Offset

Flowise versions before 3.1.4 contain an unauthenticated denial of service vulnerability in the /api/v1/text-to-speech/abort endpoint that accepts user-supplied chatflowId and chatId without ownership verification. Attackers can terminate active chatflow predictions for any user by submitting requests with known chatflow and chat identifiers, causing targeted service disruption.

**Name of the Vulnerable Software and Affected Versions** MCPHub versions prior to 0.12.15 **Description** Authenticated non-admin users can execute arbitrary processes as the server's OS user, which is often root in Docker, npx, or systemd deployments. This occurs because the 'POST /api/servers' and 'PUT /api/servers/:name' endpoints lack authorization checks and do not sanitize the `command` and `args` fields before passing them to the `child process.spawn` function. **Recommendations** Update to version 0.12.15.

**Name of the Vulnerable Software and Affected Versions** Flowise versions prior to 3.1.4 **Description** An issue exists where the software fails to validate chatflow visibility in the unauthenticated text-to-speech endpoint. This allows unauthenticated attackers to abuse private chatflow text-to-speech credentials by providing a valid `chatflow UUID`. Consequently, attackers can generate unlimited audio using stored OpenAI or ElevenLabs API keys, leading to financial costs for the chatflow owner. **Recommendations** Update to version 3.1.4 or later.

**Name of the Vulnerable Software and Affected Versions** Admidio versions prior to 5.0.11 **Description** An insecure direct object reference (IDOR) occurs in the `save temporary` mode of the `mylist function.php` file. This issue allows authenticated users to hijack list configurations by enumerating global list UUIDs. By supplying a specific `list uuid` parameter, an attacker can overwrite private lists of other users or global lists curated by administrators, effectively transferring ownership and demoting global lists to personal configurations. **Recommendations** Update to version 5.0.11 or later.

**Name of the Vulnerable Software and Affected Versions** Budibase versions prior to 3.38.1 **Description** A server-side request forgery (SSRF) issue exists in the REST datasource integration. The system fails to validate HTTP redirects against the IP blacklist, allowing users with the Builder role to configure a REST datasource that points to an external server. This external server can then return a redirect to internal IP addresses, bypassing protection to access internal services and cloud metadata endpoints. **Recommendations** Update to version 3.38.1 or later.

**Name of the Vulnerable Software and Affected Versions** Budibase Server versions prior to 3.40.0 **Description** NoSQL injection occurs in the MongoDB query execution endpoint when user-supplied parameters are interpolated into JSON query templates without proper sanitization of JSON metacharacters. Attackers with query write permissions can inject JSON structural characters to alter MongoDB queries, allowing them to bypass filters to read, modify, or delete arbitrary documents. **Recommendations** Update Budibase Server to version 3.40.0 or later.

**Name of the Vulnerable Software and Affected Versions** DOMPurify versions prior to 3.4.0 **Description** Function predicates provided via `ADD ATTR` or `ADD TAGS` to the `DOMPurify.sanitize()` function persist in the internal state `EXTRA ELEMENT HANDLING` across multiple calls on the same instance. If a subsequent call to the same instance provides `ADD ATTR` or `ADD TAGS` as an array instead of a function, the previous function handler is not cleared or overwritten. This allows the handler to continue approving attacker-controlled attributes or tags, potentially bypassing `FORBID TAGS` and allowing dangerous event-handler attributes to survive sanitization, which leads to cross-site scripting (XSS), a technique where malicious scripts are injected into trusted websites. **Recommendations** Update to version 3.4.0.

**Name of the Vulnerable Software and Affected Versions** Parse Server versions 9.0.0 through 9.10.0-alpha.3 Parse Server versions prior to 8.6.85 **Description** A schema disclosure issue exists when the GraphQL API is configured with `graphQLPublicIntrospection` set to `false`. Error messages generated during variable coercion continue to provide schema-derived suggestions, bypassing the introspection-hardening control. An unauthenticated user with the public application id can iteratively recover hidden schema identifiers, such as Parse class and field names and registered Cloud Code function names, by submitting queries or mutations with near-miss enum values or input-object field names. **Recommendations** Update to version 9.10.0-alpha.4 or later. Update to version 8.6.85 or later.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** An issue exists in the 'POST /private/admin stats' endpoint where the `limit` parameter is extracted from an unvalidated request body and inserted directly into Cloudflare Analytics Engine SQL queries using template literals. An attacker with platform admin credentials can use this to inject SQL fragments, allowing them to enumerate dataset schemas, extract analytics data, or cause a denial-of-service against the analytics backend. **Recommendations** Update to version 12.128.2 or later. Avoid using the `limit` parameter in the 'POST /private/admin stats' endpoint until the update is applied.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** An information disclosure issue exists in the unauthenticated '/private/sso/check-domain' endpoint. The endpoint returns internal `org id` and `provider id` values, allowing attackers to enumerate email domains to create mappings of domains to organization UUIDs and SSO provider identifiers for reconnaissance against tenants. **Recommendations** Update to version 12.128.2 or later. Restrict access to the '/private/sso/check-domain' endpoint to minimize the risk of information disclosure.

**Name of the Vulnerable Software and Affected Versions** LiquidJS versions prior to 10.27.1 **Description** The pop array filter at src/filters/array.ts allocates a full clone of its input array using `[...toArray(v)]` without calling `this.context.memoryLimit.use(...)`. This allows a template render, such as `{{ huge array | pop }}`, to allocate an O(N) clone of an attacker-influenced array that bypasses the configured `memoryLimit` budget. **Recommendations** Update to version 10.27.1.

**Name of the Vulnerable Software and Affected Versions** Mistune versions prior to 3.3.0 **Description** A Python Markdown parser with renderers and plugins contains an issue where a Markdown document with numerous repeated or distinct reference-link definitions triggers quadratic work within `src/mistune/block parser.py` and the `ref links` environment dictionary handling. This can lead to a denial of service through CPU exhaustion. **Recommendations** Update to version 3.3.0.

**Name of the Vulnerable Software and Affected Versions** Mistune versions prior to 3.3.0 **Description** The `safe url` filter in `src/mistune/renderers/html.py` fails to block several legacy or chained URI schemes. While it restricts `javascript:`, `vbscript:`, `file:`, and `data:`, it allows schemes such as `feed:`, `view-source:`, `jar:`, `livescript:`, `mocha:`, `ms-its:`, `mk:`, and `res:` to be included in rendered `href` and `src` attributes. This could allow the execution of scripts in affected user agents. **Recommendations** Update to version 3.3.0.

**Name of the Vulnerable Software and Affected Versions** Mistune versions prior to 3.3.0 **Description** The `toc` plugin and `TableOfContents` directive generate heading IDs using predictable `toc N` values instead of slugifying the heading text. This allows attacker-controlled content with `id="toc N"` to collide with generated anchors, which can redirect same-page navigation, CSS selectors, or JavaScript handlers. **Recommendations** Update to version 3.3.0.

**Name of the Vulnerable Software and Affected Versions** Mistune versions prior to 3.3.0 **Description** A denial of service issue exists in the default parsing process. Long sequences of well-formed double-asterisk or triple-asterisk emphasis pairs around a character cause quadratic work in `src/mistune/inline parser.py` because the parser scans forward for matching close markers from every potential opening run. **Recommendations** Update to version 3.3.0.

**Name of the Vulnerable Software and Affected Versions** Craft CMS versions 4.0.0-RC1 through 4.17.14 Craft CMS versions 5.0.0-RC1 through 5.9.21 **Description** An issue exists in the `AssetsController::actionDeleteFolder()` function where the system only verifies the `deleteAssets:<volume-uid>` permission for the target folder. It fails to enforce the `deletePeerAssets:<volume-uid>` permission, despite the `Assets::deleteFoldersByIds()` function cascading the deletion to all descendant folders and assets regardless of the uploader's privileges. Consequently, a low-privilege user with folder-management rights on a shared volume can delete assets uploaded by other users, bypassing the peer-permission checks implemented in the `actionDeleteAsset` endpoint. **Recommendations** Update to version 4.17.15 Update to version 5.9.22

**Name of the Vulnerable Software and Affected Versions** Fleet DM (affected versions not specified) **Description** An issue exists in the global policy read endpoint `GET /api/latest/fleet/policies/{policy id}` where authorization is performed against an empty structure with a nil `TeamID`. This allows the system to fetch any policy by ID from the database without verifying if the policy belongs to the global scope. Consequently, an authenticated user with observer-level access to any single team can bypass team isolation to read full details of policies belonging to any other team. This includes access to SQL queries, host pass/fail counts, and software installer or script metadata. The flaw is located in the `GetPolicyByIDQueries()` function, which fails to perform post-fetch team verification. **Recommendations** Implement a post-fetch check in the `GetPolicyByIDQueries()` function to verify that the returned policy is a global policy by ensuring the `TeamID` is nil. If the `TeamID` is not nil, the request should be denied. As a temporary mitigation, restrict access to the `GET /api/latest/fleet/policies/{policy id}` endpoint to only highly trusted administrators.

**Name of the Vulnerable Software and Affected Versions** Capgo versions prior to 12.128.2 **Description** A cross-domain Single Sign-On (SSO) account takeover issue exists in the 'provision-user' endpoint. The system fails to validate SSO provider domain authorization, allowing the merging of arbitrary victim accounts based on email matches. An attacker with enterprise organization administrator access and a malicious Identity Provider (IdP) can forge Security Assertion Markup Language (SAML) assertions—an XML-based standard for exchanging authentication and authorization data—containing victim email addresses to trigger an account merge and gain full access to victim accounts, organizations, and data. **Recommendations** Update to version 12.128.2 or later.

**Name of the Vulnerable Software and Affected Versions** @actual-app/sync-server versions prior to 26.6.0 **Description** An authorization asymmetry exists in the `@actual-app/sync-server` component of Actual. In OpenID multi-user deployments, the `GET /secret/:name` endpoint only verifies that a user has a valid session but fails to verify if the user has administrative privileges. In contrast, the sibling `POST /secret/` handler correctly enforces an admin check. This allows any authenticated non-admin (BASIC) user to probe the secrets store by observing the HTTP response codes (204 for configured, 404 for missing). Consequently, an attacker can enumerate which admin-managed bank-sync integrations are configured, including `simplefin accessKey`, `pluggyai clientSecret`, `pluggyai itemIds`, and `gocardless *` secrets. This disclosure is limited to the existence of the secrets and does not reveal their actual values. **Recommendations** Update @actual-app/sync-server to version 26.6.0.

**Name of the Vulnerable Software and Affected Versions** Actual versions prior to 26.6.0 **Description** Actual is a local-first personal finance tool that fails to neutralize formula-trigger characters when exporting data to CSV. The functions `exportToCSV()` and `exportQueryToCSV()` in `packages/loot-core/src/server/transactions/export/export-to-csv.ts` pass user-controlled strings from the `Payee`, `Notes`, `Account`, and `Category` variables to the `csv-stringify` library without a cast callback. Consequently, strings starting with `=`, `+`, `-`, `@`, tab, or carriage return are written verbatim into the CSV file. When a user opens the exported file in spreadsheet software such as Microsoft Excel, LibreOffice Calc, or Google Sheets, these strings are interpreted as formulas. This can lead to the exfiltration of sensitive transaction data (such as amounts, account names, and balances) to an attacker-controlled URL via functions like `=HYPERLINK`, `=WEBSERVICE`, or `=IMPORTXML`. Additionally, it allows attackers to manipulate displayed values in the spreadsheet or potentially achieve remote code execution on older versions of Excel through Dynamic Data Exchange (DDE). **Recommendations** Update Actual to version 26.6.0. As a temporary mitigation, avoid importing files from untrusted sources and restrict the use of the CSV export feature until the update is applied.