Mansurzhan Mavlankulov

LearnHouse before 1.4.0 contains a missing authorization vulnerability in POST /api/v1/playgrounds/{uuid}/duplicate that skips the read-access and draft checks enforced by get playground. Authenticated users with playground creation rights, such as Instructors, who know a RESTRICTED or unpublished playground UUID can copy its html content and republish it publicly.

Telegram-Stremio through 5.1.0 contains a broken object-level authorization vulnerability that allows authenticated token holders to access arbitrary chat messages by forging unsigned, unauthenticated stream IDs decoded via encode string/decode string functions. Attackers can craft or enumerate sequential msg id values and set a global flag in the stream handler endpoint to route requests through the operator's personal Userbot account, exposing private channels, groups, and Saved Messages, while the unauthenticated thumb handler endpoint further discloses thumbnails from those same chats without any token validation.

Telegram-Stremio through 5.1.0 contains an insecure storage vulnerability that allows attackers with access to the MongoDB database, backups, or logs to recover the operator's authenticated Telegram session string, which is protected only by a keyless, reversible encoding transform rather than actual encryption. Attackers can round-trip the stored value through the repository's own decode string function with no secret key to obtain a fully authenticated Telegram session, granting complete control of the operator's Telegram account even when two-step verification is enabled.

**Name of the Vulnerable Software and Affected Versions** Lektor version 3.3.14 Lektor version 3.4.0b15 **Description** A cross-site request forgery (CSRF) issue exists in the admin API blueprint. This allows unauthenticated attackers to execute state-changing actions via cross-origin requests due to a lack of CSRF tokens, Origin/Referer validation, CORS configuration, or Host allowlisting. Attackers can use a malicious web page to target the 'newattachment', 'deleterecord', 'build', 'clean', and 'publish' endpoints to write arbitrary files, delete pages, wipe build output, and trigger deployment publication. Additionally, DNS rebinding—a technique used to bypass the Same-Origin Policy—can be used to access read endpoints and disclose data. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Podgrab (affected versions not specified) **Description** An unauthenticated denial-of-service issue exists due to unsynchronized concurrent access to shared maps `activePlayers` and `allConnections` within the WebSocket handler. The `Wshandler` and `HandleWebsocketMessages` goroutines read and write to these maps without using a mutex, which is a synchronization primitive used to prevent multiple threads from accessing shared data simultaneously. A remote attacker can trigger a Go runtime data race by opening multiple WebSocket connections to the '/ws' endpoint and sending messages in a loop, resulting in a process crash that requires operator intervention to restore service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Podgrab (affected versions not specified) **Description** An authentication bypass exists because the '/ws' WebSocket endpoint is registered on the root gin engine rather than the BasicAuth-protected router group. This allows unauthenticated network clients to establish connections even when a `PASSWORD` is configured. An attacker can join the `allConnections` set and capture `PlayerExists` broadcasts containing client-supplied player identifiers. By replaying these identifiers in a `RegisterPlayer` message, an attacker can hijack queue payloads intended for authenticated users, leading to the exposure of episode IDs, titles, and server-side file paths, and potentially disrupting legitimate playback. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** OpenSave versions prior to 2.4.0-beta.1 **Description** OpenSave fails to validate sender identity in WAN relay requests. This allows unpaired room members to impersonate paired devices by spoofing the `From` field within the `RelayMessage`. Attackers with knowledge of the room code can join the session, identify paired peer identifiers through announcements, and send forged requests to access protected sync routes, which include save data, snapshots, and file operations. **Recommendations** Update to version 2.4.0-beta.1 or later.

**Name of the Vulnerable Software and Affected Versions** OpenSave versions prior to 2.4.1 **Description** The manifest request handler fails to properly validate save paths provided by paired peers. This allows attackers to specify arbitrary directories outside of the configured save locations to read and write files via the manifest and sync routes. **Recommendations** Update to a version newer than 2.4.0.