Bobur Abdugafforov

**Name of the Vulnerable Software and Affected Versions** OpenSignLabs OpenSign versions prior to 2.37.1 **Description** An information disclosure issue exists where unauthenticated remote attackers can map any email address or username to its internal user `objectId` via the `getUserId()` Parse cloud function. The function fails to perform authentication before resolving and returning the internal identifier, which allows for the enumeration of user accounts to facilitate subsequent attacks. **Recommendations** Update OpenSignLabs OpenSign to version 2.37.1 or later. As a temporary workaround, restrict access to the `getUserId()` function until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Apioo Fusio version 8.8.3 **Description** An authenticated user with the Developer role can execute arbitrary OS commands due to a PHP-Sandbox allow-list bypass. The sandbox allow-list permits functions that transitively invoke `system()`, allowing the user to escape the sandbox and potentially achieve full server compromise. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Attendize versions prior to commit 9289acb **Description** An insecure direct object reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input. In this case, any authenticated event organiser can bulk import attendees into events belonging to other accounts through the 'postImportAttendee' endpoint. The system loads the target event by ID without verifying if the requesting organiser account owns the event, allowing an attacker to inject bulk attendee data into any event regardless of account boundaries. **Recommendations** Update Attendize to a version including commit 9289acb or later. Restrict access to the 'postImportAttendee' endpoint to ensure ownership verification is performed before processing imports.

**Name of the Vulnerable Software and Affected Versions** OpenSignLabs OpenSign versions prior to 2.37.1 **Description** An information disclosure issue exists where unauthenticated remote attackers can retrieve organization tenant records. This is possible through the `gettenant` Parse cloud function, which accepts a `contactId` parameter and returns the full tenant record without performing authentication or authorization checks. This allows for the enumeration and disclosure of tenant configuration data for any organization within the system. **Recommendations** Update OpenSignLabs OpenSign to version 2.37.1 or later. As a temporary workaround, restrict access to the `gettenant` function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Windmill Labs Windmill versions prior to 1.783.1 **Description** A missing authorization issue allows authenticated workspace members to overwrite any resource type schema. This occurs because the 'update resource type' endpoint fails to perform the administrator permission check that is present in the 'delete resource type' endpoint. An attacker with workspace member privileges can exploit this to corrupt resource type definitions, which may break dependent workflows. **Recommendations** Update Windmill Labs Windmill to version 1.783.1 or later. Restrict access to the 'update resource type' endpoint to authorized administrators only.

**Name of the Vulnerable Software and Affected Versions** Friendica versions prior to 2026.08-dev **Description** An SQL injection issue allows unauthenticated remote attackers to execute arbitrary SQL statements. This occurs because the `order` parameter in the 'photo-view' endpoint is concatenated unescaped into a SHOW COLUMNS query using a bare PDO::query() call, which enables stacked statement injection. This allows an attacker to read, modify, or delete the entire database. **Recommendations** Update Friendica to a version later than 2026.08-dev. Avoid using the `order` parameter in the 'photo-view' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** OpenSignLabs OpenSign versions prior to 2.37.1 **Description** An insecure direct object reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input. In this case, unauthenticated remote attackers can retrieve any contact record through the `getcontact` Parse cloud function. The function executes with `useMasterKey` and fails to perform authentication or authorization checks before returning the requested contact object, allowing the enumeration and retrieval of all contact records, including personally identifiable information. **Recommendations** Update OpenSignLabs OpenSign to version 2.37.1 or later. As a temporary mitigation, restrict access to the `getcontact` Parse cloud function.

**Name of the Vulnerable Software and Affected Versions** Attendize versions prior to commit 9289acb **Description** An insecure direct object reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input. In this case, any authenticated event organiser can inject attendees and orders into events belonging to other accounts through the 'postInviteAttendee' endpoint. The issue arises because the endpoint loads the target event by ID without scoping the query to the authenticated organiser account, allowing an attacker to modify event data and financial records across account boundaries. **Recommendations** Update Attendize to a version including commit 9289acb or later. Restrict access to the 'postInviteAttendee' endpoint to ensure users can only modify events associated with their own account.

**Name of the Vulnerable Software and Affected Versions** Chaskiq versions prior to commit 46dfdd1 **Description** A missing authentication issue allows unauthenticated remote attackers to create Stripe Billing Portal sessions for any tenant. This occurs via the `stripeCustomerPortal` GraphQL mutation, which fails to perform authentication or authorization checks before linking a session to a tenant Stripe account. Consequently, an attacker can access and manage subscription data for any tenant without providing credentials. **Recommendations** Update Chaskiq to a version including commit 46dfdd1 or later. As a temporary mitigation, restrict access to the `stripeCustomerPortal` GraphQL mutation.

**Name of the Vulnerable Software and Affected Versions** authentik versions prior to 2026.5.7 **Description** A privilege escalation issue exists where an attacker possessing a source-scoped SCIM provisioning token can obtain superuser privileges. This occurs because the SCIM group ingest function adopts any existing group by name and replaces its membership without validating the source scope against the target group. By provisioning a SCIM group that matches the name of an existing administrator group, an attacker can grant their provisioning token full IdP superuser access and lock out all current administrators. **Recommendations** Update to version 2026.5.7 or later.

**Name of the Vulnerable Software and Affected Versions** PrefectHQ Prefect versions prior to 3.8.3 **Description** Authenticated users can achieve remote code execution on the Prefect server through an argument injection flaw. The issue occurs because the `branch` parameter in the `git clone` pull step is passed directly to the git pull command without proper sanitization, allowing the injection of arbitrary git arguments. **Recommendations** Update PrefectHQ Prefect to version 3.8.3 or later. Avoid using the `branch` parameter in the `git clone` pull step until the update is applied.

**Name of the Vulnerable Software and Affected Versions** authentik versions prior to 2026.5.7 **Description** A privilege escalation issue exists where an attacker possessing a source-scoped SCIM provisioning token can take over any user account, including superusers. This occurs because the SCIM user ingest function adopts pre-existing local accounts based on the username without validating scope boundaries. Consequently, an attacker can rewrite or delete any account using a limited provisioning credential. **Recommendations** Update to version 2026.5.7 or later.

**Name of the Vulnerable Software and Affected Versions** Windmill Labs Windmill versions prior to 1.783.1 **Description** An information disclosure issue allows authenticated workspace members to read legacy ownerless draft scripts containing plaintext resource credentials. This occurs because drafts with a null owner email bypass Access Control List (ACL) enforcement—a security mechanism that defines which users have access to specific resources—and are returned to any member querying the drafts endpoint. Consequently, sensitive credentials stored in these drafts are exposed across ACL boundaries. **Recommendations** Update Windmill Labs Windmill to version 1.783.1 or later.

**Name of the Vulnerable Software and Affected Versions** PhotoPrism versions prior to commit bb0b933 **Description** An insecure direct object reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input. In this case, the `AlbumCover` handler fails to verify if the requesting user is authorized to access a specific album before serving the cover image. Consequently, any user possessing a valid preview token can enumerate and download original-resolution cover photos from albums belonging to other users. **Recommendations** Update PhotoPrism to commit bb0b933 or a later version.

**Name of the Vulnerable Software and Affected Versions** Chaskiq versions prior to commit 46dfdd1 **Description** A missing authentication issue allows unauthenticated remote attackers to manipulate Stripe subscriptions for any tenant. This occurs because the `stripeCreateIntent` GraphQL mutation lacks necessary authentication and authorization checks, enabling unauthorized users to create payment intents and alter billing details without credentials. **Recommendations** Update Chaskiq to a version that includes commit 46dfdd1 or later. As a temporary mitigation, restrict access to the `stripeCreateIntent` GraphQL mutation.

**Name of the Vulnerable Software and Affected Versions** Windmill Labs Windmill versions prior to 1.783.1 **Description** A missing authorization issue allows authenticated operators to write job progress and read job metrics for any job within a workspace, regardless of ownership. This occurs because the `job metrics` handlers do not utilize an authorization extractor, which bypasses workspace-level access controls. Consequently, an operator can monitor sensitive job execution data and inject misleading progress for jobs they do not own. **Recommendations** Update Windmill Labs Windmill to version 1.783.1 or later.

**Name of the Vulnerable Software and Affected Versions** OpenSignLabs OpenSign versions prior to 2.37.1 **Description** An integrity verification issue allows unauthenticated remote attackers to forge document audit-trail entries. This is possible through the `triggerevent Parse` cloud function, which accepts viewer identity and IP address as caller-supplied parameters without authentication. By exploiting this, an attacker can fabricate arbitrary audit log entries and tamper with the legal audit trail of any signed document, undermining non-repudiation, which is the assurance that someone cannot deny the validity of something. **Recommendations** Update OpenSignLabs OpenSign to version 2.37.1 or later. As a temporary workaround, restrict access to the `triggerevent Parse` cloud function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** OpenSignLabs OpenSign versions prior to 2.37.1 **Description** An insecure direct object reference (IDOR) occurs when an application provides direct access to objects based on user-supplied input. In this case, unauthenticated remote attackers can write to any contact record using the `updatecontacttour` Parse cloud function. Because the function lacks authentication and authorization checks, an attacker can corrupt or overwrite contact data for any user in the system without providing credentials. **Recommendations** Update OpenSignLabs OpenSign to version 2.37.1 or later. As a temporary workaround, restrict access to the `updatecontacttour` Parse cloud function to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Portainer CE versions prior to 2.44.1 **Description** An authentication bypass occurs when authenticated low-privileged users bypass Docker proxy authorization checks. This is caused by non-canonical URL normalization, where the proxy endpoint fails to normalize request paths before applying access controls. This discrepancy allows crafted requests to be interpreted differently by the proxy and the authorization layer, defeating all authorization middleware and granting the attacker root-level access to the underlying Docker host. **Recommendations** Update Portainer CE to version 2.44.1 or later.

**Name of the Vulnerable Software and Affected Versions** Dub versions prior to 2026-07-10 **Description** An unauthenticated remote attacker can induce the server to issue HTTP requests to arbitrary internal or external hosts. This occurs via the 'metatags edge' endpoint, which fetches any caller-supplied URL without requiring authentication or applying a denylist. This flaw can be leveraged to scan internal services or exfiltrate data from cloud metadata endpoints. Server-Side Request Forgery (SSRF) is a flaw where an attacker forces a server to make requests to a destination of the attacker's choosing. **Recommendations** Update to a version released after 2026-07-10. Restrict access to the 'metatags edge' endpoint to minimize the risk of exploitation.