Eldor Nabijonov

**Name of the Vulnerable Software and Affected Versions** Plainpad versions prior to 1.1.1 **Description** An issue exists where unauthenticated attackers can send unbounded login requests to the 'POST /v1/sessions' endpoint. This occurs because dead code in `AppHttpKernel.php` is not instantiated under the Laravel 11+ skeleton, which leaves the API throttle configuration unattached to any route. This allows for unlimited credential attempts without lockout or CAPTCHA enforcement and can lead to CPU exhaustion by forcing repeated bcrypt comparisons on each request. **Recommendations** Update Plainpad to the version containing commit d3823fc.

**Name of the Vulnerable Software and Affected Versions** Grafana versions prior to 13.2.1 **Description** An authorization bypass allows a user with the Editor role to delete protected contact points (receivers) without possessing the necessary `alert.notifications.receivers.protected:write` permission. This occurs because the DELETE path in the `pkg/services/ngalert/provisioning/contactpoints.go` and `pkg/services/ngalert/notifier/receiver svc.go` services lacks the required protected-field check. **Recommendations** Update Grafana to version 13.2.1 or later.

**Name of the Vulnerable Software and Affected Versions** changedetection.io (affected versions not specified) **Description** The REST API resources are protected by an `@auth.check token` decorator that validates the `x-api-key` header. However, the Spec resource registered at the '/api/v1/full-spec' endpoint lacks both the `@auth.check token` and `@validate openapi request` decorators in its `get()` method. This allows an unauthenticated client to retrieve the full merged OpenAPI schema, including all endpoint paths, parameters, and registered processor plugins, even when API access control is enabled. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** changedetection.io (affected versions not specified) **Description** The `/settings` save handler creates an update dictionary from `form.data['application']` and merges it into the stored application settings using the `.update()` method. Due to how WTForms handles unchecked checkboxes as `False` instead of unchanged, and because only the `password` field is protected against this behavior, a POST request to the `/settings` endpoint that omits the `api access token enabled` variable can silently disable API key enforcement. This allows unauthenticated requests to access the full watch list, history, and configuration of the REST API. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** changedetection.io (affected versions not specified) **Description** The '/login' endpoint fails to implement per-IP or per-session rate limiting, failed-attempt counters, or account lockouts when verifying passwords against a PBKDF2-HMAC-SHA256 hash. Since the application uses a single shared password instead of individual user accounts, a successful brute-force attack allows an attacker to gain full administrative access, which includes the ability to view or regenerate the API token. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Shiori (affected versions not specified) **Description** The `CheckToken()` function in `internal/domains/auth.go` validates only the HMAC signature of the JSON Web Token (JWT) and returns the embedded `Account` object without re-fetching the account data from the database. Because the system lacks a session store or token-revocation mechanism, changes to an account—such as deletion or demotion from an owner to a regular role—do not affect existing tokens. Consequently, a token issued to a deleted or demoted owner remains valid and retains original owner-level privileges until it expires, which can take up to 30 days if the remember me option is enabled. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.