Komiljon Ayubov

**Name of the Vulnerable Software and Affected Versions** daptin versions prior to 0.12.35 **Description** An improper authorization issue allows unauthenticated remote attackers to perform read, create, update, and delete operations on usergroup records. The flaw exists in the `server/permission/permission.go` file within the permission check functions `CanRead()`, `CanPeek()`, `CanCreate()`, `CanUpdate()`, `CanDelete()`, and `CanRefer()`. These functions return true when the `p.UserId` matches the requesting `userId` but fail to reject null or zero references. Because usergroup table rows lack a `user account id` and are loaded with a null owner, an unauthenticated guest with a null session `UserId` is granted full CRUD (Create, Read, Update, Delete) access to all usergroup objects. **Recommendations** Update daptin to version 0.12.35 or later.

**Name of the Vulnerable Software and Affected Versions** fastschema versions prior to 0.15.2 **Description** A NULL pointer dereference occurs when the server fails to validate that a pointer is non-nil before use. An unauthenticated remote attacker can trigger a fatal panic that crashes the server process by sending a single HTTP request to the '/api/auth/local/recover' endpoint. This issue is located in the `sendOTPEmail()` function within the pkg/auth/local.go file, where a pointer is dereferenced from an unchecked error path. **Recommendations** Update to a version newer than 0.15.1. As a temporary workaround, restrict access to the '/api/auth/local/recover' endpoint to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** fastschema versions prior to 0.15.2 **Description** A stored cross-site scripting (XSS) issue exists where a low-privileged authenticated user can upload an SVG file containing malicious JavaScript. This occurs because the `PutMultipart()` function in `pkg/rclonefs/base.go` validates the `Content-Type` header provided by the client instead of inspecting the actual file content. An attacker can bypass the MIME type allow-list check by renaming a file to .jpg while specifying `image/svg+xml` as the header, allowing the storage of a script-bearing SVG in the web root. **Recommendations** Update fastschema to version 0.15.2 or later.

**Name of the Vulnerable Software and Affected Versions** fastschema versions prior to 0.15.2 **Description** A time-of-check/time-of-use (TOCTOU) race condition occurs in the account recovery flow. This issue allows an unauthenticated remote attacker to bypass the One-Time Password (OTP) attempt limit, facilitating brute-force attacks on 6-digit OTP codes. The `verifyOTPSession()` function in pkg/auth/local.go reads and increments the attempt counter using separate non-atomic operations. This allows concurrent requests to see the same attempt count below the threshold and bypass the limit check before the update is committed. A TOCTOU race condition is a software bug where a program checks the state of a resource and then acts on that resource, but the state changes between the check and the action. **Recommendations** Update fastschema to version 0.15.2 or later.

**Name of the Vulnerable Software and Affected Versions** CoreBunch/Instatic versions 0.0.1 through 0.0.14 **Description** An unauthenticated remote attacker can poison the shared process-wide render cache. By manipulating the `u` query parameter of the GET '/ instatic/hole/<nodeId>' server island endpoint, an attacker can seed the route template frame used for rendering. Because the result is stored in a shared cache keyed only on `nodeId`, this allows the injection of a crafted route, causing subsequent visitors to receive malformed or attacker-controlled fragment content. **Recommendations** Update CoreBunch/Instatic to a version later than 0.0.14. Avoid using the `u` parameter in the '/ instatic/hole/<nodeId>' endpoint until the software is updated.