5Ud0Er

**Name of the Vulnerable Software and Affected Versions** Plane versions prior to 1.4.0 **Description** Insufficient access control in the project management tool allows unauthorized retrieval of file assets. The endpoints 'WorkspaceFileAssetEndpoint.get' and 'WorkspaceAssetDownloadEndpoint.get' resolve `FileAsset` records without verifying if the workspace member belongs to the asset's project, enabling the download of assets from private projects if the asset UUID is known. Additionally, the 'EntityAssetEndpoint.get' public-anchor endpoint grants `AllowAny` access and limits lookups to the workspace level rather than the specific published entity or project. This allows unauthenticated users with a valid anchor and asset UUID to retrieve issue-description or comment-description assets from private or unpublished projects within that workspace. **Recommendations** Update to version 1.4.0.

**Name of the Vulnerable Software and Affected Versions** Penpot versions prior to 2.18.0 **Description** An issue exists where the `get-page` RPC (Remote Procedure Call) accepts a share-link permission object providing broad read access but fails to verify if the requested `page-id` is among the pages authorized by the link. An authenticated attacker possessing a valid share link can retrieve the full shape and design data of other pages within the same file if the page identifier is known. Additionally, the `get-file-fragment` RPC allows share-link access without properly mapping fragments to authorized pages. **Recommendations** Update to version 2.18.0.

**Name of the Vulnerable Software and Affected Versions** OpenPanel versions prior to 2.3.0 **Description** Share lookup procedures fail to validate access controls, allowing unauthenticated callers to retrieve protected report definitions and argon2id password hashes. Attackers possessing a share link can obtain full report configurations, including filters, event names, and breakdown dimensions, which may lead to business intelligence theft and offline password cracking. **Recommendations** Update to version 2.3.0 or later.

**Name of the Vulnerable Software and Affected Versions** OpenPanel versions prior to 2.3.1 **Description** Missing access level validation in mutation resolvers allows members with read-only project access to perform unauthorized actions. This issue affects 26 of 29 mutating procedures, enabling users to modify, delete, and publish project data. Specifically, attackers can delete reports and dashboards, schedule entire projects for deletion, publish private analytics to public share links, and modify alerting rules. **Recommendations** Update to version 2.3.1 or later.

**Name of the Vulnerable Software and Affected Versions** OpenPanel versions prior to 2.3.1 **Description** The data importer fails to use the project's SSRF guard, instead utilizing a plain fetch mechanism to retrieve caller-supplied URLs. In the `parseRemoteFile()` function within `packages/importer/src/providers/umami.ts`, the `config.fileUrl` variable is validated only as a URL string, allowing requests to internal addresses such as `http://127.0.0.1:9911/` or `http://169.254.169.254/latest/meta-data/`. An authenticated organization member can exploit this to force the server to connect to any reachable address. The server then returns the HTTP status and status text via `import.get`, creating a scanning oracle for internal hosts, ports, and paths. Additionally, if an internal response is formatted as a Umami CSV, the data is ingested as events and becomes visible in the attacker's analytics views. SSRF (Server-Side Request Forgery) is a flaw where an attacker forces a server to make requests to an unintended location. **Recommendations** Update OpenPanel to a version later than 2.3.0. As a temporary workaround, restrict the use of the `config.fileUrl` parameter in the data importer to prevent requests to internal network addresses.

**Name of the Vulnerable Software and Affected Versions** Trilium versions prior to 0.104.0 **Description** The public share-search endpoint does not enforce `shareCredentials` and `shareHiddenFromTree` controls. The endpoint authorizes only the ancestor note provided in the request and performs a full-text search across the published subtree, returning the title, share identifier, and hierarchical path of matching notes without verifying if the individual note requires a password or is hidden. An unauthenticated visitor can use this endpoint as a boolean oracle—a system that provides a yes/no answer to a query—to confirm arbitrary substrings and recover the full content of protected shared notes. **Recommendations** Update to version 0.104.0.

**Name of the Vulnerable Software and Affected Versions** Weblate versions prior to 2026.7 **Description** An authenticated user with project access can retrieve the change history of restricted components through nested API change endpoints. This occurs because these nested endpoints fail to apply the component-level access checks required for direct component views, allowing the enumeration of changes for hidden components. Exposed data may include the identity of the restricted component, translation and unit links, and change payload fields such as source or translated string content within the `target`, `old`, and `details` values. **Recommendations** Update to version 2026.7.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Huginn السابقة لتاريخ 19 أغسطس 2022 **الوصف** يمكن للمستخدمين المصادق عليهم تنفيذ هجوم تزوير الطلبات من جانب الخادم (SSRF) عن طريق إرسال عناوين URL مُعدَّلة خصيصًا. تحدث هذه المشكلة داخل الدالة `fetch url()` في فئة `ScenarioImport`، مما يسمح للمهاجمين بإجراء طلبات HTTP تعسفية. ويمكن استغلال ذلك لاستكشاف خدمات الشبكة الداخلية، وتعداد المنافذ من خلال توقيعات الأخطاء، والوصول إلى نقاط نهاية البيانات الوصفية السحابية لاسترداد بيانات الاعتماد الحساسة. **التوصيات** تحديث Huginn إلى إصدار أحدث من 2022.08.18. كإجراء تخفيفي مؤقت، تقييد الوصول إلى الدالة `fetch url()` داخل `ScenarioImport` لمنع الطلبات الداخلية غير المصرح بها.

**اسم البرنامج المعرض للخطر والإصدارات المتأثرة** إصدارات Astro الأقدم من 6.4.6 **الوصف** تقوم تطبيقات Astro SSR التي تستخدم صفحات خطأ مُعدة مسبقًا، مثل ’/404‘ أو ’/500‘ مع `export const prerender = true`، باسترداد هذه الصفحات عبر بروتوكول HTTP أثناء وقت التشغيل عند حدوث خطأ. يُشتق عنوان URL الخاص بالجلب من `request.url`، الذي يحصل على مصدره من رأس `Host` الوارد. إذا لم يتم التحقق من صحة رأس `Host` مقابل `allowedDomains`، فيمكن للمهاجم التلاعب بالرأس لتوجيه عملية الجلب نحو مضيف عشوائي وقراءة الاستجابة. يحدث هذا على وجه التحديد في عمليات نشر SSR التي تستخدم `createRequestFromNodeRequest` من `astro/app/node` مع `app.render()` دون تجاوز `prerenderedErrorPageFetch`. **التوصيات** قم بالتحديث إلى الإصدار 6.4.6 أو أحدث.