D3Do-23

The endpoint `GET /api/v1/users/{username}/heatmap` failed to enforce the public-only restriction of access tokens. This allowed a holder of a public-only token to access contribution counts and 15-minute time buckets derived from the user's activity in private repositories, although repository names and contents remained protected.

An improper authorization issue exists in the GET '/api/v1/projects/:projectRef/envvars' endpoint. This flaw allows users with a restricted `read:envvars` key to obtain the root API key, identified as `TRIGGER SECRET KEY`, as well as plaintext secrets for staging, production, and preview environments. An attacker with this access can trigger tasks and mint admin public JWTs (JSON Web Tokens), which are compact, URL-safe means of representing claims to be transferred between two parties.

An improper access control issue allows authenticated users to read restricted `emailAddress` values. This occurs when users with record access query the address-book search API, enabling them to obtain email addresses even if Roles are configured to restrict the `emailAddress` field.

An access control issue allows authenticated users to read audited field values that are restricted by field-level security. By fetching individual stream notes, a user with stream access to a parent record can request the 'GET /Note/{id}' endpoint. This action bypasses the `NoteAccessControl` filter, enabling the recovery of `data.attributes.was` and `became` values from restricted fields.

Identity-scoped `protectedFields` (including authenticated, role, or per-user groups) are not enforced on count queries that utilize the `$relatedTo` operator. This allows an authenticated user with read access to the owning object to use counts combined with an `objectId` constraint as a membership oracle, potentially revealing the size of protected Relation fields and confidential memberships, such as block lists or private groups.

LiveQuery evaluates the `protectedFields` class-level permission using an incompletely resolved caller identity. Because subscriber roles are not resolved and subscriptions without a session token are redacted against an anonymous identity, field masks defined for specific roles, authenticated users, or individual users are not applied. This allows authenticated subscribers to receive field values that the REST API would normally withhold and enables the use of masked fields to filter or watch a subscription. This issue only affects classes with LiveQuery enabled that define `protectedFields` under role, authenticated, or per-user groups; masks under the public (*) group function correctly.

LLaMA-Factory, a tuning library for large language models, contains a Server-Side Request Forgery (SSRF) issue in the chat API. Authenticated users can make the server send arbitrary HTTP requests to internal and external networks, potentially exposing sensitive internal services, allowing network reconnaissance, or interacting with third-party services. A Local File Inclusion (LFI) issue also exists, allowing users to read arbitrary files from the server's filesystem. The issue resides in the ` process request` function within `src/llamafactory/api/chat.py`. This function processes multimodal content from URLs, and if the URL is not a base64 data URI or a local file path, it makes an HTTP GET request using `requests.get(url, stream=True).raw` without validating or sanitizing the URL.

The issue concerns a critical performance vulnerability in the input preprocessing logic of the multimodal tokenizer. It is caused by inefficient list concatenation operations, resulting in quadratic time complexity (O(n²)), which allows malicious actors to trigger resource exhaustion via specially crafted inputs.