Joostgrunwald

An SQL injection issue exists due to insufficient input validation in certain endpoints. This allows authenticated attackers with low privileges to send specially crafted requests to alter database queries and extract sensitive information from the database. SQL injection is a technique where malicious SQL statements are inserted into entry fields for execution, potentially allowing unauthorized access to data.

Certain endpoints fail to enforce proper authorization checks during document status modification. This allows authenticated low-privileged users to modify data beyond their permitted role, bypassing role-based access restrictions.

Authenticated users can read financial data beyond their permitted role due to missing authorization checks. This allows attackers to query endpoints to access sensitive financial records that should be restricted.

Certain endpoints fail to enforce proper authorization checks. This allows authenticated users to send requests to these endpoints to modify data that exceeds the permissions granted by their assigned role.

Certain endpoints fail to enforce proper authorization checks during document creation. This allows authenticated low-privileged users to send requests to these endpoints to create documents against records that exceed their permitted role, effectively bypassing role-based permission restrictions.

Certain endpoints fail to enforce proper authorization checks. This allows authenticated users to send requests to these endpoints to modify data beyond their permitted role, which compromises data integrity.

Certain endpoints fail to enforce proper permission checks, leading to a missing authorization issue. This allows authenticated users with low privileges to request these endpoints and read personal data that exceeds the permissions granted by their assigned role.

Certain endpoints fail to enforce proper permission checks. This allows authenticated low-privileged users to request these endpoints directly to read financial data that exceeds the permissions of their assigned role.

An issue exists where an endpoint used for sending transactional emails fails to verify the authorization of the caller. This allows any authenticated user to specify arbitrary message content and recipient lists, enabling the delivery of attacker-controlled messages that appear to originate from the organization's configured outgoing email account.

KaTeX uses ordinary JavaScript property access for the renderer options object, the trust setting, default and processor setting metadata, and namespace lookup and group restoration. This allows inherited properties to be treated as explicitly supplied values. If `Object.prototype` is polluted or an attacker controls the options object's prototype, attacker-controlled mathematical expressions can use an inherited trust value to enable trusted rendering. This can lead to user-interaction cross-site scripting (XSS)—a technique where malicious scripts are injected into trusted websites—or the loading of attacker-selected external resources in applications that insert unsanitized KaTeX output into a page. KaTeX does not create the prototype pollution itself, and rendering an expression alone does not execute script.