Raysabee

An authorization bypass exists in the by-id read endpoints within `src/main/kotlin/nl/info/zac/app/zaak/ZaakRestService.kt` because they omit the `assertPolicy`(`policyService.readZaakRechten(zaak).lezen`) check. While `RequestAuthorizationFilter` and `hasAnyApplicationRole` verify a general application role, they do not validate the specific case type, and the `zaak-rechten.rego` policy is not invoked to enforce the `zaaktype allowed` boundary. Consequently, an authenticated low-privileged municipal user with a case or decision UUID can access unauthorized data through the following endpoints: - '/rest/zaken/besluit/zaakUuid/{uuid}' using `listBesluitenForZaakUUID` to read decisions, types, dates, and free-text toelichting. - '/rest/zaken/besluit/{uuid}/historie' using `listBesluitHistorie` to read audit old and new values. - '/rest/zaken/{uuid}/process-diagram' using `downloadProcessDiagram` to read BPMN workflow state. - 'zaak/{uuid}/afzender' using `listAfzendersVoorZaak` to expose zaaktype mailbox configuration.

An issue exists where a non-superuser API token with read access to a single ObjectType can access the full versioned record of objects belonging to any other ObjectType. This occurs via the `GET /api/v2/objects/{uuid}/{index}` endpoint. The `history detail` action in `src/objects/api/v2/views.py` bypasses necessary permission checks by calling `self.get queryset()` and `get object or 404` instead of `self.get object()`, which prevents the execution of `check object permissions` and the `ObjectTypeBasedPermission.has object permission` check. Consequently, the `data` of versioned objects, potentially including sensitive citizen or case records, can be disclosed.

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, an attacker with authenticated access could potentially exfiltrate sensitive data from the database. This issue has been patched in version 0.93.1.

OpenMRS module bahmnicore contains Core OpenMRS modules for Bahmni (including ERP & ELIS Atom Feed Clients). In version 0.93, there is insufficient validation of input paths during the admin CSV import process, allowing for potential arbitrary file write. This issue has been patched in version 0.93.1.

mcp-pinot is a Python-based Model Context Protocol (MCP) server for interacting with Apache Pinot. The software defaults to running an HTTP MCP server bound to 0.0.0.0:8080 without authentication. This allows any network-adjacent caller to access all MCP tools, including SQL query execution, schema creation, and table-config mutation. The server proxies these requests using server-side Pinot credentials, creating a confused-deputy condition—where a privileged entity is tricked into performing actions on behalf of an unauthorized user—resulting in full read and write access to the configured Pinot cluster.