Mansur Mavlankulov

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get playground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished playground UUID can copy its html content and republish it publicly.

**Name of the Vulnerable Software and Affected Versions** Podgrab (affected versions not specified) **Description** An unauthenticated denial-of-service issue exists due to unsynchronized concurrent access to shared maps `activePlayers` and `allConnections` within the WebSocket handler. The `Wshandler` and `HandleWebsocketMessages` goroutines read and write to these maps without using a mutex, which is a synchronization primitive used to prevent multiple threads from accessing shared data simultaneously. A remote attacker can trigger a Go runtime data race by opening multiple WebSocket connections to the '/ws' endpoint and sending messages in a loop, resulting in a process crash that requires operator intervention to restore service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Podgrab (affected versions not specified) **Description** An authentication bypass exists because the '/ws' WebSocket endpoint is registered on the root gin engine rather than the BasicAuth-protected router group. This allows unauthenticated network clients to establish connections even when a `PASSWORD` is configured. An attacker can join the `allConnections` set and capture `PlayerExists` broadcasts containing client-supplied player identifiers. By replaying these identifiers in a `RegisterPlayer` message, an attacker can hijack queue payloads intended for authenticated users, leading to the exposure of episode IDs, titles, and server-side file paths, and potentially disrupting legitimate playback. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Lektor version 3.3.14 Lektor version 3.4.0b15 **Description** A cross-site request forgery (CSRF) issue exists in the admin API blueprint. This allows unauthenticated attackers to execute state-changing actions via cross-origin requests due to a lack of CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting. Attackers can use a malicious web page to target the 'newattachment', 'deleterecord', 'build', 'clean', and 'publish' endpoints to write arbitrary files, delete pages, wipe build output, and trigger deployment publication. Additionally, DNS rebinding—a technique used to bypass the Same-Origin Policy—can be used to access read endpoints and disclose data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.