Geochen

A vulnerability was detected in donetick up to 0.1.82. The impacted element is the function CanDeleteHistory of the file internal/chore/model/model.go of the component History Deletion Handler. The manipulation of the argument AssignedTo results in improper authorization. The attack can be launched remotely. The exploit is now public and may be used. The project maintainer explains: "The concerns about "IDOR" framing seem to be overstated in my opinion (...), as Circle members are already trusted collaborators. We will address this issue. However, since the impact is limited to trusted members within the same circle, I would classify this as a bug rather than a security vulnerability."

A security vulnerability has been detected in dotnet eShop up to 913acea66708a59595351174cee9b29f37179d29. The affected element is the function AddApplicationServices of the file src/Catalog.API/Extensions/Extensions.cs of the component Catalog API. The manipulation leads to improper authentication. The attack can be initiated remotely. The project was informed of the problem early through an issue report but has not responded yet.

A weakness has been identified in calcom cal.com and cal.diy up to 6.2.0. Impacted is the function createWebhookProcedure of the file packages/trpc/server/routers/viewer/webhook/util.ts of the component Webhook Handler. Executing a manipulation of the argument ID can lead to authorization bypass. It is possible to launch the attack remotely. The pull request to fix this issue awaits acceptance.

**Name of the Vulnerable Software and Affected Versions** uptrace versions prior to 2.1.0-beta.9 **Description** A remote information exposure issue exists due to verbose error handling in the `Login()` function within the `pkg/org/user handler.go` file. This flaw allows a remote attacker to use the login handler as a tool for username lookup by analyzing the error messages returned by the system. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the `Login()` function to minimize the risk of username enumeration.

**Name of the Vulnerable Software and Affected Versions** imgproxy versions prior to 4.0.18 **Description** A flaw in the SVG Handler component, specifically within the `sanitizeElement()` function of the `processing/svg/svg.go` file, allows for remote cross-site scripting. Cross-site scripting is a technique where malicious scripts are injected into trusted websites. **Recommendations** Update imgproxy to version 4.0.18 or later. As a temporary workaround, restrict the use of the SVG Handler component until the update is applied.

**Name of the Vulnerable Software and Affected Versions** OSSRS srs versions prior to 8.0-d0 **Description** An issue exists in the System API component within the `systemAPI.Run()` function of the `internal/proxy/api.go` file. A remote attacker can perform a manipulation that results in missing authentication, allowing unauthorized access to the system. **Recommendations** Upgrade to version 8.0-d0. As a temporary mitigation, restrict access to the `systemAPI.Run()` function.

**Name of the Vulnerable Software and Affected Versions** ChatGPTNextWeb NextChat versions prior to 2.16.2 **Description** A flaw in the Proxy Fallback Handler component allows for server-side request forgery, which occurs when an attacker can induce the server to make requests to an unintended location. This issue is located in the `proxyHandler()` function within the `app/api/proxy.ts` file and is triggered by manipulating the `x-base-url` argument. The attack can be initiated remotely. **Recommendations** Update ChatGPTNextWeb NextChat to version 2.16.2 or later. As a temporary workaround, restrict or monitor the use of the `x-base-url` argument in the `proxyHandler()` function.

**Name of the Vulnerable Software and Affected Versions** dotnet eShop version .NET 8 **Description** An issue exists in the Ordering API component within the `GetOrderAsync()` function located in the `src/Ordering.API/Apis/OrdersApi.cs` file. A remote attacker can manipulate the `OrderNumber` argument to cause improper control of resource identifiers, which occurs when a system fails to properly validate that a user is authorized to access a specific resource identifier. **Recommendations** As a temporary workaround, restrict access to the `GetOrderAsync()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** sgl-project sglang versions prior to 0.5.22 **Description** A flaw in the HTTP Endpoint component allows remote attackers to cause the cleartext transmission of sensitive information. This occurs through the manipulation of the `api key` argument within the `server info()` function located in the python/sglang/srt/entrypoints/http server.py file. **Recommendations** As a temporary workaround, restrict access to the `server info()` function to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mcp-server-fetch versions prior to 2026.6.4 mcp-server-everything versions prior to 2026.6.4 **Description** A server-side request forgery (SSRF) issue exists in the Fetch Tool component. The vulnerability occurs within the `fetch url()` function located in the `mcp server fetch/server.py` file. A remote attacker can trigger this by manipulating the `url` or `path` arguments, allowing the server to make unauthorized requests to private IP addresses, loopback interfaces, or metadata services. **Recommendations** Update mcp-server-fetch to version 2026.6.4 or later. Update mcp-server-everything to version 2026.6.4 or later. Implement egress filtering to deny traffic to RFC1918, loopback, and metadata addresses.

**Name of the Vulnerable Software and Affected Versions** calcom cal.diy versions prior to 6.2.1 **Description** A security flaw in the PBAC Permission Engine component allows for missing authorization. The issue resides in the `doesUserIdHaveAccessToBooking()` function within the `BookingAccessService.ts` file. This flaw can be exploited remotely through manipulation to bypass authorization checks. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary mitigation, restrict access to the `doesUserIdHaveAccessToBooking()` function within the `BookingAccessService.ts` file.

**Name of the Vulnerable Software and Affected Versions** Immich versions prior to 2.7.6 **Description** Improper authorization occurs in the Shared Link Preview Handler component within the `checkSharedLinkAccess()` function located in server/src/utils/access.ts. A remote attacker can exploit this by manipulating the `Password` argument to bypass authorization controls. **Recommendations** Update to version 2.7.6 or later. As a temporary mitigation, restrict access to the Shared Link Preview Handler functionality.

**Name of the Vulnerable Software and Affected Versions** Pixelfed versions prior to 0.12.10 **Description** An issue exists in the OAuth Scope Handler component within the `instancePeers()` function of the `app/Http/Controllers/Api/ApiV1Controller.php` file. Remote manipulation of the `ID` argument can lead to missing authentication. **Recommendations** Update to version 0.12.10.

**Name of the Vulnerable Software and Affected Versions** nginx-proxy-manager versions prior to 2.15.2 **Description** Missing authentication in the Validate Route component allows remote attackers to manipulate the `internalCertificate.validate()` function within the `backend/internal/certificate.js` file. The endpoint processes and echoes back the submitted certificate, leading to unauthenticated OpenSSL processing of attacker-controlled input. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Mealie versions prior to 3.26.0 **Description** A weakness in the Recipe Action Trigger component allows for remote server-side request forgery (SSRF), a condition where an attacker can induce the server to make requests to an unintended location. The issue exists within the `payload.model dump()` function located in the `mealie/routes/households/controller group recipe actions.py` file. This occurs when the `url` argument is manipulated. **Recommendations** Upgrade to version 3.26.0.

**Name of the Vulnerable Software and Affected Versions** chatwoot versions prior to 4.17.2 **Description** A server-side request forgery (SSRF) issue exists within the Shopify OAuth component, specifically affecting the `callbacks controller.rb` file. This flaw allows remote attackers to manipulate requests to induce the server to make unauthorized requests to internal or external resources. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** cheshire-cat-ai versions prior to 1.9.3 **Description** An issue exists where the manipulation of the `user id` argument in the ` authorize http key()` function within the `core/cat/factory/custom auth handler.py` file leads to missing authentication. This allows a remote attacker to impersonate any user, including the administrator, by providing a specific client header. This occurs in default installations where no API key is configured. **Recommendations** Set the `CCAT API KEY` environment variable to enable authentication. Remove the server from the open internet to restrict access. As a temporary workaround, restrict access to the ` authorize http key()` function until a patch is available.

**Name of the Vulnerable Software and Affected Versions** StackStorm st2 versions prior to 3.9.1 **Description** Improper privilege management exists in the API Key Handler component within the file `st2api/st2api/controllers/v1/auth.py`. A remote attacker can manipulate the `api key api.user` argument to gain unauthorized privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** StackStorm st2 versions prior to 3.9.1 **Description** Improper privilege management exists in the NoOp RBAC backend component. A remote attacker can manipulate the `User` argument within the `assert user is admin if user query param is provided()` function located in the `st2api/st2api/controllers/v1/actionexecutions.py` file. This issue affects default installations where RBAC (Role-Based Access Control) is disabled. **Recommendations** Update StackStorm st2 to version 3.9.1 or later. As a temporary mitigation, restrict access to the `assert user is admin if user query param is provided()` function.

**Name of the Vulnerable Software and Affected Versions** Casdoor versions prior to 4.0.0 **Description** An issue exists in the `upload-resource` API within the `controllers/resource.go` file. This flaw allows remote attackers to bypass authentication, leading to missing authentication for the affected component. **Recommendations** Update to a version later than 4.0.0. As a temporary mitigation, restrict access to the `upload-resource` API.