CVEs

Workspace-scoped asset download endpoint checked workspace access but not owning-project access, letting non-project workspace members download private project-bound files from secret projects.

Missing validation of app-scoped builder role assignments in the public user create and update endpoints let an authenticated app-scoped builder grant builder access to unrelated apps.

A shared plugin cache directory could be poisoned with attacker-controlled PF4J plugin code for an official pinned plugin ID, which a victim workflow would later load and execute as the victim user.

The local secrets provider wrote secrets to disk before applying owner-only permissions, creating a world-readable race window exploitable on shared filesystems with permissive umask.

Missing path, interface, and member checks on broadcast message filtering let a sandboxed app monitor broadcast signals outside its allowed scope.

Cross-course submission comment and grade tampering via POST /api/c_student_publication_comments/upload allowed low-privileged users to add feedback and overwrite grades on arbitrary assignment submissions.

Multiple blog API endpoints lacked object-level authorization checks, letting authenticated low-privileged users read, create, modify, and comment on blog resources outside their course scope.

The WebAuthn deserialization filter only constrained the root AuthenticatorImpl object, allowing nested gadget graphs through an ObjectInputFilter depth bypass.

A scoped API token limited to oauth.authorize could mint normal OAuth JWT and refresh credentials that were not restricted by the original token scope.

Family-scoped API endpoints trusted attacker-controlled family IDs, letting low-privileged users read and create notes on unrelated family records.

Stored XSS in Wikimedia chart pie tooltips allowed Data namespace field titles to reach the ECharts HTML tooltip renderer.

Missing function-level authorization on Settings Livewire actions let low-privileged users delete tax, zone, shipping, and carrier configuration used by checkout.

Stored XSS in page list view breadcrumbs let attacker-controlled page titles execute in the SilverStripe CMS admin interface.

Missing object-level authorization on notification export let any authenticated user download arbitrary notification attachments by iterating IDs.

A CRUD delete helper precedence bug let real HTTP DELETE requests bypass failed validation, leading to runtime-confirmed cross-organisation galaxy deletion.

The backend FileUpload widget trusted posted file IDs globally, letting any authenticated backend user target unrelated attachment records and modify metadata or ordering.

Non-admin users granted remote download permission could make Cloudreve fetch loopback and internal URLs, then read the imported response body from their own files.

Public customer document tokens could cross company boundaries through EmailLog type confusion, and JSON endpoints kept accepting expired tokens.

Direct event media endpoints let low-privileged users fetch private snapshots, frames, videos, and HLS media from monitors they were denied access to.

A stored future DDNS profile ID could later resolve to another user profile and be consumed by the DDNS worker in attacker server context.

Quick Creation Command endpoints missed create authorization checks and let authenticated Sharp users bypass create permission on configured entities.

The single meeting agenda item API disclosed private work package data from a linked work package in an inaccessible project.

Cross-user subscription cost inference via replacement_subscription_id let an authenticated user infer another user subscription cost through unscoped stats dereferencing.

Cross-user Fixer/API Layer credential consumption in exchange-rate refresh let one user trigger provider-backed actions through another user's stored credential.

Authenticated cross-tenant credential disclosure exposed another client secrets through an unprotected credential modal.

Inconsistent scope enforcement for AttachAction and AssociateAction Select fields let out-of-scope records pass through backend validation.

Team settings authorization defects let authenticated panel users take over the RBAC system itself.

Missing authorization on order mutation actions let low-privileged authenticated users mutate order state without the required write permission.

Multiple admin Livewire issues led to data tampering, sensitive data disclosure, and stored XSS.

A discount race condition enabled silent over-redemption and effectively bypassed the per-user usage limit.

Product editor sub-form Livewire components accepted unauthorized store actions and allowed tampering without the required permission.

Payment methods, currencies, and carriers exposed inline toggles and record actions without proper per-action authorization checks.

A generic download endpoint let authenticated users use one valid record as an authorization anchor to download unrelated Laravel Storage objects.