Bobur Abdugafforov

A broken access control issue exists in the Mautic Stats API endpoint '/api/stats/{table}'. The system failed to enforce permissions for several internal tables, as administrator-only restrictions were not applied and tables lacking explicit permission mappings remained readable by default. Consequently, any authenticated API user, regardless of their assigned role or permissions, can access sensitive data. This includes the application audit log containing user actions and change details that may expose personal contact data, visitor IP addresses, geolocation details, and tracked redirect URLs with channel mappings.

An SQL Injection issue exists in the dashboard widget data API endpoint '/api/data/{type}'. This occurs because chart filter parameters provided by the client are not properly validated before being used in database queries that generate dashboard chart data. An authenticated user with API access can use blind SQL injection—a technique used to retrieve data from a database by asking true/false questions—to read arbitrary information from the database, including contact details, marketing data, and user account password hashes. Additionally, the injected SQL can be used to slow down queries, potentially impacting availability. Data modification is not possible, and exploitation requires the Mautic API to be enabled.

Authenticated users can achieve remote code execution on the Prefect server through an argument injection flaw. The issue occurs because the `branch` parameter in the `git clone` pull step is passed directly to the git pull command without proper sanitization, allowing the injection of arbitrary git arguments.

An information disclosure issue exists where unauthenticated remote attackers can retrieve organization tenant records. This is possible through the `gettenant` Parse cloud function, which accepts a `contactId` parameter and returns the full tenant record without performing authentication or authorization checks. This allows for the enumeration and disclosure of tenant configuration data for any organization within the system.

A privilege escalation issue exists where an attacker possessing a source-scoped SCIM provisioning token can obtain superuser privileges. This occurs because the SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group. By provisioning a SCIM group that matches the name of an existing administrator group, an attacker can grant their provisioning token full IdP superuser access and lock out all current administrators.

A privilege escalation issue exists where an attacker possessing a source-scoped SCIM provisioning token can take over any user account, including superusers. This occurs because the SCIM user ingest function adopts pre-existing local accounts based on the username without validating scope boundaries. Consequently, an attacker can rewrite or delete any account using a limited provisioning credential.

An insecure direct object reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input. In this case, unauthenticated remote attackers can retrieve any contact record through the `getcontact` Parse cloud function. The function executes with `useMasterKey` and fails to perform authentication or authorization checks before returning the requested contact object, allowing the enumeration and retrieval of all contact records, including personally identifiable information.

An insecure direct object reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input. In this case, the `AlbumCover` handler fails to verify if the requesting user is authorized to access a specific album before serving the cover image. Consequently, any user possessing a valid preview token can enumerate and download original-resolution cover photos from albums belonging to other users.

An insecure direct object reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input. In this case, any authenticated event organiser can inject attendees and orders into events belonging to other accounts through the 'postInviteAttendee' endpoint. The issue arises because the endpoint loads the target event by ID without scoping the query to the authenticated organiser account, allowing an attacker to modify event data and financial records across account boundaries.

An insecure direct object reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input. In this case, any authenticated event organiser can bulk import attendees into events belonging to other accounts through the 'postImportAttendee' endpoint. The system loads the target event by ID without verifying if the requesting organiser account owns the event, allowing an attacker to inject bulk attendee data into any event regardless of account boundaries.

An integrity verification issue allows unauthenticated remote attackers to forge document audit-trail entries. This is possible through the `triggerevent Parse` cloud function, which accepts viewer identity and IP address as caller-supplied parameters without authentication. By exploiting this, an attacker can fabricate arbitrary audit log entries and tamper with the legal audit trail of any signed document, undermining non-repudiation, which is the assurance that someone cannot deny the validity of something.

An authentication bypass occurs when authenticated low-privileged users bypass Docker proxy authorization checks. This is caused by non-canonical URL normalization, where the proxy endpoint fails to normalize request paths before applying access controls. This discrepancy allows crafted requests to be interpreted differently by the proxy and the authorization layer, defeating all authorization middleware and granting the attacker root-level access to the underlying Docker host.

A missing authentication issue allows unauthenticated remote attackers to create Stripe Billing Portal sessions for any tenant. This occurs via the `stripeCustomerPortal` GraphQL mutation, which fails to perform authentication or authorization checks before linking a session to a tenant Stripe account. Consequently, an attacker can access and manage subscription data for any tenant without providing credentials.

A missing authentication issue allows unauthenticated remote attackers to manipulate Stripe subscriptions for any tenant. This occurs because the `stripeCreateIntent` GraphQL mutation lacks necessary authentication and authorization checks, enabling unauthorized users to create payment intents and alter billing details without credentials.

An information disclosure issue exists where unauthenticated remote attackers can map any email address or username to its internal user `objectId` via the `getUserId()` Parse cloud function. The function fails to perform authentication before resolving and returning the internal identifier, which allows for the enumeration of user accounts to facilitate subsequent attacks.

An information disclosure issue allows authenticated workspace members to read legacy ownerless draft scripts containing plaintext resource credentials. This occurs because drafts with a null owner email bypass Access Control List (ACL) enforcement—a security mechanism that defines which users have access to specific resources—and are returned to any member querying the drafts endpoint. Consequently, sensitive credentials stored in these drafts are exposed across ACL boundaries.

A missing authorization issue allows authenticated workspace members to overwrite any resource type schema. This occurs because the 'update resource type' endpoint fails to perform the administrator permission check that is present in the 'delete resource type' endpoint. An attacker with workspace member privileges can exploit this to corrupt resource type definitions, which may break dependent workflows.

A missing authorization issue allows authenticated operators to write job progress and read job metrics for any job within a workspace, regardless of ownership. This occurs because the `job metrics` handlers do not utilize an authorization extractor, which bypasses workspace-level access controls. Consequently, an operator can monitor sensitive job execution data and inject misleading progress for jobs they do not own.

An insecure direct object reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input. In this case, unauthenticated remote attackers can write to any contact record using the `updatecontacttour` Parse cloud function. Because the function lacks authentication and authorization checks, an attacker can corrupt or overwrite contact data for any user in the system without providing credentials.

An SQL injection issue allows unauthenticated remote attackers to execute arbitrary SQL statements. This occurs because the `order` parameter in the 'photo-view' endpoint is concatenated unescaped into a SHOW COLUMNS query using a bare PDO::query() call, which enables stacked statement injection. This allows an attacker to read, modify, or delete the entire database.