Komiljon Ayubov

An authentication bypass exists in the `doResetPassword()` function. The issue allows the TOTP (Time-based One-Time Password) verification step to be skipped following a password reset. An attacker who can complete the reset process, for example, by accessing the victim's reset email, can obtain a fully authenticated session, including Super Admin privileges, without providing the required TOTP code.

A 2FA bypass exists that allows attackers possessing a valid password to brute-force Time-based One-Time Password (TOTP) codes. This occurs because the attempt counter resets every time a new password login is performed. An attacker can repeatedly submit credentials to the 'POST /admin/login' endpoint to obtain fresh tokens, with each token providing 15 additional guesses, potentially granting access to 2FA-protected accounts, including Super Admin sessions.

listmonk 6.2.0 before 7.0.0-beta.2 contains a missing authentication vulnerability that allows unauthenticated attackers to submit Azure Event Grid bounce webhooks when no shared secret is configured. Attackers can POST forged EmailDeliveryReportReceived events with Bounced status to /webhooks/service/azure to blocklist, unsubscribe, or delete arbitrary subscribers.

A server-side request forgery (SSRF) issue allows unauthenticated attackers to bypass the MCP outbound URL policy. This is achieved by using IPv4-mapped IPv6 addresses, where attackers provide hex-normalized addresses such as `::ffff:7f00:1` directly or through redirects. This allows the unauthorized fetching of loopback, private, and cloud metadata services to read their responses.

A Cross-Site Request Forgery (CSRF) issue exists in the staff guest login endpoint 'POST /api/guest/staff/login'. This occurs because the `checkGuestClientAuthentication()` function only allowlists `client login` and `client create`, leaving `staff login` without CSRF or Origin validation. A remote attacker can use an auto-submitting HTML form with controlled credentials to silently authenticate a victim's browser into the attacker's staff account.

An issue exists in `builder/api.py` where the `assert not private url()` function only validates the initial hostname. Because `requests.get(url)` is called with default redirect-following and no IP pinning, a public URL provided by an attacker can redirect to internal or link-local addresses. An authenticated attacker can exploit the `convert to webp` endpoint, which lacks a permission decorator, to perform Server-Side Request Forgery (SSRF) against internal targets like cloud metadata services, conduct internal port scanning, or cause a request-hang denial of service due to a missing timeout.

An authentication bypass exists in the local bypass authentication mode. The `enforce authentication()` function in api service/auth/middleware.py trusts the `request.remote addr` value, which is derived from the spoofable X-Forwarded-For header due to the ProxyFix(x for=1) configuration in api service/app.py. An attacker can spoof a trusted CIDR address, such as 127.0.0.1, via the X-Forwarded-For header to be granted an unauthenticated admin session through the ` load bypass user context()` function. This allows full administrative access to endpoints including '/api/users' and '/api/jobs' without credentials.

A path traversal issue exists that allows remote attackers to read and write arbitrary host files. This is achieved by executing DuckDB filesystem functions through the query editor. An attacker can access a DuckDB file without credentials and utilize functions such as `read text()`, `read blob()`, `COPY ... TO`, or `ATTACH` to steal `session.key` and stored database credentials or overwrite files.

An improper authorization issue allows unauthenticated remote attackers to perform read, create, update, and delete operations on usergroup records. The flaw exists in the `server/permission/permission.go` file within the permission check functions `CanRead()`, `CanPeek()`, `CanCreate()`, `CanUpdate()`, `CanDelete()`, and `CanRefer()`. These functions return true when the `p.UserId` matches the requesting `userId` but fail to reject null or zero references. Because usergroup table rows lack a `user account id` and are loaded with a null owner, an unauthenticated guest with a null session `UserId` is granted full CRUD (Create, Read, Update, Delete) access to all usergroup objects.

A NULL pointer dereference occurs when the server fails to validate that a pointer is non-nil before use. An unauthenticated remote attacker can trigger a fatal panic that crashes the server process by sending a single HTTP request to the '/api/auth/local/recover' endpoint. This issue is located in the `sendOTPEmail()` function within the pkg/auth/local.go file, where a pointer is dereferenced from an unchecked error path.

A stored cross-site scripting (XSS) issue exists where a low-privileged authenticated user can upload an SVG file containing malicious JavaScript. This occurs because the `PutMultipart()` function in `pkg/rclonefs/base.go` validates the `Content-Type` header provided by the client instead of inspecting the actual file content. An attacker can bypass the MIME type allow-list check by renaming a file to .jpg while specifying `image/svg+xml` as the header, allowing the storage of a script-bearing SVG in the web root.

A time-of-check/time-of-use (TOCTOU) race condition occurs in the account recovery flow. This issue allows an unauthenticated remote attacker to bypass the One-Time Password (OTP) attempt limit, facilitating brute-force attacks on 6-digit OTP codes. The `verifyOTPSession()` function in pkg/auth/local.go reads and increments the attempt counter using separate non-atomic operations. This allows concurrent requests to see the same attempt count below the threshold and bypass the limit check before the update is committed. A TOCTOU race condition is a software bug where a program checks the state of a resource and then acts on that resource, but the state changes between the check and the action.

An unauthenticated remote attacker can poison the shared process-wide render cache. By manipulating the `u` query parameter of the GET '/ instatic/hole/<nodeId>' server island endpoint, an attacker can seed the route template frame used for rendering. Because the result is stored in a shared cache keyed only on `nodeId`, this allows the injection of a crafted route, causing subsequent visitors to receive malformed or attacker-controlled fragment content.