Bstapes

The issue is related to a lack of authorization controls in REST API functions. This allows any TeamPass user with a valid API token to become a TeamPass administrator and read or modify all passwords via authenticated "api/index.php" REST API calls. It's noted that the API is not available by default.

The issue allows any user with a valid API token to bypass IP address whitelist restrictions. This is achieved via an X-Forwarded-For client HTTP header to the `getIp` function.

The issue allows an unauthenticated attacker to retrieve files from the TeamPass web root, potentially including backups or LDAP debug files.

The issue allows any authenticated TeamPass user to trigger a PHP file include vulnerability via a crafted HTTP request with `sources/users.queries.php` using `newValue` directory traversal.