0Xshemesh

Rate-limit buckets are keyed using the verbatim client IP string from `request.ip`. An IPv6-capable client can bypass rate-limit boundaries by rotating addresses within a large address range (such as a /64) or by using different textual representations of the same address. This allows attackers to bypass protections on sensitive endpoints like authentication, password reset, OTP delivery, or expensive API calls, particularly when the application is behind a proxy that surfaces IPv6 to the origin and `trustProxy` is enabled.

The software is subject to Server-Side Request Forgery (SSRF), a flaw that allows an attacker to induce the server-side application to make requests to an unintended location.

Missing authorization flaws in the `editUser()` and `updateUserRights()` endpoints allow authenticated administrators to escalate privileges. An authenticated non-SuperAdmin user possessing the `edit user` permission can modify the `is superadmin` flag or grant arbitrary rights to an account, enabling them to gain full SuperAdmin access and complete control over the knowledge base.