Harish Kolla

In deployments configured with multiple organizations, an Org Admin of a single organization can access permission data from other organizations. This occurs when calling the 'GET /api/access-control/users/permissions/search' endpoint using the `actionPrefix` parameter set to 'dashboards:'. The exposed information is limited to dashboard and folder identifiers (UIDs) and per-user permission or scope mappings. This issue does not expose dashboard contents, panels, query results, datasource credentials, secrets, or personal data.

Sensitive data, including Variable values and Connection `extra` contents, are written to the audit log in cleartext when submitted via the bulk endpoints `PATCH /api/v2/variables` and `PATCH /api/v2/connections`. This occurs because the audit-log masking mechanism only recognizes top-level request fields, while bulk requests nest entities two levels deeper, bypassing the masking process. Consequently, any authenticated user with audit-log read access can recover these secrets, even if they lack specific permissions to read Variables or Connections. Additionally, the Connection `extra` data is stored unencrypted in the log, despite being encrypted in the connection table. This issue is also triggered by the Airflow UI's Import Variables action.

An authorization flaw exists in the Backfill API where a discrepancy in how the `backfill id` path segment is parsed allows an authenticated user with edit permissions on any single Dag to perform unauthorized actions on other Dags. The authorization dependency uses `int()` for parsing, while the route handler uses pydantic's `NonNegativeInt`, which accepts values that `int()` rejects (for example, `1.0` is coerced to `1`). Because FastAPI resolves dependencies before endpoint validation, the authorization check and the actual operation act on different Dags. This allows users to read, pause, and cancel backfills of other Dags, or move queued runs to a failed state. Since backfill ids are sequential, identifying targets is trivial.

An issue exists that allows unauthenticated attackers to write arbitrary files to any directory on the host filesystem. This occurs during the initial onboarding window when a crafted backup archive is uploaded. By manipulating the `name` field within the `backup.json` file inside the archive to provide an absolute path, the `pathlib.Path. truediv ` function discards the intended backup directory prefix. This results in attacker-controlled content being written to arbitrary locations, granting full filesystem access if the process is running as root. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

A cross-site scripting issue exists in the Shelly integration's `async get media image()` function. An attacker who controls a Shelly device's `thumb` field can serve arbitrary HTML content by providing a data URI with a `text/html` content type, as the system fails to validate the input against an image-only allowlist. This allows the media player proxy endpoint to serve attacker-controlled bytes with a `text/html` Content-Type within the Home Assistant web origin. Consequently, this can lead to the theft of session tokens from local storage and the execution of authenticated calls to sensitive service endpoints, such as those controlling locks, alarms, and covers.

A credential exposure issue exists where workspace dotenv files can override provider credentials. This allows attackers with lower-trust access to configured input paths to expose sensitive data and credentials that are intended to remain within trusted boundaries.

A path traversal issue exists in the backup-restore function. An attacker can write files to arbitrary absolute filesystem paths by providing a specially crafted tar archive. This is achieved using a SYMTYPE entry that pairs a benign member name with an absolute linkname pointing outside the extraction directory. Since the official Docker image executes the Home Assistant process as root, the subsequent regular-file entry is written through the unvalidated symlink. This can lead to remote code execution by overwriting auto-imported Python paths, such as `site-packages/sitecustomize.py`, or custom component directories.