.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2021-37213"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639",
      "CWE-706"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-08-09T10:15:00Z",
    "severity": "MODERATE"
  },
  "details": "The check-in record page of Flygo contains Insecure Direct Object Reference (IDOR) vulnerability. After being authenticated as a general user, remote attackers can manipulate the employee ID and date in specific parameters to access particular employee\u2019s check-in record.",
  "id": "GHSA-8r96-j25h-hj4g",
  "modified": "2022-05-24T22:28:27Z",
  "published": "2022-05-24T22:28:27Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-37213"
    },
    {
      "type": "WEB",
      "url": "https://www.twcert.org.tw/tw/cp-132-4990-0c75d-1.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8RF9-C59G-F82F

Vulnerability from github – Published: 2026-03-06 23:55 – Updated: 2026-03-09 13:21

Summary

WeKnora has Unauthorized Cross‑Tenant Knowledge Base Cloning

Details

Summary

A cross-tenant authorization bypass in the knowledge base copy endpoint allows any authenticated user to clone (duplicate) another tenant’s knowledge base into their own tenant by knowing/guessing the source knowledge base ID. This enables bulk data exfiltration (document/FAQ content) across tenants, making the impact critical.

Details

The POST /api/v1/knowledge-bases/copy endpoint enqueues an asynchronous KB clone task using the caller-supplied source_id without verifying ownership (see internal/handler/knowledgebase.go).

// Create KB clone payload
payload := types.KBClonePayload{
  TenantID: tenantID.(uint64),
  TaskID:   taskID,
  SourceID: req.SourceID, // from attacker's input
  TargetID: req.TargetID,
}

payloadBytes, err := json.Marshal(payload)
if err != nil {
  logger.Errorf(ctx, "Failed to marshal KB clone payload: %v", err)
  c.Error(errors.NewInternalServerError("Failed to create task"))
  return
}

// Enqueue KB clone task to Asynq
task := asynq.NewTask(types.TypeKBClone, payloadBytes,
asynq.TaskID(taskID), asynq.Queue("default"), asynq.MaxRetry(3)) // enqueue task
info, err := h.asynqClient.Enqueue(task)
if err != nil {
  logger.Errorf(ctx, "Failed to enqueue KB clone task: %v", err)
  c.Error(errors.NewInternalServerError("Failed to enqueue task"))
  return
}

Then, the asynq task handler (ProcessKBClone) invokes the CopyKnowledgeBase service method to perform the clone operation (see internal/application/service/knowledge.go):

// Get source and target knowledge bases
srcKB, dstKB, err := s.kbService.CopyKnowledgeBase(ctx, payload.SourceID, payload.TargetID)
if err != nil {
    logger.Errorf(ctx, "Failed to copy knowledge base: %v", err)
    handleError(progress, err, "Failed to copy knowledge base configuration")
    return err
}

After that, the CopyKnowledgeBase method calls the repository method to load the source knowledge base (see internal/application/service/knowledgebase.go):

func (s *knowledgeBaseService) CopyKnowledgeBase(ctx context.Context,
    srcKB string, dstKB string,
) (*types.KnowledgeBase, *types.KnowledgeBase, error) {
    sourceKB, err := s.repo.GetKnowledgeBaseByID(ctx, srcKB)
    if err != nil {
        logger.Errorf(ctx, "Get source knowledge base failed: %v", err)
        return nil, nil, err
    }
    sourceKB.EnsureDefaults()
    tenantID := ctx.Value(types.TenantIDContextKey).(uint64)
    var targetKB *types.KnowledgeBase
    if dstKB != "" {
        targetKB, err = s.repo.GetKnowledgeBaseByID(ctx, dstKB)
        // ...
    }
    // ...
}

Note: until now, the tenant ID is correctly set in context to the attacker’s tenant (from the payload), which can be used to prevent cross-tenant access.

However, the repository method GetKnowledgeBaseByID loads knowledge bases by id only, allowing cross-tenant reads (see internal/application/repository/knowledgebase.go).

func (r *knowledgeBaseRepository) GetKnowledgeBaseByID(ctx context.Context, id string) (*types.KnowledgeBase, error) {
    var kb types.KnowledgeBase
    if err := r.db.WithContext(ctx).Where("id = ?", id).First(&kb).Error; err != nil {
        if errors.Is(err, gorm.ErrRecordNotFound) {
            return nil, ErrKnowledgeBaseNotFound
        }
        return nil, err
    }
    return &kb, nil
}

The data access layer fails to enforce tenant isolation because GetKnowledgeBaseByID only filters by ID and ignores the tenant_id present in the context. A secure implementation should enforce a tenant-scoped lookup (e.g., WHERE id = ? AND tenant_id = ?) or use a tenant-aware repository API to prevent cross-tenant access.

Service shallow-copies the KB configuration by calling GetKnowledgeBaseByID(ctx, srcKB) for the source KB, then creates a new KB under the attacker’s tenant while copying fields from the victim KB (internal/application/service/knowledgebase.go):

sourceKB, err := s.repo.GetKnowledgeBaseByID(ctx, srcKB) // not tenant-scoped
...
targetKB = &types.KnowledgeBase{
    ID:                    uuid.New().String(),
    Name:                  sourceKB.Name,
    Type:                  sourceKB.Type,
    Description:           sourceKB.Description,
    TenantID:              tenantID,
    ChunkingConfig:        sourceKB.ChunkingConfig,
    ImageProcessingConfig: sourceKB.ImageProcessingConfig,
    EmbeddingModelID:      sourceKB.EmbeddingModelID,
    SummaryModelID:        sourceKB.SummaryModelID,
    VLMConfig:             sourceKB.VLMConfig,
    StorageConfig:         sourceKB.StorageConfig,
    FAQConfig:             faqConfig,
}
targetKB.EnsureDefaults()
  if err := s.repo.CreateKnowledgeBase(ctx, targetKB); err != nil {
      return nil, nil, err
  }
}

PoC

Precondition: Attacker is authenticated in Tenant A and can obtain (or guess) a victim's knowledge base UUID belonging to Tenant B.

1) Authenticate as Tenant A and obtain a bearer token or API key.

2) Start a cross-tenant clone using the victim’s knowledge base ID as source_id:

curl -X POST http://localhost:8088/api/v1/knowledge-bases/copy \
  -H "Authorization: Bearer <ATTACKER_TOKEN>" \
  -H "Content-Type: application/json" \
  -d '{"source_id":"<VICTIM_KB_UUID>","target_id":""}'

3) Observe that the task is accepted: - HTTP 200 OK - Response contains a task_id and a message like "Knowledge base copy task started".

4) After the async task completes, a new knowledge base appears under Tenant A containing copied content/config from Tenant B.

Note: the copy can succeed even when models referenced by the source KB do not exist in the attacker tenant, indicating the workflow does not validate model ownership during copy.

PoC Video:

https://github.com/user-attachments/assets/8313fa44-5d5d-43f4-8ebd-f465c5a9d56e

Impact

This is a Broken Access Control (BOLA/IDOR) vulnerability enabling cross-tenant data exfiltration:

Any authenticated user can trigger a clone of a victim tenant’s knowledge base into their own tenant.
Results in bulk disclosure/duplication of knowledge base contents (documents/FAQ entries/chunks), plus associated configuration.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.2.14"
      },
      "package": {
        "ecosystem": "Go",
        "name": "github.com/Tencent/WeKnora"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.3.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-30857"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-06T23:55:47Z",
    "nvd_published_at": "2026-03-07T17:15:53Z",
    "severity": "MODERATE"
  },
  "details": "### Summary\nA cross-tenant authorization bypass in the knowledge base copy endpoint allows any authenticated user to clone (duplicate) another tenant\u2019s knowledge base into their own tenant by knowing/guessing the source knowledge base ID. This enables bulk data exfiltration (document/FAQ content) across tenants, making the impact critical.\n\n### Details\n\nThe `POST /api/v1/knowledge-bases/copy` endpoint enqueues an asynchronous KB clone task using the caller-supplied `source_id` without verifying ownership (see `internal/handler/knowledgebase.go`).\n```go\n// Create KB clone payload\npayload := types.KBClonePayload{\n  TenantID: tenantID.(uint64),\n  TaskID:   taskID,\n  SourceID: req.SourceID, // from attacker\u0027s input\n  TargetID: req.TargetID,\n}\n\npayloadBytes, err := json.Marshal(payload)\nif err != nil {\n  logger.Errorf(ctx, \"Failed to marshal KB clone payload: %v\", err)\n  c.Error(errors.NewInternalServerError(\"Failed to create task\"))\n  return\n}\n\n// Enqueue KB clone task to Asynq\ntask := asynq.NewTask(types.TypeKBClone, payloadBytes,\nasynq.TaskID(taskID), asynq.Queue(\"default\"), asynq.MaxRetry(3)) // enqueue task\ninfo, err := h.asynqClient.Enqueue(task)\nif err != nil {\n  logger.Errorf(ctx, \"Failed to enqueue KB clone task: %v\", err)\n  c.Error(errors.NewInternalServerError(\"Failed to enqueue task\"))\n  return\n}\n```\n\nThen, the asynq task handler (`ProcessKBClone`) invokes the `CopyKnowledgeBase` service method to perform the clone operation (see `internal/application/service/knowledge.go`):\n\n```go\n// Get source and target knowledge bases\nsrcKB, dstKB, err := s.kbService.CopyKnowledgeBase(ctx, payload.SourceID, payload.TargetID)\nif err != nil {\n    logger.Errorf(ctx, \"Failed to copy knowledge base: %v\", err)\n    handleError(progress, err, \"Failed to copy knowledge base configuration\")\n    return err\n}\n```\n\nAfter that, the `CopyKnowledgeBase` method calls the repository method to load the source knowledge base (see `internal/application/service/knowledgebase.go`):\n\n```go\nfunc (s *knowledgeBaseService) CopyKnowledgeBase(ctx context.Context,\n\tsrcKB string, dstKB string,\n) (*types.KnowledgeBase, *types.KnowledgeBase, error) {\n\tsourceKB, err := s.repo.GetKnowledgeBaseByID(ctx, srcKB)\n\tif err != nil {\n\t\tlogger.Errorf(ctx, \"Get source knowledge base failed: %v\", err)\n\t\treturn nil, nil, err\n\t}\n\tsourceKB.EnsureDefaults()\n\ttenantID := ctx.Value(types.TenantIDContextKey).(uint64)\n\tvar targetKB *types.KnowledgeBase\n\tif dstKB != \"\" {\n\t\ttargetKB, err = s.repo.GetKnowledgeBaseByID(ctx, dstKB)\n        // ...\n    }\n    // ...\n}\n```\n\n\n\u003e Note: until now, the tenant ID is correctly set in context to the attacker\u2019s tenant (from the payload), which can be used to prevent cross-tenant access.\n\nHowever, the repository method `GetKnowledgeBaseByID` loads knowledge bases by `id` only, allowing cross-tenant reads (see `internal/application/repository/knowledgebase.go`).\n\n```go\nfunc (r *knowledgeBaseRepository) GetKnowledgeBaseByID(ctx context.Context, id string) (*types.KnowledgeBase, error) {\n\tvar kb types.KnowledgeBase\n\tif err := r.db.WithContext(ctx).Where(\"id = ?\", id).First(\u0026kb).Error; err != nil {\n\t\tif errors.Is(err, gorm.ErrRecordNotFound) {\n\t\t\treturn nil, ErrKnowledgeBaseNotFound\n\t\t}\n\t\treturn nil, err\n\t}\n\treturn \u0026kb, nil\n}\n```\n\nThe data access layer fails to enforce tenant isolation because `GetKnowledgeBaseByID` only filters by ID and ignores the `tenant_id` present in the context. A secure implementation should enforce a tenant-scoped lookup (e.g., `WHERE id = ? AND tenant_id = ?`) or use a tenant-aware repository API to prevent cross-tenant access.\n\nService shallow-copies the KB configuration by calling `GetKnowledgeBaseByID(ctx, srcKB)` for the source KB, then creates a new KB under the attacker\u2019s tenant while copying fields from the victim KB (`internal/application/service/knowledgebase.go`):\n\n```go\nsourceKB, err := s.repo.GetKnowledgeBaseByID(ctx, srcKB) // not tenant-scoped\n...\ntargetKB = \u0026types.KnowledgeBase{\n    ID:                    uuid.New().String(),\n    Name:                  sourceKB.Name,\n    Type:                  sourceKB.Type,\n    Description:           sourceKB.Description,\n    TenantID:              tenantID,\n    ChunkingConfig:        sourceKB.ChunkingConfig,\n    ImageProcessingConfig: sourceKB.ImageProcessingConfig,\n    EmbeddingModelID:      sourceKB.EmbeddingModelID,\n    SummaryModelID:        sourceKB.SummaryModelID,\n    VLMConfig:             sourceKB.VLMConfig,\n    StorageConfig:         sourceKB.StorageConfig,\n    FAQConfig:             faqConfig,\n}\ntargetKB.EnsureDefaults()\n  if err := s.repo.CreateKnowledgeBase(ctx, targetKB); err != nil {\n      return nil, nil, err\n  }\n}\n```\n\n### PoC\n\nPrecondition: Attacker is authenticated in Tenant A and can obtain (or guess) a victim\u0027s knowledge base UUID belonging to Tenant B.\n\n1) Authenticate as Tenant A and obtain a bearer token or API key.\n\n2) Start a cross-tenant clone using the victim\u2019s knowledge base ID as `source_id`:\n\n```bash\ncurl -X POST http://localhost:8088/api/v1/knowledge-bases/copy \\\n  -H \"Authorization: Bearer \u003cATTACKER_TOKEN\u003e\" \\\n  -H \"Content-Type: application/json\" \\\n  -d \u0027{\"source_id\":\"\u003cVICTIM_KB_UUID\u003e\",\"target_id\":\"\"}\u0027\n```\n\n3) Observe that the task is accepted:\n- HTTP `200 OK`\n- Response contains a `task_id` and a message like `\"Knowledge base copy task started\"`.\n\n4) After the async task completes, a new knowledge base appears under Tenant A containing copied content/config from Tenant B.\n\n\u003e Note: the copy can succeed even when models referenced by the source KB do not exist in the attacker tenant, indicating the workflow does not validate model ownership during copy.\n\nPoC Video:\n\nhttps://github.com/user-attachments/assets/8313fa44-5d5d-43f4-8ebd-f465c5a9d56e\n\n### Impact\n\nThis is a Broken Access Control (BOLA/IDOR) vulnerability enabling cross-tenant data exfiltration:\n\n- Any authenticated user can trigger a clone of a victim tenant\u2019s knowledge base into their own tenant.\n- Results in bulk disclosure/duplication of knowledge base contents (documents/FAQ entries/chunks), plus associated configuration.",
  "id": "GHSA-8rf9-c59g-f82f",
  "modified": "2026-03-09T13:21:46Z",
  "published": "2026-03-06T23:55:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/Tencent/WeKnora/security/advisories/GHSA-8rf9-c59g-f82f"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30857"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/Tencent/WeKnora"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "WeKnora has Unauthorized Cross\u2011Tenant Knowledge Base Cloning"
}

GHSA-8RGJ-VRFR-6HQR

Vulnerability from github – Published: 2026-03-11 00:16 – Updated: 2026-03-11 00:16

Summary

StudioCMS: IDOR — Arbitrary API Token Revocation Leading to Denial of Service

Details

Summary

The DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy. This enables targeted denial of service against critical integrations and automations.

Details

Vulnerable Code

The following is the server-side handler for the DELETE /studiocms_api/dashboard/api-tokens endpoint (revokeApiToken):

File: packages/studiocms/frontend/pages/studiocms_api/dashboard/api-tokens.ts (lines 58–99) Version: studiocms@0.3.0

DELETE: (ctx) =>
    genLogger('studiocms/routes/api/dashboard/api-tokens.DELETE')(function* () {
        const sdk = yield* SDKCore;

        // Check if demo mode is enabled
        if (developerConfig.demoMode !== false) {
            return apiResponseLogger(403, 'Demo mode is enabled, this action is not allowed.');
        }

        // Get user data
        const userData = ctx.locals.StudioCMS.security?.userSessionData;       // [1]

        // Check if user is logged in
        if (!userData?.isLoggedIn) {                                            // [2]
            return apiResponseLogger(403, 'Unauthorized');
        }

        // Check if user has permission
        const isAuthorized = ctx.locals.StudioCMS.security?.userPermissionLevel.isEditor;  // [3]
        if (!isAuthorized) {
            return apiResponseLogger(403, 'Unauthorized');
        }

        // Get Json Data
        const jsonData = yield* readAPIContextJson<{
            tokenID: string;                                                    // [4]
            userID: string;                                                     // [5]
        }>(ctx);

        // Validate form data
        if (!jsonData.tokenID) {
            return apiResponseLogger(400, 'Invalid form data, tokenID is required');
        }

        if (!jsonData.userID) {
            return apiResponseLogger(400, 'Invalid form data, userID is required');
        }

        // [6] Both user-controlled values passed directly — no ownership or identity checks
        yield* sdk.REST_API.tokens.delete({ tokenId: jsonData.tokenID, userId: jsonData.userID });

        return apiResponseLogger(200, 'Token deleted');                         // [7]
    }),

Analysis The handler shares the same class of authorization flaws found in the token generation endpoint, applied to a destructive operation: 1. Insufficient permission gate [1][2][3]: The handler retrieves the session from ctx.locals.StudioCMS.security and only checks isEditor. Token revocation is a high-privilege operation that should require ownership of the token or elevated administrative privileges — not a generic editor-level gate. 2. No token ownership validation [4][6]: The handler does not verify that jsonData.tokenID actually belongs to the jsonData.userID supplied in the payload. An attacker could enumerate or guess token IDs and revoke them regardless of ownership. 3. Missing caller identity check [5][6]: The jsonData.userID from the payload is never compared against userData (the authenticated caller from [1]). Any editor can specify an arbitrary target user UUID and revoke their tokens. 4. No role hierarchy enforcement [6]: There is no check preventing a lower-privileged user (editor) from revoking tokens belonging to higher-privileged accounts (admin, owner). 5. Direct pass-through to destructive operation [6][7]: Both user-controlled parameters are passed directly to sdk.REST_API.tokens.delete() without any server-side validation, and the server responds with a generic success message, making this a textbook IDOR.

PoC

Environment User ID | Role 2450bf33-0135-4142-80be-9854f9a5e9f1 | owner 39b3e7d3-5eb0-48e1-abdc-ce95a57b212c | editor

Attack — Editor Revokes Owner's API Token An authenticated editor sends the following request to revoke a token belonging to the owner:

DELETE /studiocms_api/dashboard/api-tokens HTTP/1.1
Host: 127.0.0.1:4321
Cookie: auth_session=<editor_session_cookie>
Content-Type: application/json
Accept: application/json
Content-Length: 98

{
  "tokenID": "16a2e549-513b-40ac-8ca3-858af6118afc",
  "userID": "2450bf33-0135-4142-80be-9854f9a5e9f1"
}

Response (HTTP 200):

{"message":"Token deleted"}

The server confirmed deletion of the owner's token. The tokenID here refers to the internal token record identifier (UUID), not the JWT value itself. The editor's session cookie was sufficient to authorize this destructive action against a higher-privileged user.

Impact

Denial of Service on integrations: API tokens used in CI/CD pipelines, third-party integrations, or monitoring systems can be silently revoked, causing automated workflows to fail without warning.
No audit trail: The revocation is processed as a legitimate operation — the only evidence is the editor's own session, making attribution difficult without detailed request logging.

Severity

7.1 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 0.3.0"
      },
      "package": {
        "ecosystem": "npm",
        "name": "studiocms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0.4.0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-30945"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-11T00:16:41Z",
    "nvd_published_at": "2026-03-10T18:18:54Z",
    "severity": "HIGH"
  },
  "details": "## Summary\nThe DELETE /studiocms_api/dashboard/api-tokens endpoint allows any authenticated user with editor privileges or above to revoke API tokens belonging to any other user, including admin and owner accounts. The handler accepts tokenID and userID directly from the request payload without verifying token ownership, caller identity, or role hierarchy. This enables targeted denial of service against critical integrations and automations.\n\n## Details\n#### Vulnerable Code\nThe following is the server-side handler for the `DELETE /studiocms_api/dashboard/api-tokens` endpoint (`revokeApiToken`):\n\n**File:** packages/studiocms/frontend/pages/studiocms_api/dashboard/api-tokens.ts (lines 58\u201399)\n**Version:** studiocms@0.3.0\n```\nDELETE: (ctx) =\u003e\n    genLogger(\u0027studiocms/routes/api/dashboard/api-tokens.DELETE\u0027)(function* () {\n        const sdk = yield* SDKCore;\n\n        // Check if demo mode is enabled\n        if (developerConfig.demoMode !== false) {\n            return apiResponseLogger(403, \u0027Demo mode is enabled, this action is not allowed.\u0027);\n        }\n\n        // Get user data\n        const userData = ctx.locals.StudioCMS.security?.userSessionData;       // [1]\n\n        // Check if user is logged in\n        if (!userData?.isLoggedIn) {                                            // [2]\n            return apiResponseLogger(403, \u0027Unauthorized\u0027);\n        }\n\n        // Check if user has permission\n        const isAuthorized = ctx.locals.StudioCMS.security?.userPermissionLevel.isEditor;  // [3]\n        if (!isAuthorized) {\n            return apiResponseLogger(403, \u0027Unauthorized\u0027);\n        }\n\n        // Get Json Data\n        const jsonData = yield* readAPIContextJson\u003c{\n            tokenID: string;                                                    // [4]\n            userID: string;                                                     // [5]\n        }\u003e(ctx);\n\n        // Validate form data\n        if (!jsonData.tokenID) {\n            return apiResponseLogger(400, \u0027Invalid form data, tokenID is required\u0027);\n        }\n\n        if (!jsonData.userID) {\n            return apiResponseLogger(400, \u0027Invalid form data, userID is required\u0027);\n        }\n\n        // [6] Both user-controlled values passed directly \u2014 no ownership or identity checks\n        yield* sdk.REST_API.tokens.delete({ tokenId: jsonData.tokenID, userId: jsonData.userID });\n\n        return apiResponseLogger(200, \u0027Token deleted\u0027);                         // [7]\n    }),\n```\n**Analysis**\nThe handler shares the same class of authorization flaws found in the token generation endpoint, applied to a destructive operation:\n1. **Insufficient permission gate [1][2][3]:** The handler retrieves the session from ctx.locals.StudioCMS.security and only checks isEditor. Token revocation is a high-privilege operation that should require ownership of the token or elevated administrative privileges \u2014 not a generic editor-level gate.\n2. **No token ownership validation [4][6]:** The handler does not verify that jsonData.tokenID actually belongs to the jsonData.userID supplied in the payload. An attacker could enumerate or guess token IDs and revoke them regardless of ownership.\n3. **Missing caller identity check [5][6]:** The jsonData.userID from the payload is never compared against userData (the authenticated caller from [1]). Any editor can specify an arbitrary target user UUID and revoke their tokens.\n4. **No role hierarchy enforcement [6]:** There is no check preventing a lower-privileged user (editor) from revoking tokens belonging to higher-privileged accounts (admin, owner).\n5. **Direct pass-through to destructive operation [6][7]:** Both user-controlled parameters are passed directly to sdk.REST_API.tokens.delete() without any server-side validation, and the server responds with a generic success message, making this a textbook IDOR.\n\n## PoC\n**Environment**\n*User ID | Role*\n2450bf33-0135-4142-80be-9854f9a5e9f1 | owner\n39b3e7d3-5eb0-48e1-abdc-ce95a57b212c | editor\n\n**Attack \u2014 Editor Revokes Owner\u0027s API Token**\nAn authenticated editor sends the following request to revoke a token belonging to the owner:\n```\nDELETE /studiocms_api/dashboard/api-tokens HTTP/1.1\nHost: 127.0.0.1:4321\nCookie: auth_session=\u003ceditor_session_cookie\u003e\nContent-Type: application/json\nAccept: application/json\nContent-Length: 98\n\n{\n  \"tokenID\": \"16a2e549-513b-40ac-8ca3-858af6118afc\",\n  \"userID\": \"2450bf33-0135-4142-80be-9854f9a5e9f1\"\n}\n```\n\n**Response (HTTP 200):**\n```\n{\"message\":\"Token deleted\"}\n```\nThe server confirmed deletion of the owner\u0027s token. The tokenID here refers to the internal token record identifier (UUID), not the JWT value itself. The editor\u0027s session cookie was sufficient to authorize this destructive action against a higher-privileged user.\n\n## Impact\n- **Denial of Service on integrations:** API tokens used in CI/CD pipelines, third-party integrations, or monitoring systems can be silently revoked, causing automated workflows to fail without warning.\n- **No audit trail:** The revocation is processed as a legitimate operation \u2014 the only evidence is the editor\u0027s own session, making attribution difficult without detailed request logging.",
  "id": "GHSA-8rgj-vrfr-6hqr",
  "modified": "2026-03-11T00:16:41Z",
  "published": "2026-03-11T00:16:41Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/withstudiocms/studiocms/security/advisories/GHSA-8rgj-vrfr-6hqr"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-30945"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withstudiocms/studiocms/commit/9eec9c3b45523b635cfe16d55aa55afabacbebe3"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/withstudiocms/studiocms"
    },
    {
      "type": "WEB",
      "url": "https://github.com/withstudiocms/studiocms/releases/tag/studiocms@0.4.0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "StudioCMS: IDOR \u2014 Arbitrary API Token Revocation Leading to Denial of Service"
}

GHSA-8RHW-C8PH-CP97

Vulnerability from github – Published: 2026-07-16 09:32 – Updated: 2026-07-16 18:31

Details

The AI Engine WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users' private conversations and take over their conversation records when the discussions feature is enabled.

Severity

5.9 (Medium)


                  
                    CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-12510"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-16T07:16:46Z",
    "severity": "MODERATE"
  },
  "details": "The AI Engine  WordPress plugin before 3.5.5 does not verify that a user owns the chatbot conversation referenced by a client-supplied identifier, allowing users with subscriber-level access to read other users\u0027 private conversations and take over their conversation records when the discussions feature is enabled.",
  "id": "GHSA-8rhw-c8ph-cp97",
  "modified": "2026-07-16T18:31:29Z",
  "published": "2026-07-16T09:32:16Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-12510"
    },
    {
      "type": "WEB",
      "url": "https://wpscan.com/vulnerability/b7825c8a-1817-4a17-b641-076e48ac7c2e"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8RMF-HHQR-454P

Vulnerability from github – Published: 2025-01-11 03:30 – Updated: 2025-01-11 03:30

Details

The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_duplicate_post() due to insufficient restrictions on which posts can be duplicated. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to by duplicating the post.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-12472"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-01-11T03:15:21Z",
    "severity": "MODERATE"
  },
  "details": "The Post Duplicator plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 2.36 via the mtphr_duplicate_post() due to insufficient restrictions on which posts can be duplicated. This makes it possible for authenticated attackers, with Contributor-level access and above, to extract data from password protected, private, or draft posts that they should not have access to by duplicating the post.",
  "id": "GHSA-8rmf-hhqr-454p",
  "modified": "2025-01-11T03:30:40Z",
  "published": "2025-01-11T03:30:40Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12472"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset?sfp_email=\u0026sfph_mail=\u0026reponame=\u0026old=3219375%40post-duplicator\u0026new=3219375%40post-duplicator\u0026sfp_email=\u0026sfph_mail="
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/3071b2dc-9673-4e30-bd04-7404eb6a1ed9?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8RMW-GGQW-8V95

Vulnerability from github – Published: 2026-06-17 18:35 – Updated: 2026-06-17 18:35

Details

Unauthenticated Insecure Direct Object References (IDOR) in Clean Login <= 1.15 versions.

Severity

8.2 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-54184"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-17T13:20:49Z",
    "severity": "HIGH"
  },
  "details": "Unauthenticated Insecure Direct Object References (IDOR) in Clean Login \u003c= 1.15 versions.",
  "id": "GHSA-8rmw-ggqw-8v95",
  "modified": "2026-06-17T18:35:52Z",
  "published": "2026-06-17T18:35:52Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-54184"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/wordpress/plugin/clean-login/vulnerability/wordpress-clean-login-plugin-1-15-insecure-direct-object-references-idor-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8RQ4-278F-V3VJ

Vulnerability from github – Published: 2026-06-05 15:32 – Updated: 2026-06-05 15:32

Details

The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that the requesting user has access to the object identified by the relatedObjectId. This Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to read and write comments on any process across all business units by supplying an arbitrary object GUID.

Severity

7.1 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-11369"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-06-05T14:16:35Z",
    "severity": "HIGH"
  },
  "details": "The Comment API (GET /api/Comment and POST /api/Comment) in the affected application fails to perform authorization checks to verify that the requesting user has access to the object identified by the relatedObjectId. This Insecure Direct Object Reference (IDOR) vulnerability allows any authenticated user to read and write comments on any process across all business units by supplying an arbitrary object GUID.",
  "id": "GHSA-8rq4-278f-v3vj",
  "modified": "2026-06-05T15:32:24Z",
  "published": "2026-06-05T15:32:24Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-11369"
    },
    {
      "type": "WEB",
      "url": "https://linqi.help/en/reference/security/security-advisories/#security-advisory-insecure-direct-object-reference-idor-in-comment-api-in-linqi"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

GHSA-8RQM-M9FJ-HXXC

Vulnerability from github – Published: 2024-10-28 15:31 – Updated: 2026-04-01 18:32

Details

Authorization Bypass Through User-Controlled Key vulnerability in Meetup allows Privilege Escalation.This issue affects Meetup: from n/a through 0.1.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-50483"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-28T13:15:06Z",
    "severity": "CRITICAL"
  },
  "details": "Authorization Bypass Through User-Controlled Key vulnerability in Meetup allows Privilege Escalation.This issue affects Meetup: from n/a through 0.1.",
  "id": "GHSA-8rqm-m9fj-hxxc",
  "modified": "2026-04-01T18:32:10Z",
  "published": "2024-10-28T15:31:14Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-50483"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/Wordpress/Plugin/meetup/vulnerability/wordpress-meetup-plugin-0-1-broken-authentication-vulnerability?_s_id=cve"
    },
    {
      "type": "WEB",
      "url": "https://patchstack.com/database/vulnerability/meetup/wordpress-meetup-plugin-0-1-broken-authentication-vulnerability?_s_id=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8RX5-5GMV-VG9P

Vulnerability from github – Published: 2025-03-13 06:30 – Updated: 2025-03-13 06:30

Details

The Business Directory Plugin – Easy Listing Directories for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.14 via the 'ajax_listing_submit_image_upload' function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to add arbitrary images to listings.

Severity

5.3 (Medium)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-13887"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-03-13T04:15:18Z",
    "severity": "MODERATE"
  },
  "details": "The Business Directory Plugin \u2013 Easy Listing Directories for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 6.4.14 via the \u0027ajax_listing_submit_image_upload\u0027 function due to missing validation on a user controlled key. This makes it possible for unauthenticated attackers to add arbitrary images to listings.",
  "id": "GHSA-8rx5-5gmv-vg9p",
  "modified": "2025-03-13T06:30:34Z",
  "published": "2025-03-13T06:30:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-13887"
    },
    {
      "type": "WEB",
      "url": "https://plugins.trac.wordpress.org/changeset/3249927/business-directory-plugin/trunk/includes/class-wpbdp.php"
    },
    {
      "type": "WEB",
      "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/06c3de6d-92e7-46f8-86a9-37f027767fc0?source=cve"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
      "type": "CVSS_V3"
    }
  ]
}

GHSA-8V38-PW62-9CW2

Vulnerability from github – Published: 2022-02-18 00:00 – Updated: 2026-02-20 19:56

Summary

url-parse Incorrectly parses URLs that include an '@'

Details

A specially crafted URL with an '@' sign but empty user info and no hostname, when parsed with url-parse, url-parse will return the incorrect href. In particular,

parse(\"http://@/127.0.0.1\")

Will return:

{
 slashes: true,
 protocol: 'http:',
 hash: '',
 query: '',
 pathname: '/127.0.0.1',
 auth: '',
 host: '',
 port: '',
 hostname: '',
 password: '',
 username: '',
 origin: 'null',
 href: 'http:///127.0.0.1'
 }

If the 'hostname' or 'origin' attributes of the output from url-parse are used in security decisions and the final 'href' attribute of the output is then used to make a request, the decision may be incorrect.

Severity

6.5 (Medium)


                  
                    CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "url-parse"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "1.0.0"
            },
            {
              "fixed": "1.5.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2022-0639"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-639"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2022-02-22T18:08:05Z",
    "nvd_published_at": "2022-02-17T18:15:00Z",
    "severity": "MODERATE"
  },
  "details": "A specially crafted URL with an \u0027@\u0027 sign but empty user info and no hostname, when parsed with url-parse, url-parse will return the incorrect href. In particular,\n\n```js\nparse(\\\"http://@/127.0.0.1\\\")\n```\nWill return:\n```yaml\n{\n slashes: true,\n protocol: \u0027http:\u0027,\n hash: \u0027\u0027,\n query: \u0027\u0027,\n pathname: \u0027/127.0.0.1\u0027,\n auth: \u0027\u0027,\n host: \u0027\u0027,\n port: \u0027\u0027,\n hostname: \u0027\u0027,\n password: \u0027\u0027,\n username: \u0027\u0027,\n origin: \u0027null\u0027,\n href: \u0027http:///127.0.0.1\u0027\n }\n```\nIf the \u0027hostname\u0027 or \u0027origin\u0027 attributes of the output from url-parse are used in security decisions and the final \u0027href\u0027 attribute of the output is then used to make a request, the decision may be incorrect.",
  "id": "GHSA-8v38-pw62-9cw2",
  "modified": "2026-02-20T19:56:16Z",
  "published": "2022-02-18T00:00:33Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2022-0639"
    },
    {
      "type": "WEB",
      "url": "https://github.com/unshiftio/url-parse/commit/ef45a1355375a8244063793a19059b4f62fc8788"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/unshiftio/url-parse"
    },
    {
      "type": "WEB",
      "url": "https://huntr.dev/bounties/83a6bc9a-b542-4a38-82cd-d995a1481155"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2023/02/msg00030.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2025/12/msg00024.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "url-parse Incorrectly parses URLs that include an \u0027@\u0027"
}

CWE-639

Authorization Bypass Through User-Controlled Key

GHSA-8R96-J25H-HJ4G

GHSA-8RF9-C59G-F82F

Summary

Details

PoC

Impact

GHSA-8RGJ-VRFR-6HQR

Summary

Details

Vulnerable Code

PoC

Impact

GHSA-8RHW-C8PH-CP97

GHSA-8RMF-HHQR-454P

GHSA-8RMW-GGQW-8V95

GHSA-8RQ4-278F-V3VJ

GHSA-8RQM-M9FJ-HXXC

GHSA-8RX5-5GMV-VG9P

GHSA-8V38-PW62-9CW2

Mitigation

Mitigation

Mitigation