Lighthousekeeper1212

An authorization flaw exists in the `updateAssign()` function of the ProjectsController. This issue allows any authenticated user to reassign projects even if they lack the `can-assign-new-user-to-project` permission. Low-privileged employees can exploit this by sending PATCH or POST requests to the '/projects/updateassign/{external id}' endpoint using a specific `user assigned id` to redirect project ownership and notifications.

An insecure direct object reference occurs in the `get object()` function within the `SubscriptionViewSet`. The issue stems from the use of an unscoped queryset that lacks organization filtering or permission checks. Consequently, authenticated users or those with API keys from any organization can provide a `subscription id` belonging to another organization to read, cancel, update, switch plans, or modify addons, which allows for the alteration of another tenant's billing.

An authorization bypass exists in the `UpdateIssueComment` handler. Low-privileged project users, including those with the Project Viewer role, can modify comments in other projects. This is achieved by setting an issue from their own project as the parent and providing a foreign comment UID to overwrite comments they are not authorized to access.

An SQL injection issue exists in the `mem0/vector stores/databricks.py` file. Attackers can execute arbitrary SQL on the configured Databricks SQL warehouse by providing crafted memory text, metadata, or message names. These inputs reach unescaped string interpolation within the `insert()` and `update()` functions, allowing the injection of malicious SQL commands.

An authorization bypass exists in the `updateExtClient` handler. This flaw allows users with network-scoped permissions to modify external clients belonging to other networks. An attacker can send PUT requests to the '/api/extclients/{network}/{clientid}' endpoint to replace public keys, disable clients, and retrieve WireGuard private keys.

An authorization bypass allows authenticated users to access task runs from other projects by providing a UID. Users with permissions on one project can supply foreign task or task run UIDs to read execution logs, database session details, and rollback SQL from other projects via the `GetTaskRunLog()`, `GetTaskRunSession()`, and `PreviewTaskRunRollback()` functions.

An incorrect authorization issue exists in the `sources/state.ts` handlers. The problem occurs because the `findFirst()` function is called without the `await` keyword, which prevents the `syncId` ownership check from executing properly. Consequently, authenticated users who possess the `syncId` of another workspace can read, overwrite, or delete its stream cursors, potentially leading to skipped data or the re-ingestion of data.

A missing authorization issue allows users with `access dashboard` privileges to create administrator accounts and grant permissions. This is achieved by directly calling the `CreateTeamMember::store()` or `Permissions::togglePermission()` functions via the `/livewire/update` endpoint, leading to full administrative privilege escalation.

Missing authorization in legacy AJAX handlers located under public/main/inc/ajax/ allows unauthenticated or low-privileged users to harvest user names and certificate PDFs of other learners. This is achieved by calling the functions `get users by group course()`, `user by all roles()`, and `export all certificates()`.

An authorization bypass exists in the `isOpenMethod()` function of `commonModel`. This issue allows authenticated users to circumvent group-based Access Control List (ACL) checks for any method that includes the string 'ajax'. Consequently, users with minimal privileges can execute methods such as `task.ajaxGetByID`, `system.ajaxDBAuthUrl`, and `admin.ajaxChangeTableEngine` to read sensitive data, retrieve database credentials, trigger Continuous Integration (CI) jobs, and modify database tables.

An authorization flaw exists in the `openAnswerGrade()` function within the `AiController`. This issue allows any authenticated user to access AI grading for exam attempts belonging to other students. By enumerating the `exeId` and `questionId` variables sent to the 'open answer grade' endpoint, an attacker can expose other students' answers via feedback and deplete the AI quota.

Missing access control in the `GradebookController` allows unauthenticated users to modify gradebook certificates. An attacker can tamper with the certificate configuration for any course by requesting the 'set default certificate' endpoint using any `course id` and `document id`.

An authorization flaw exists in the 'ajax/testEmailSettings.php' endpoint. This issue allows any authenticated user, including those with read-only permissions, to send emails via the configured SMTP relay. By manipulating the `testEmailAddress` and `fromAddress` parameters, an attacker can send a predefined test message to any recipient while spoofing the sender address.

Missing authorization in the 'ajax/deleteActivity.php' and 'ajax/editActivity.php' endpoints allows users with READ-level permissions to modify or delete activity entries. Authenticated attackers can provide an arbitrary `activityID` via GET or POST requests to alter or remove activity and pipeline history associated with candidates, contacts, and companies.

Authenticated users can access project data belonging to other users due to missing authorization. By knowing a project UUID, an attacker can query the '/trpc' endpoint using the `publishedBuilds` and `findManyByIds` tRPC procedures to retrieve information such as publish history, titles, domains, preview images, and the latest builds.

An insecure direct object reference allows authenticated users to modify or delete comments belonging to other users. This occurs because the `update()` and `destroy()` functions within the `CommentsController` utilize an unscoped `Comment.find` method that lacks proper authorization checks. An attacker can exploit this by sending PUT or DELETE requests to the '/comments/:id' endpoint using sequential IDs to manipulate comments associated with contacts, accounts, leads, and opportunities owned by other users.

An authorization flaw allows authenticated members to modify server-wide settings. This is possible by invoking the `others.updateSettings` tRPC mutation without possessing the `MANAGE SETTINGS` permission. An attacker can exploit this to set a join password, disable registration, set upload limits to zero, or toggle plugin loading, which can result in a denial of service for other members.

An insecure direct object reference allows authenticated users to create auto-reply messages for arbitrary mailboxes. By providing another user's `mbox` value, an attacker can send a POST request to the '/api/v2/armessages/' endpoint to inject controlled auto-reply subjects and content into a victim's settings or disrupt their auto-reply management by triggering MultipleObjectsReturned errors.

Authenticated users can view activity records of all users due to missing authorization in the ActivityService `ListActivities` and `GetActivity` API endpoints. Low-privileged attackers can enumerate sequential activity IDs to retrieve creator IDs, timestamps, and memo-comment references, which may include activity related to private memos of other users.

Authenticated users can modify or delete calendar events belonging to other users, including non-public events restricted to the owner. This occurs because of missing authorization in the `onEditEvent()` and `onDeleteEvent()` functions within CalendarUI. An attacker with EDIT or DELETE permissions can provide arbitrary `eventID` values to manipulate these events.