Jankesec

Routes that accept a session ID or response ID validate only the caller's organization and fail to enforce the workspace scope for non-default workspace API keys. An attacker possessing a non-guessable identifier from another workspace within the same organization can perform unauthorized actions, including reading sessions, conversation turns, files, traces, and responses, as well as overwriting files, canceling or deleting sessions, and publishing share links. This issue is limited to the organization boundary; console users, organization keys, and Default Workspace keys maintain their intended organization-wide access.

A flaw in the way the library handles crafted PDF files can lead to uncontrolled resource consumption. Specifically, when a PDF contains indirect-object identifiers or generation-number tokens that persist for a long duration without whitespace, the `read until whitespace` function within `pypdf/ reader.py` and `pypdf/generic/ base.py` scans excessive input. This results in long runtimes and can lead to application unavailability.