Alpesh Bhagwatkar

SurrealDB before 3.3.0 contains an authorization bypass in HTTP session construction where check auth() verifies credentials against Surreal-Auth-NS and Surreal-Auth-DB headers but constructs sessions using Surreal-NS and Surreal-DB headers without validating access permissions. Attackers can authenticate as a user from one tenant while selecting another tenant's namespace and database to read, create, and modify records across tenant boundaries.

**Name of the Vulnerable Software and Affected Versions** Appwrite versions prior to 2.0.0 **Description** Authenticated users with `functions.write` or `sites.write` permissions can execute arbitrary commands. This occurs because the application uses `escapeshellcmd()` instead of `escapeshellarg()` and fails to quote the `providerRootDirectory` parameter when constructing GNU tar commands. By injecting TAB characters, which survive sanitization and act as argument separators, an attacker can inject arbitrary GNU tar arguments, such as `--checkpoint-action=exec`, to achieve remote code execution as the builds worker process user. **Recommendations** Update Appwrite to version 2.0.0 or later.

**Name of the Vulnerable Software and Affected Versions** Apache NiFi version 2.11.0 **Description** An authorization flaw exists in the REST API methods used to list migration sources and submit migration requests when moving version-controlled Process Group contents into a Connector. The system only verified permissions for the target Connector, failing to evaluate access rights for the involved Process Groups. This allows an authenticated user with read access to a Connector to enumerate identifiers, names, and flow registry details of Process Groups they are not authorized to read. Additionally, a user with write access to a Connector can migrate a Process Group they do not have write access to, which copies the flow definition, referenced assets, and component state into the Connector while disabling and renaming the source Process Group. This issue does not affect installations that do not use component-level authorization policies for Process Groups. The migration process requires the source Process Group to be stopped with empty queues and does not include sensitive property values. **Recommendations** Upgrade to version 2.12.0.